Privacy

What we do with your data, why we are allowed to, and how to make us stop. This notice is given under Articles 13 and 14 of the GDPR.

Who is responsible

The controller of your personal data is Lorenz Development Kft., 2800 Tatabánya, Boróka utca 7., Hungary (company registration 11-09-032270, VAT 33092957-2-11). For anything in this notice, including every request described below, write to [email protected].

We have not appointed a data protection officer. We are not required to, and the address above reaches the people who decide these things.

What we collect

Only what the guide needs. There are no accounts. There is one piece of advertising measurement, Google's tag, and it is the only thing here that could follow you anywhere — which is why it is the only thing we ask you about. It is described under Cookies below.

Your email address: Not asked for by us. Stripe collects it at the checkout, for the receipt, and passes it to us so the guide has somewhere to go. We use it to send the guide and to answer you if you write. If you ask us to send a copy to a second address, we use that one for that message and do not keep it.
The two places and the language: Where you are travelling from and to, and the language to write in.
Trip details: Your dates, how many people are travelling, whether children or a pet are coming, the hotel or area you typed, the radius you chose, and any dietary requirements you ticked.
The guide itself: The text we produced and the PDF, kept so your link keeps working.
Payment record: The Stripe transaction reference. We never see or hold your card details.
Technical records: Server logs, which include your IP address, and a short-lived counter keyed to your IP that stops the form being hammered. The counter is discarded within an hour.
Anonymous usage counts: Which step of the buying process was reached — the page was viewed, an order was started, the guide was paid for — and, if you arrived on one of our destination pages, which page that was. This counting is ours and happens on our own server as it answers each request: no cookie, no identifier, no IP address, and nothing that lets us tell one visitor from another or link two visits by the same person. It counts steps, not people, so what we learn is how many got from one step to the next and nothing about who they were. Google's tag is separate and is described under Cookies.
Where you came from: If you followed a tagged link — from an advert, say — the name of that campaign, recorded on your order so we know which ones work. It arrives as part of the form you submit, not from anything watching you browse.
The advert you clicked: If you reached us from a Google advert, Google puts a click identifier on the link you followed. We read it off that link and keep it on your order. It identifies the click, not you: it tells us nothing about who you are, and it does not follow you anywhere else. Like the campaign name above, it travels here on the form you submit rather than through anything stored on your device — which is why it still works whatever you answer the banner, and why we kept it after adding the tag.

Dietary requirements: a special note

If you tick Halal or Kosher, that says something about your religious beliefs. If you tick a gluten, dairy, nut or shellfish option, that says something about your health. Both are special categories of data under Article 9 of the GDPR and deserve to be treated as such.

These fields are entirely optional and the guide is written without them if you leave them alone. By ticking one you explicitly consent to us processing it, and to it being passed to the language-model provider that writes the eating pages, for the single purpose of writing your guide. That is our legal basis under Article 9(2)(a).

You can withdraw that consent at any time by writing to us, and we will delete the answers. Withdrawing does not affect the guide already written, and does not affect anything else about your order.

Why we are allowed to use it

To write and deliver your guide: Performance of our contract with you — Article 6(1)(b). Without this data there is no guide to write.
Dietary requirements: Your explicit consent — Articles 6(1)(a) and 9(2)(a).
Preventing abuse: Our legitimate interest in not having the service used to send guides to people who did not ask for them — Article 6(1)(f).
Counting who got how far, and which campaigns worked: Our legitimate interest in knowing whether the site works and whether the money we spend advertising it is wasted — Article 6(1)(f). We judged this against your interests and it is a narrow intrusion: the counts identify nobody, and the campaign name says where a link was clicked rather than anything about the person who clicked it.
Keeping billing records: A legal obligation under Hungarian accounting and tax law — Article 6(1)(c).

Who else sees it

We do not sell your data and we do not share it for anyone else's purposes. It reaches these categories of recipient, each acting under contract for us and only on our instructions, except where noted:

Our payment provider: Stripe, who act as seller of record and are a controller in their own right for the payment. They receive your email address and the transaction; we receive no card details.
The language-model provider: Receives the trip brief — the places, dates, party, hotel and any dietary rules — so the guide can be written. It does not receive your email address or your payment details.
Our email provider: Delivers the verification code and the finished guide.
Our hosting provider: Runs the servers the site and the database sit on.
Google Ads: If you came from a Google advert and then bought a guide, our server sends Google the click identifier from that advert, the amount and the time, so the advert can be credited with the sale. Your name, your email address and what your guide is about are not sent, and nothing is sent about visitors who did not arrive from an advert. Google is an independent controller for what it does with that measurement. This happens from our server after the fact, and it happens whatever you answered the banner, because it needs nothing from your device.
Google Ads, again — the tag: The same advert measurement done the other way round: a script from Google that runs in your browser while you are here, and reports the sale as it happens rather than afterwards. What it may do depends entirely on what you chose, and that is set out under Cookies below.

