Privacy Policy

CustomRates (the "Service"), operated by Sentrics, s.r.o. ("we", "us", or "our"), tells travelers which hotel loyalty discounts and perks apply to a booking, and lets them connect that benefit picture to an AI assistant. This policy explains what personal data we process and your rights over it.

Our model is built to minimise sensitive data. Specifically:

• We never handle prices. We do not fetch, compute, or store hotel prices or final rates — only discount percentages, perks, conditions, and estimated perk values.
• We never read your logged-in third-party sessions (e.g. your Booking.com or hotel-website account). The browser extension does not scrape or transmit those sessions.
• We never sell your personal data, and we do not collect payment card numbers, government IDs, health data, or your third-party account passwords.

We collect only what the Service needs to function:

• Account data — your email address and authentication credentials, to create and secure your account.
• Membership vault — the loyalty programs and perks you add (e.g. "Marriott Platinum"). Any membership secret you store is encrypted at rest and is never logged or returned in decrypted form.
• MCP connection token — when you connect an AI assistant, we store a hashed token mapping your personal MCP URL to your account. The URL itself is the credential; you can rotate or revoke it at any time.
• Usage analytics — which provider or perk surfaced in a lookup, recorded against a one-way hash of your user ID (not your identity), so we can show benefit ROI. No prices, no booking contents.
• Operational logs — request metadata and correlation IDs for reliability and security, retained for a limited period.

• To provide the Service: match your memberships to applicable benefits.
• To let your AI assistant retrieve your benefit picture via the MCP connector.
• To secure accounts, prevent abuse, and debug failures.
• To bill hotel/provider subscriptions (travelers are free).

We share data only with the processors needed to run the Service, under data-processing terms:

• Microsoft Azure — hosting and database (EU region).
• Stripe — subscription billing for hotel/provider plans (we never see full card numbers).
• Anthropic / OpenAI — an AI assistant you connect retrieves your benefit data through the MCP connector, at your direction.

When you add CustomRates as a connector in ChatGPT or Claude, those platforms receive only the discount/perk/condition data their request returns — never prices, and never your stored membership secrets.

We keep account and membership data for as long as your account is active. Operational logs and hashed usage analytics are retained for a limited period (typically up to 12 months) and then deleted or aggregated. When you delete your account, we delete or irreversibly anonymise your personal data within a reasonable period, except where retention is required by law.

You can, at any time:

• Rotate or revoke your MCP URL from your dashboard, instantly cutting off any connected assistant.
• Edit or remove memberships from your vault.
• Access, export, or delete your account data by contacting us.
• Object to or restrict processing, where applicable law (e.g. GDPR) grants that right.

Membership secrets are encrypted at rest and never printed, logged, or returned decrypted. We use managed, access-controlled infrastructure and prefer managed identities over long-lived keys. No system is perfectly secure, but we design to minimise the data at risk in the first place.

The Service is not directed to children under 16, and we do not knowingly collect their personal data.

We may update this policy. Material changes will be communicated via email or a prominent notice on the Service before they take effect. Continued use after the effective date constitutes acceptance of the revised policy.

For privacy questions or to exercise your rights, contact us at info@customrates.online (data protection: info@customrates.online), or write to Sentrics, s.r.o..