Privacy policy

Last updated: 21 October 2026. This page is also available in German: Datenschutzerklärung.

1. Who is responsible

Controller under the GDPR (a private person, not a company):
Marcel Fonseca Santana
Krauser Baum 18d
24568 Kaltenkirchen
Germany
Email: msan889921@gmail.com
See also the imprint.

2. In short

Borderbasket is a private, non-commercial hotel price comparison. It has no advertising and uses no third-party tracking or analytics service (no Google Analytics); we only run our own cookie-free visitor statistics (section 3.2a), and we do not sell data. You need a free account to search. We process only the data needed to run the search, to keep the service secure and to apply a fair-use limit.

3. Data we process, why, and on what legal basis

3.1 Visiting the website

The pages are delivered by Google Firebase Hosting. The hosting provider processes technical data such as your IP address, browser type and the time of the request to deliver and secure the pages. Legal basis: our legitimate interest in a working, secure website (Art. 6(1)(f) GDPR).

3.2a Visitor statistics (without cookies)

When you open a page, our own server records: the time, the page, the page you came from (referrer), your IP address, your approximate location derived from the IP address (country and city, using a local database from DB-IP.com, no data is sent to anyone), your internet provider, browser, operating system, device type, screen size, language and time zone, your clicks on links and buttons, and the search terms you enter into our search. A short randomly generated page ID (not stored in your browser) links these events during the visit; we do not set cookies and do not store anything on your device. If you are signed in, the events are linked to your account. We use this to see how many people use the site, where they come from, which pages and functions work, to find errors and to detect abuse and bots. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). You can object at any time, see section 8; contact us and we will exclude and delete your data. IP location data by DB-IP.com (CC BY 4.0).

3.2 Account and sign-in

You sign in with Google or with a link sent to your email address (Google Firebase Authentication). We receive and store your account ID, email address, name (with Google sign-in), the sign-in method and the dates of creation and last sign-in. Legal basis: providing the service you ask for (Art. 6(1)(b) GDPR).

3.3 Searches

When you search, our server (operated by a hosting provider in the EU) processes and logs: your account ID and email address, the hotel name and place you searched for, the travel dates, number of guests, the result (for example how many offers were found and the cheapest), the time, your IP address and browser identification, and your daily number of searches. Purpose: to provide the search, to apply the fair-use limit (40 searches per day), to find errors and to keep the service secure. Legal basis: Art. 6(1)(b) and (f) GDPR. We delete or anonymise logs that are no longer needed. The names of hotels that have been searched (without any information about who searched) can appear in the list “Recently searched hotels” on the home page.

3.4 Where the prices come from

To compare prices, our server sends only the hotel name, place and travel dates, without any personal data about you (no IP address, account or email), to an external search-data service provider (USA), which reads the public Google Hotels page and returns the offers of the booking sites. Results are kept for up to 30 minutes so that repeated searches are faster. In addition, our server may open public hotel pages of Booking.com in the background through internet connections of a network service provider in several countries, to check whether the booking country changes the price. Only hotel names and travel dates are used; none of your personal data is passed on.

3.5 Your feedback

If you tell us that a price differed, we store the offer, the price shown and the price you saw, together with your account ID, to improve the comparison. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

Dashboard, price alerts and emails. Your account page shows your recent searches. If you press “Watch this price” or “Email me this comparison”, we store the hotel, the travel dates and the latest prices with your account ID and email address, check the price regularly and email you at your own address when it drops. Every email contains a link to turn notifications off. Legal basis: your request (Art. 6(1)(b) GDPR). We send emails through our own mail account or a mail service provider that only receives your email address and the email text. You can delete alerts in your dashboard at any time.

3.6 Links to booking sites

If you click “View offer”, you leave our website. The privacy policy of that website applies there. We currently use no partner or affiliate links and earn no commission. If this changes, we will say so on the page and here.

3.7 Optional browser extension

If you use the optional “Borderbasket VPN” extension, we additionally process the Booking.com host names you open and the amount of data transferred, to apply a daily data limit. Details: privacy policy of the extension.

4. Cookies and local storage

We use only what is technically necessary: your sign-in session (Google Firebase, stored in your browser’s local storage or IndexedDB), your language setting and a few remembered inputs. We use no advertising, tracking or analytics cookies and no third-party fonts or scripts for tracking. Because this storage is strictly necessary to provide the service you request, no consent banner is needed (Section 25(2) no. 2 TDDDG). You can clear this data in your browser at any time; you will then be signed out.

5. Who receives data

We have data processing agreements or equivalent terms where required. We do not sell your data.

6. Transfers outside the EU/EEA

Some recipients may process data in the United States. Where personal data is involved, we rely on an adequacy decision (for example the EU–US Data Privacy Framework) or on standard contractual clauses.

7. Retention

Account data is kept as long as your account exists. Search logs are kept only as long as needed for the purposes above and are then deleted or anonymised. If you ask us to delete your account, we delete your account data and the logs linked to it, unless the law requires us to keep something.

8. Your rights

You have the right to access, correct, delete and restrict the processing of your data, to receive it in a portable format, and to object to processing based on legitimate interests (Art. 15 to 21 GDPR). To use your rights, write to us using the contact details above. You also have the right to complain to a data protection supervisory authority, for example the one responsible for the controller: Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein, Holstenstraße 98, 24103 Kiel, Germany.

9. Security

Connections to our website and server are encrypted. Access to the server and its logs is limited to what is needed to run the service. Sign-in tokens are checked on every request.

10. Children

The service is not intended for people under 16 years of age.

11. Changes

We may update this policy, for example when the service changes. The date at the top shows the latest version.