Privacy Policy

1. Who is responsible for your data

The data controller is GCI Solutions Ltd, a company registered in England and Wales under company number 09806862, with its registered office at C/O Cloud Business Hub, 23 Sangley Road, London, England, SE25 6QT, United Kingdom. We operate secretselects.com. For anything in this policy, contact privacy@secretselects.com.

We process personal data under UK data protection law: the UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).

2. The data we process, and why

Here is the full picture. There is nothing processed beyond this table.

We do not sell personal data. We use no advertising cookies. We do no profiling that produces legal effects.

3. Travel memory is opt-in

If you consent, the planner remembers useful things about how you travel: who you usually travel with, preferences, and spend ranges. Two things are worth knowing.

First, it is genuinely off until you turn it on. Consent is recorded with a timestamp when you give it, and without that record the feature is inert. Nothing is remembered.

Second, spend is stored as bands only, never as figures. The planner might know you tend toward a certain range for stays; it never stores what you actually paid for anything.

You can withdraw consent at any time, and withdrawing is as easy as giving it.

4. Your controls, built in

Your profile includes a transparency panel showing everything travel memory holds about you. From there you can delete any single row, export the lot as JSON, or delete everything in one action. These controls are never behind a paywall and never will be. They implement your rights of access, erasure, and portability directly, without a form or a waiting period.

5. Analytics, only if you accept

We use PostHog for product analytics, hosted in the EU (eu.posthog.com). PostHog runs only after you choose Accept on the cookie banner. If you decline, no analytics cookies or storage are set, no events are sent, and the site works exactly the same. Declining is one click, the same as accepting.

6. Payments

Pro subscriptions are billed through Stripe. Your card details go straight to Stripe and never touch our servers. We see subscription status, not card numbers.

7. Emails

Deal alerts and transactional emails (such as booking-related messages) are sent through Resend. Alerts exist because you created them, and every alert email carries an unsubscribe link that we honour.

8. Hotel bookings

When you book a stay inside SecretSelects, we pass the details the booking needs (guest name, dates, property) to LiteAPI so the reservation can be made. Payment goes to LiteAPI and the property side, not to us.

9. Affiliate links and click records

When you click out to a partner, we record the click with a SubID that identifies your user account, the trip, and the slot on the page. We and the partner network (Travelpayouts and others) use this to attribute commission if you book.

One honest note on retention: if you delete a trip, its itinerary, conversations, messages, and travel-memory rows are deleted with it, but click events are kept. They are our record of commission earned and we need them for revenue accounting. After trip deletion the click record no longer links to any trip content, because that content is gone.

10. AI processing

Your chat messages with the planner are processed by Anthropic's AI models, sent via Anthropic's API directly or through Vercel's AI Gateway. This is how the planner generates its responses. It is part of providing the service, not a secondary use.

11. Hosting

The site runs on Vercel, which processes server logs and request data as part of hosting it.

12. International transfers

Some of our processors are outside the UK: Anthropic (US), Vercel (US and global), Stripe (US), Clerk (US), and partners in the Travelpayouts network. Where personal data leaves the UK we rely on standard contractual safeguards: the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses. PostHog analytics data stays in the EU.

13. How long we keep data

We keep personal data while your account is active and for as long as the purpose in section 2 requires. Deleting a trip deletes its contents (section 9 describes the one exception, click records). The transparency panel's delete-all removes travel memory immediately. To close your account entirely, contact us at privacy@secretselects.com.

14. Your rights

Under UK GDPR you can ask us for access to your data, correction, erasure, restriction of processing, a portable copy, and you can object to processing based on legitimate interests. For travel memory, the transparency panel handles access, export, and erasure directly; for anything else, email privacy@secretselects.com and we will respond within one month.

If you think we have handled your data badly, you can complain to the Information Commissioner's Office at ico.org.uk. We would appreciate the chance to put it right first, but you do not need our permission to go to the ICO.

15. Cookies

We keep cookies minimal. There are two kinds here: strictly necessary cookies, which the site needs to function and which do not require consent, and analytics cookies, which are set only after you accept them.

There are no advertising or third-party marketing cookies on SecretSelects.

16. Changing your cookie choices

You can change your mind at any time using the "Cookie choices" control in the site footer. Switching from Accept to Decline stops analytics from that point on.

17. Children

SecretSelects is not directed at under-18s, and you must be 18 or over to book travel through it. We do not knowingly collect data from children.

18. Changes to this policy

When we change how we process data, we will update this policy and the date at the top. For significant changes we will tell you before they take effect.

19. Contact

Privacy questions, rights requests, anything in this policy: privacy@secretselects.com. Post: GCI Solutions Ltd, C/O Cloud Business Hub, 23 Sangley Road, London, England, SE25 6QT, United Kingdom.