Data leaving the EEA

Where a provider we use processes data outside the European Economic Area, that transfer is made under an adequacy decision of the European Commission where one covers the country in question, and otherwise under the Commission's Standard Contractual Clauses together with any additional measures the transfer requires. You can ask us which safeguard applies to a given provider, and we will tell you.

How long we keep it

Your order, your trip details and the guide are kept until you ask us to delete them, so that the link we sent you keeps working for as long as you want it. There is no automatic expiry.

Two things survive a deletion request. Billing records are kept for the eight years Hungarian accounting law requires, and server logs age out on their own within a short period. Neither contains your trip details.

The usage counts are kept for about a year and then deleted. The ones attached to an order go the moment that order does — erasing your order takes them with it rather than leaving them behind.

An advert click identifier stops being useful to anyone ninety days after the click, which is the point past which Google will no longer accept it, and it goes with the order it sits on if that order is erased.

Your rights

Under the GDPR you can ask us to do any of the following, free of charge, and we answer within one month:

Access: A copy of the personal data we hold about you.
Rectification: Correction of anything wrong.
Erasure: Deletion of your order and the guide with it.
Restriction and objection: That we pause our use of it, or that we stop relying on legitimate interests, which we will unless we have compelling grounds not to.
Portability: The data you gave us, in a machine-readable file you can take elsewhere.
Withdraw consent: For your dietary answers, at any time, without affecting what was done before you withdrew it.

Write to [email protected] for any of these. We may ask you to confirm the email address the order was made with, because it is the only thing tying an order to a person.

Complaining about us

If you think we have handled your data badly, please tell us first. You also have the right to complain to a supervisory authority — in Hungary that is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), 1055 Budapest, Falk Miksa utca 9-11., naih.hu — or to the authority in the EU country where you live or work.

Cookies

We set no cookies of our own. There is one third-party script on the site: Google's advertising tag, which is there so we can tell which adverts lead to a sale. It is not loaded on the admin pages, which are ours rather than yours.

If you are in the European Economic Area or the United Kingdom, you are asked before it may store or read anything. Until you answer, the tag runs in a mode Google calls consent mode, in which it writes nothing to your device, reads nothing from it, and sends a request carrying no identifier — enough for Google to estimate how an advert performed, not enough to recognise you. Outside those countries the tag starts in its ordinary mode, and you can still turn it off at any time.

The banner has three answers, and they do different things:

Allow all: Google may set its own cookies in your browser and read them back. That is what lets a sale be matched to the advert you clicked exactly, and it is also what allows Google to show you adverts for this site elsewhere. This is the only answer under which anything follows you.
Allow necessary: Nothing is stored on your device and nothing is read from it. The tag stays loaded and keeps sending the identifier-free requests described above. Nothing here needs storage to work, so nothing about the site changes.
Disallow all: Google's script is not requested at all on any page after the one you are on. We cannot unload it from a page where it has already started, so on that one page it stays as it was — storing nothing and reading nothing — until you move or reload.

Your answer itself is kept in your browser's local storage, under geg-consent. It is not a cookie, it is never sent to us or to anyone else, and it holds nothing but which of the three you picked and when. Clearing your browser's site data removes it and you will be asked again.

To change your mind, use Cookie settings in the footer of any page. It clears the stored answer and asks again, and it is there whether or not you were asked in the first place — withdrawing should not be harder than agreeing.

Separately from all of this, we count how many people reach each step of the buying process. That counting happens on our own server as it answers each request, so nothing is written to your device and nothing is read from it, and no answer to the banner affects it.

Automated processing

The text of your guide is generated by an AI language model rather than written by a person. That is automated processing, but it makes no decision about you: it produces a document. Nothing on this site makes automated decisions with legal or similarly significant effects.

There is no profiling by us. If you answer Allow all to the banner, Google may build an advertising profile from your visit for its own purposes, as an independent controller — that is what the answer means, and it is the reason it is asked as a question rather than assumed.

Security

The site is served over HTTPS, order links carry a long random token rather than a guessable number, and access to the database is limited to the people who run the service. Card details never reach our servers.

Last updated 28 August 2026.

Back