Who we are
Responsible Entity: Layla AI GmbH
Official Address: Belziger Straße 69-71, 10823 Berlin, Germany
Managing Directors: Saad Saeed
Contact for Inquiries: Reach us at help@layla.ai
Legal Registration: Registered under the Berlin District Court
Commercial Register number HRB 247135 B
Key Terms Explained
Personal data means any information that can identify you directly or indirectly. Processing covers everything done with personal data — collection, storage, use, disclosure and deletion.
Profiling: automated processing of personal data to evaluate certain personal aspects, such as preferences or behavior.
Controller and processor: Layla AI GmbH is the controller — we decide why and how your data is processed. Processors are companies that process data on our documented instructions.
Data We Process
Account data: email address, name, profile photo, sign-in provider (Google, Facebook, Apple or email), optional phone number, language, currency and unit preferences, your approximate location derived from your IP address (city, country), and a record of your consent choices.
Your search requests: the free-text hotel searches you type, the structured interpretation our AI derives from them (destination, dates, guests, budget, preferences), your saved search history, and related metadata such as timestamps. Search is free text — please share only what is needed to find your stay; anything you choose to write becomes part of your stored search history.
Bookings and saved hotels: destinations, stay dates, room selections, wishlists of hotels you save, and the guest details you add for bookings (names, email address, phone number). If you provide details of co-travelers, you confirm that you are entitled to share them with us.
Payment data: payments are processed by Stripe. We never store card numbers — we keep only customer and transaction references and records of completed transactions.
Usage and technical data: product events (pages and features used, experiments), device and browser information, server log files kept briefly for security, error reports and support conversations.
Marketing data: your email address and marketing preferences, together with records that evidence your consent.
Sensitive Information
Bellboy is not designed to collect special categories of personal data within the meaning of Art. 9 GDPR — such as information revealing health, religious or philosophical beliefs, ethnic origin, political opinions or sexual orientation. Please do not enter such information into the free-text search unless it is genuinely needed for your stay.
If you do choose to share it — for example a mobility-related accessibility requirement for your room — you explicitly consent to us processing it for the limited purpose of arranging your stay (Art. 9(2)(a) GDPR), and we process only what is needed to fulfil your request.
We do not use special-category data for profiling, analytics or advertising, and you can withdraw your consent or ask us to delete it at any time via help@layla.ai.
Why We Process Your Data (Legal Bases)
Providing the service — your account, searching for hotels, saving searches and wishlists: performance of our contract with you (Art. 6(1)(b) GDPR).
Bookings and payments, and keeping transaction records: contract performance and our legal obligations (Art. 6(1)(b) and (c) GDPR).
Service security, log files and abuse prevention: our legitimate interest in a secure and reliable service (Art. 6(1)(f) GDPR).
Product analytics, A/B testing and error monitoring: our legitimate interest in improving Bellboy, and your consent where required (Art. 6(1)(a) and (f) GDPR).
Marketing communication and advertising measurement: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
Administration, accounting and legal compliance: our legal obligations and legitimate interests (Art. 6(1)(c) and (f) GDPR).
AI Processing
Bellboy is an AI hotel finder. Providing the service inherently involves AI processing of what you share:
Your search requests and the profile information you choose to add are processed by large-language-model systems — operated by our AI providers, Google (Gemini) and OpenAI — to interpret your request, match it to hotel search criteria and generate your results in real time.
Transparency: the interpretation of your search and the recommendations Bellboy shows you are generated by an AI system, not by a human. We make this clear in line with the transparency requirements of the EU AI Act.
Training: we do not use your personal data to train or fine-tune our own AI models. The AI providers that process your requests on our behalf act as our processors under Art. 28 GDPR and do not use your content to train their models — they use it only to generate your results, in line with their API terms and our data processing agreements.
We may derive travel-preference information (for example preferred travel styles or destinations) from what you share, to improve your suggestions. This constitutes profiling within the meaning of Art. 4(4) GDPR; it produces no legal or similarly significant effects for you.
AI output consists of suggestions only — no decision with legal or similarly significant effect is made automatically about you.
Accuracy: AI can make mistakes. The results, recommendations and hotel details Bellboy generates may be incomplete, out of date or inaccurate, so please verify important information — such as prices, availability and property details — before you rely on or book anything.
How We Analyze Your Searches
Beyond answering your search in the moment, we analyze searches to operate and improve Bellboy:
Service quality: we use AI tools to understand how users experience Bellboy — including the feedback you give on search results — so we can fix problems and improve the product. These analyses run with identifiers removed where possible, and their results are kept only for a limited period.
