What we know about you

Miles & Lux is Daniel and Jackie. We're a luxury travel agency, booking hotels through our host agency, and we publish notes on the places we've stayed. This page covers what we collect when you read the site, and what we collect when you ask us a question or ask us to plan something.

The short version: reading this site collects nothing unless you agree to advertising cookies. Asking us to plan a trip collects what we need to plan it. We never see your card.

Reading the site

The globe, the destination pages and our other pages set no cookies and run no analytics. We do not know who you are, and our pages are served as cached files, so most of the time your visit does not reach a server of ours at all.

Our host, Netlify, processes the request itself (your IP address, the page asked for and your browser's user agent) as an ordinary part of delivering a website and for security. We do not build profiles from it.

Advertising cookies

If you agree, we run advertising pixels from Meta (Facebook and Instagram) and Google Ads. They let us show our ads to people who have already visited, and tell us whether that worked. They are not necessary for the site to function. They are switched off today. Until we set up those ad accounts, there is nothing to agree to, so we don't ask.

Nothing loads until you say yes. If you decline, or have not answered, the scripts are not on the page at all. They are not loaded and then switched off. If your browser sends a Global Privacy Control signal we treat that as a no and do not ask. What those platforms receive is the fact that a browser visited a page, and whether an inquiry or a question was submitted. We do not send them your name, your email or a hashed version of either, and they never load on your private trip or quote pages.

Our chat assistant

The “Ask us” button opens an AI assistant that answers questions about what we book and how we work, can look up live hotel rates, and can send your trip to us. What you type and what it replies are sent to Anthropic, which runs the model. Our agreement with Anthropic doesn't let it use what we send to train its models; Anthropic keeps its own copy for a limited time under its own policy, and longer if something is flagged for abuse. Each message also carries the scrambled visitor ID described below, so Anthropic can spot abuse without knowing who you are.

When the assistant looks up rates, the hotel or city, your dates, the number of guests and any children's ages, and your passport country if you gave it are sent to LiteAPI, our booking partner for live rates. Nothing that identifies you goes with them.

You can ask the chat general questions without telling it who you are. Before it shows you live hotel rates or sends your trip to us, a short form in the chat asks for your name, your email and your phone number. We don't check them. They come straight to us and never go into the conversation, so they are never sent to Anthropic. If you type your email address or phone number into the conversation itself instead, the chat takes out what it recognizes before the message is shown, saved or sent, a hotel's number included. We usually email your details to Daniel and Jackie, with your last few messages to the chat (normally once a day at most for the same email address), and use them only to answer you. If you then send your trip, the form you send is filled in with them, and it becomes a trip request like one sent from our booking page, with the conversation and the rates you were shown attached so we don't have to ask again.

Before anything you type is saved or sent, we remove anything that looks like a card number or a Social Security number, and the details form won't take a card number at all. To stop the chat being flooded, we count messages by a scrambled form of your IP address, made with a secret key, so the address itself is never stored. We save each conversation so we can see what people ask and check the answers were right. One you didn't send to us is deleted after 90 days, with the name, email and phone you gave in it; one you did is kept with your trip request, and deleted when it is. The conversation is also kept in your browser tab, so it survives a reload, and it's gone when you close the tab.

Asking us to plan a trip

The form on our booking page collects your name and email, and whatever else you choose to fill in: where you are thinking of going, your dates, how many of you there are, a budget, and anything you tell us about the trip. Once you are a client we also keep a phone number, your nationality (hotels and suppliers price by it, so a quote is wrong without it), your preferred currency, and notes on what you like. If you want help using points or miles, we'll also note which loyalty and card programs you belong to and roughly what you have in each.

The question form on our What We Do page collects your email, your question, and your name if you give it. We use them to answer you, and nothing else.

When you send us a trip request, you get a private link to a page that shows where your trip stands. Anyone with that link can see that page, so keep it to yourself. It shows your trip details, the options we send and your booking. Your card is never on it.

