Legal

Privacy Policy

Last updated: 3 August 2026

Who we are

direct.guide is built and operated by Your Brand Travel International AB (trading as Xbrandify), a company registered in Sweden with organisation number 559391-1018, based in Stockholm.

For anything in this policy, you can reach us at privacy@xbrandify.com.

What this policy covers

This policy explains what happens to personal data on direct.guide: what we collect, why, how long we keep it, and what rights you have.

It covers the direct.guide website and the concierge conversations that take place on it. It does not cover the websites of the hotels, tour operators and other businesses listed in the guide. Once you leave direct.guide, that business's own privacy policy applies.

Two different roles

This distinction matters, so it is worth stating clearly.

When you browse direct.guide, we decide what data is collected and why. In data protection terms we are the controller.

When you have a conversation with a place's concierge, that conversation belongs to the business you are talking to. They decide what happens with it. They are the controller, and we are the processor acting on their instructions. Each business has its own agreement with us covering this.

If you want to exercise your rights over a concierge conversation, you can contact the business directly, or contact us and we will pass your request to them.

What we collect

When you browse the site

• Pages visited, time spent, and how you arrived
• Approximate location, derived from IP address at country or city level
• Browser type, device type and language setting
• IP address

When you use a concierge

• The messages you send and the responses given
• Any details you volunteer in the conversation, such as travel dates, group size or preferences
• Whether the conversation led to a booking enquiry

We do not ask for and do not want special category data. Please do not include health information, religious or dietary requirements tied to belief, or similar details in a conversation. If you need to communicate something like that, contact the business directly.

When you contact us or apply to join the network

• Name, email address, company name and anything else you choose to write

Payments

We do not process payments on direct.guide. If you book something, that happens with the business or their payment provider, and we never see your card details.

Why we collect it

Where we rely on legitimate interest, we have considered whether it is fair to you. You can object at any time using the contact details above.

Cookies

We use cookies that are necessary for the site to work, and analytics cookies and local storage to understand how the site is used.

We do not currently show a cookie banner. Analytics are set when you arrive, and we rely on legitimate interest for them rather than asking for consent — the table above sets out that basis. They are never used for advertising.

You can block or clear cookies in your browser settings at any time, and the site will keep working. You can also object to analytics altogether using the contact details above.

Who we share data with

We share personal data only where there is a reason to:

• The business you are talking to. If you use a concierge, that conversation goes to them.
• Service providers who run parts of the platform for us, including hosting, AI language models, analytics and email delivery. They act on our instructions and cannot use the data for their own purposes.
• Authorities, if we are legally required to.

We do not sell personal data. We do not share it with advertisers.

Where data is stored

Our infrastructure is hosted in the European Union.

Some service providers, including AI model providers, may process data outside the EEA. Where that happens, we rely on the European Commission's Standard Contractual Clauses or an adequacy decision, and we check that appropriate safeguards are in place.

How long we keep it

• Analytics data: up to 26 months
• Concierge conversations: up to 24 months, or less if the business instructs us
• Contact and partner enquiries: up to 3 years after the last contact
• Security logs: up to 12 months

When a business leaves the network, we delete or return their conversation data according to our agreement with them.

Your rights

Under the GDPR you have the right to:

• Ask what data we hold about you and get a copy
• Have inaccurate data corrected
• Ask us to delete data
• Ask us to restrict how we use it
• Object to processing based on legitimate interest
• Receive your data in a portable format
• Withdraw consent where we relied on it

Email privacy@xbrandify.com and we will respond within one month.

If you are not satisfied with our response, you can complain to the Swedish authority Integritetsskyddsmyndigheten (IMY) at imy.se, or to the authority in your own country.

Children

direct.guide is not intended for children under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.

AI and automated processing

The concierge on direct.guide uses AI language models to generate responses. Your messages are sent to those models to produce an answer.

The concierge does not make decisions that have a legal effect on you or similarly significant consequences. It answers questions and helps you plan. Bookings and any decision about them rest with the business.

AI can be wrong. Prices, availability and details shown in a conversation should be confirmed with the business before you rely on them.

Changes

If we change this policy we will update the date at the top. For significant changes we will make it obvious on the site.

Contact

Your Brand Travel International AB

Organisation number 559391-1018

Stockholm, Sweden

privacy@xbrandify.com