Privacy policy

1. Controller

ligea GmbH, Hardtstraße 37a, 76185 Karlsruhe, Germany. Contact: [email protected]. We have not appointed a data protection officer, as there is no legal obligation to do so.

2. Browsing the site

Browsing the overview requires no account and sets no tracking cookies. To see how the site is used we use Cloudflare Web Analytics. It works without cookies, does not store IP addresses and creates no user profiles; it counts page views, referring sites, countries and device types (Art. 6 (1) (f) GDPR). Cloudflare delivers and protects the site and processes connection data (IP address, time, requested page) for this purpose, legal basis Art. 6 (1) (f) GDPR. Fonts and scripts are served from our own domain. Map tiles are loaded from OpenFreeMap (tiles.openfreemap.org), which receives your IP address when the map is shown.

3. Early access and enquiries

When you request access or send an enquiry, we store your email, company, trade, note, the page you came from, a hashed form of your IP address and your browser type, in order to reply and prepare your access (Art. 6 (1) (b) and (f) GDPR). Storage: Supabase, EU region (Frankfurt).

4. Accounts

For each seat holder we store the email address, role, organisation, plan, credit balance, opened files, watch list and the dates of these actions, to provide the contract (Art. 6 (1) (b) GDPR). When you create an account we also store your name, your company if you give it, and the time you accepted the terms. Sign-in works with a one-time link that we send to your email address and that expires after 15 minutes; we store only a hashed form of it. After sign-in we set a session cookie (hr_session, 30 days) that is technically necessary (§ 25 (2) TDDDG). To protect the data against bulk extraction we count file and name views per account and day.

4a. Newsletter and weekly emails

If you subscribe to The Radar Weekly, we store your email address, the time of subscription and confirmation, the consent text, the page you came from and a hashed form of your IP address. We send the newsletter only after you confirm the link in our confirmation email (double opt-in), legal basis your consent (Art. 6 (1) (a) GDPR). Account holders receive a weekly email about the projects, companies and cities they watch, as part of the service (Art. 6 (1) (b) GDPR). Every email contains a link to unsubscribe with one click; you can also write to [email protected]. We keep the address with a note of the unsubscription for as long as we need to prove consent, at most three years. Emails are sent through Resend.

4b. AI access (MCP connector)

If you connect Hospitality Radar to an AI assistant such as Claude, ChatGPT or Grok, the assistant sends tool calls to our server, for example a city, a project type or a project reference, and receives our answer. We do not receive your conversation with the assistant, only these calls, and we do not keep a record of what was searched. We count searches per account for the daily limit and delete these counts after one day, and we store when an access key was last used. Files you open and watch list entries you set through the assistant are stored in your account as described in section 4. Access keys are created in your account, or when you connect with OAuth, in which case the key is labelled with the name of the assistant. We store only a hashed form of each key, and you can revoke a key at any time under "AI access" in your account. How the assistant provider handles your conversation is governed by that provider's terms and privacy policy. Legal basis Art. 6 (1) (b) GDPR.

5. Payments

Payments are processed by Stripe Payments Europe Ltd., Dublin. Stripe receives name, billing address, email, VAT ID and payment details and acts as an independent controller for payment processing. We receive the payment status, invoice data and a customer reference. Invoices are kept for the statutory retention periods (Art. 6 (1) (c) GDPR).

6. Referral links

If you arrive through a partner link, we store the partner code in a first-party cookie (hr_ref, 90 days) and, if you buy a plan, assign your account to that partner to calculate commission. The partner sees your company name and plan, not your usage. Legal basis Art. 6 (1) (f) GDPR. We also store in a first-party cookie (hr_src, 90 days) how you first reached the site: directly, from a search engine, from another website (its domain) or from a campaign link (utm parameters). We use this only to attribute a later purchase to the right sales channel; it is not shared and not used for profiling. Legal basis Art. 6 (1) (f) GDPR.

7. Data in files

Files contain information about companies and hotel projects from public sources. For companies they include business contact details (registered address, switchboard, general email such as info@, website) and the names and functions of managing directors or board members as published in the company's legal notice or in the commercial register, each with its source. Files do not contain personal email addresses, direct dials or mobile numbers. The legal basis is our legitimate interest in informing about hotel projects and the companies involved (Art. 6(1)(f) GDPR). Persons named may object at any time (Art. 21 GDPR): write to [email protected] and we remove the information without delay. If you believe a file contains other information about you as a natural person, write to us as well and we remove it.

7a. Supplier profiles

We list companies that supplied hotel projects, each entry with a public source (press, trade media, the company's own reference pages). This concerns companies, not people. To invite a company to check its entries, we email one business address per company: the business address of a person in a management, sales or projects role, and only exceptionally a shared address published by the company. We take the person's name and role from the company's legal notice or website, a company register or press releases. We found the address on the company's website or through a business contact database (Hunter, Hunter Web Services Inc.), or derived it from the address format the company itself uses, and checked that it is deliverable (MillionVerifier). If you ask, we tell you the specific source of your name and address. Legal basis: our legitimate interest in accurate supplier data and in offering our service to businesses (Art. 6(1)(f) GDPR / UK GDPR). We keep the address until you unsubscribe or for at most 12 months after our last email. Every email has a link to stop further emails, and a short reply works too. We do not track whether you open an email.

On the profile page, the company can name contact persons. A person is stored only when the company ticks the consent box, and shown only after that person confirms by email themselves (Art. 6(1)(a)). Without confirmation we delete the entry after 30 days. Consent can be withdrawn at any time through the same link, without any effect on the company profile. Radar users who can see a confirmed contact are companies supplying hotel projects, which can include competitors.

When a company has completed its profile, a member of our team looks at the company's entries, its profile details and whether it already has a Radar account or plan. A person, not an automated system, then decides whether we offer the company a time-limited Radar access, and we keep that decision with its reason. We may then email the same business address once to thank the company, and, if we offered access, once more shortly before it ends. Access ends by itself, needs no payment details, and the account returns to the free Explorer plan. Legal basis: our legitimate interest in offering our service to businesses (Art. 6(1)(f)). We record which links were clicked, whether the profile was opened and completed, which project files were opened during the access and whether a plan was chosen, to see which offers are useful.

Reference lists uploaded by a company are used under the permission given on upload. Please do not include names of people. In the UK you can also complain to the Information Commissioner's Office (ICO).

8. Processors

9. Your rights

You have the right to access, rectification, erasure, restriction, data portability and to object to processing based on legitimate interests, and the right to lodge a complaint with a supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (LfDI BW).

10. Retention

Account data is deleted three months after the end of the contract, unless statutory retention applies. Enquiries without a contract are deleted after twelve months.