We deliberately do not collect passport numbers, and we do not ask for a date of birth unless a specific supplier requires one for a specific booking.

We never handle your card. On the bookings we place, you settle with the hotel directly. No card number, expiry or security code is ever typed into this site, stored in our database, or written to our logs, and there is no code here that could accept one.

Why we are allowed to hold it

• To do what you asked. Planning and placing a booking is the performance of the arrangement between us.
• Because you agreed. Advertising cookies, and nothing else, rest on your consent, which you can withdraw at any time.
• Because we have to. Booking and commission records are kept for tax and accounting.
• Because it is reasonable. Keeping the site up, secure and free of form spam.

Who else sees it

Only those who need to, and only for their part:

• Fora, our host agency, receives what a reservation requires: guest names, dates, the property, and contact details. They are the agency of record for bookings we place.
• The hotel receives your name, your dates and anything you have asked us to pass on. We only write to an address a hotel or our host has actually given us. We never guess one.
• Supabase hosts our database, in the United States (us-east-1).
• Netlify hosts and serves the site, in the United States (us-east-2).
• Resend sends our email.
• Google hosts our advisor inboxes: Daniel's on Fora's Google Workspace (Fora is our host agency) and Jackie's on Gmail. Your trip request, your question, the name, email and phone you give the chat, the trip you send us from the chat and the option you choose from a shortlist are emailed to both, with everything you wrote, so we can answer you from them. A reply to an email from one of us goes to that advisor's inbox.
• Anthropic runs our chat assistant, and receives what you type into the conversation, but not the name, email and phone you give in its form.
• LiteAPI (Nuitee) supplies the live rates the chat assistant shows, and receives the hotel or city, your dates, the number of guests and any children's ages, and your passport country if you gave it, for each lookup.
• Meta and Google, for advertising, and only with your consent.

We do not sell your personal information, and we do not share it for anyone else's advertising. We will disclose it if the law actually requires us to.

Where it goes

Our infrastructure is in the United States. If you are writing to us from the UK or the EEA, your information is transferred there, under the standard contractual clauses in our agreements with those providers. If that is not something you want, tell us and we will work with you by email instead.

How long we keep it

• An inquiry that never becomes a trip: two years, then deleted, in case you come back.
• A question you sent us: two years, then deleted.
• A conversation with the chat assistant, and the name, email and phone you gave in it: 90 days, then deleted, unless you sent it to us, in which case they are kept with your trip request, and deleted with it.
• Client records and booking history: seven years, for tax and accounting.
• Email we have sent you: kept with the trip it belongs to.
• The emails that tell us about your request, your question, your choice or the details you gave the chat: in our inboxes, and in our record of email sent, until we delete them. Ask and we will delete them along with the rest.
• Our activity log, which records what was done to a booking and when: kept for the life of the record. It is append-only, so a correction is a new entry rather than an edit.
• Your cookie answer: in your own browser, until you clear it.

What you can ask for

Whoever and wherever you are, write to daniel.laskowski@fora.travel and we will: tell you what we hold, send you a copy, correct it, delete it, or stop using it. We do not charge for this and we do not make it a process. We will come back to you within 30 days.

If you are in the UK or EEA, those are your rights under the GDPR (access, rectification, erasure, restriction, portability, objection, and withdrawing consent), and you may also complain to your data protection authority. If you are in California, you have the rights to know, delete, correct, and opt out of sale or sharing under the CCPA as amended by the CPRA. We honor Global Privacy Control as that opt-out, and we will not treat you differently for exercising any of it.

Children

This is not a site for children and we do not knowingly collect anything from anyone under 16. Where a booking involves a child, we hold only what the hotel needs, usually a first name and an age.

Changes

If we change what we collect or who processes it, we will change this page and move the date at the top. If the change is significant and you are a client, we will email you.

Reaching us

daniel.laskowski@fora.travel. It reaches us directly, not a call center.

This is written to be accurate and readable, and it is not legal advice. It has not been reviewed by a lawyer.