Privacy policy

When you send a booking request, we pass the retreat your first name, your dates, the number of guests and your message. Your email address and phone number are not given to the retreat.

Replies go through RetreatBird: the retreat and the guest each write to an address of ours that belongs to that one booking, and we pass each message on to the other side, with any files attached up to a size limit. We do this to run the booking: so the two of you can talk, so we can help if anything goes wrong, and so we know whether the booking went ahead and at what price, which is what our commission from the retreat is based on. We keep a copy of these messages, and we may use automated processing to read the price stated in them. Anything you choose to write in a message, including your own contact details, reaches the other side as you wrote it.

With a booking request we also keep how you reached us: the name of the website you came from (not its full address), the first page you opened, any campaign tags in that page's address (such as utm_source), and your answer to “How did you find us?” if you give one. This is our legitimate interest in knowing which channels bring guests (Article 6(1)(f) GDPR). If you accept analytics cookies, a cookie called rb_ft also keeps this for your first visit after you accept, for up to 90 days, so a request you send later is counted too; “Reject all” deletes it.

If you add details through the optional “tell the retreat a little more” form (number of guests, flexible dates, room, budget, dietary needs, experience, questions), we pass them only to that retreat, through the same booking address, after removing any email address, phone number or link. While the retreat has not answered, we email you at most once a day, on days we contacted the retreat for you; reply “stop” to end these updates.

The legal basis is taking the steps you asked for with your booking request (Article 6(1)(b) GDPR) and, for keeping the messages and working out the commission, our legitimate interest in supporting both sides and being paid for the booking (Article 6(1)(f)).

Retention: we keep booking messages for 24 months after the stay ends, then delete them. The booking record itself (reference, dates, agreed price and commission) is kept for as long as tax law requires us to keep invoicing records, which in the Netherlands is 7 years.

Strictly necessary cookies are always on: the sign-in session for hosts and travellers, security, and one cookie called rb_consent that remembers your cookie choice for 6 months. The site cannot work without them.

Analytics cookies are used only if you choose “Accept all” (or switch analytics on in Cookie settings). We use two services: Google Analytics 4, provided by Google Ireland Limited, and PostHog, provided by PostHog Inc., a US company, with our data hosted on its EU cloud in Frankfurt, Germany. The legal basis is your consent (Article 6(1)(a) GDPR).

With analytics on, we also set one first-party cookie of our own, rb_ft, for up to 90 days: it remembers how you reached us on your first visit after you accept (the website you came from, the first page and any campaign tags) and is used only if you send a booking request (see “Booking requests and messages”). “Reject all” deletes it.

What they tell us: which pages are visited, where visitors come from (for example a search engine or a link), the type of browser and device, screen size, language and time zone, the approximate location derived from the IP address (Google Analytics only — Google does not store the IP address), clicks on buttons and links, the words typed into the retreat search box and the filters picked there, and which steps of a booking request, a listing claim or a company brief are reached. That is how we find out what helps people and what gets in their way. PostHog sees the IP address of each request, as any website does, but we never send it your IP address as part of the data, and we tell it not to work out your location from it.

What they never get: your name, email address, phone number, messages, or what you type into any other form (booking requests, company briefs, sign-in, the claim PIN). Email addresses are removed even from search words. Private parts of page addresses — claim links, PINs, sign-in codes, email addresses and similar — are removed in your browser before anything is sent. Session recording is switched off. Google’s advertising features, Google signals and ad personalisation are switched off, and we run no ads.

Hosts who are signed in to their dashboard and have accepted analytics are linked in PostHog to their listing account by an internal ID — never by name or email — so we can see which parts of the dashboard are used. Travellers are never identified.

Before you choose, PostHog may record anonymous page views and clicks without setting any cookie or storing anything on your device: a random number held only in the open tab links the pages viewed in it, and a new page load starts a new one. PostHog still receives your IP address with each request, as any website does. Google Analytics does not load until you accept. If you choose “Reject all”, both stay off and any analytics cookies are deleted.

Retention: analytics cookies expire after at most 6 months. PostHog also keeps a random identifier in your browser's local storage, which stays until you choose “Reject all” (we then delete it) or clear your browser data. Event data is kept for at most 14 months in Google Analytics and at most 12 months in PostHog, then deleted. Google may process data in the United States; Google LLC is certified under the EU-US Data Privacy Framework. PostHog stores our data in the EU and may access it from the United States under its data processing agreement with us.

If your browser sends a Do Not Track or Global Privacy Control signal, analytics stay off whatever you choose. You can change your mind at any time:

Cookie settings