Travel personality analysis: we use AI to build a travel-personality profile from your searches, saved hotels and bookings — your likely travel styles, interests and preferences, such as whether you lean toward adventure, culture or relaxation — so we can tailor recommendations and insights to you. This is profiling within the meaning of Art. 4(4) GDPR; it produces no legal or similarly significant effects for you, and you can opt out at any time via the "Travel profiling" option in your cookie and consent settings.
Our staff may access searches and bookings connected to your support or booking requests, under confidentiality obligations and access controls.
Sharing Your Wishlists
Bellboy lets you share the wishlists of hotels you save. You stay in control of what you share and with whom.
When you share a wishlist via a link, anyone who has that link can view the hotels it contains — so share only with people you trust.
Sharing a wishlist does not expose your name, your account details, your searches or your payment information.
Who Receives Your Data
We use carefully selected service providers, bound by data processing agreements under Art. 28 GDPR:
Infrastructure and hosting: Google (Firebase authentication, database, cloud storage), Vercel (hosting).
Payments: Stripe.
AI processing: Google (Gemini) and OpenAI. These providers act on our instructions and do not use your data to train their models.
Communication and support: Braze (transactional and marketing emails), Intercom (support chat).
Analytics and advertising, with your consent where required: Google Analytics, Microsoft (Clarity, Bing), Meta, Pinterest.
Maps and places: Mapbox, Google Maps; error monitoring by Sentry.
Hotel supply and booking fulfilment: hotel content, availability, rates and booking processing are provided by Expedia Group (Rapid API). When you book, we share the reservation details necessary for fulfilment — your name, contact details, stay dates and room selection — with Expedia Group and with the property you book (Art. 6(1)(b) GDPR).
Custom Audiences (Meta): with your consent, we share a hashed (SHA-256) version of your email address with Meta to show you and similar audiences more relevant ads. You can withdraw this at any time via help@layla.ai.
Advisors and authorities: financial and legal advisors, and public authorities where we are legally required to disclose data (Art. 6(1)(c) and (f) GDPR).
International Data Transfers
Many of our providers process data in the United States, and our database infrastructure runs on Google Cloud in a US region.
Where data is transferred outside the EU/EEA, we rely on an adequacy decision — such as the EU-US Data Privacy Framework for certified providers — and on EU Standard Contractual Clauses otherwise or in addition (Art. 44 ff. GDPR).
How Long We Keep Your Data
Your account data, search history, wishlists and bookings are kept for as long as your account exists, so you can come back at any time and continue planning. You can request the deletion of your account and data at any time (see Your Rights and Controls).
Booking and payment records are kept after account deletion for as long as commercial and tax law requires.
Server log files are kept for security purposes for a short period (currently up to 7 days).
Analytics data follows the retention settings of the respective tools (for example Google Analytics: 14 months).
Results of internal search and feedback analyses are kept for a limited period and then deleted.
After you withdraw your consent to marketing emails, we may keep your email address for up to three years solely to evidence your previous consent.
Your Rights and Controls
You have the following rights regarding your personal data, and we make exercising them as simple as possible:
Access and portability: you can request a copy of your personal data — including in a machine-readable format — at any time via help@layla.ai (Art. 15 and 20 GDPR).
Deletion: you can request the permanent deletion of your account, searches, wishlists and bookings at any time via help@layla.ai. Data we are legally required to keep — for example transaction records — is excluded (Art. 17 GDPR).
You also have the rights of rectification (Art. 16), restriction of processing (Art. 18) and data portability (Art. 20 GDPR). For anything not covered in the product, contact help@layla.ai.
Objection (Art. 21 GDPR): you may object at any time to processing based on our legitimate interests.
Withdrawal (Art. 7(3) GDPR): you may withdraw any consent at any time, with effect for the future.
Complaint (Art. 77 GDPR): you may lodge a complaint with a supervisory authority — for us, the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).
We respond to requests within one month.
Marketing Emails
We send marketing emails only with your consent — for example via the optional marketing checkbox at sign-up. The time of your consent is logged to evidence it (Art. 6(1)(a) and 7 GDPR).
Every marketing email contains an unsubscribe link. Unsubscribing takes effect immediately.
Cookies and Tracking
We use cookies and similar technologies to operate the service (for example to keep you signed in) and — with your consent where required — for analytics and advertising measurement.
You can manage or delete cookies in your browser settings (this may affect functionality) and adjust your tracking choices at any time via the cookie banner and the cookie settings.