Privacy policy

This policy explains what information we collect when you use BackpackLondon, why we collect it, and the choices you have. If anything here is unclear, email hello@backpacklondon.co.uk and we’ll explain in plain English.

Who we are

BackpackLondon (“we”, “us”) is an independent UK travel guide. We’re the data controller for the personal information described below. If you want to exercise any of your rights under UK GDPR, contact us at hello@backpacklondon.co.uk.

What we collect and why

Account & sign-in

If you sign in to save your trip across devices, we collect your email address (and, if you use Google sign-in, your name and profile picture). This is used to authenticate you and attach your saved trip to your account. Legal basis: performance of a contract (running the account feature you asked for).

Saved trips

Your saved itinerary lives in your browser’s localStorage by default. If you sign in, we also store it in our database (hosted on Turso, EU region) so you can pick up where you left off on another device. We never share your trip with third parties.

Contact forms & quote requests

When you send us a message or request a quote, we collect the details you provide (name, email, travel preferences, dates, party size, notes). We use this only to reply to you. Emails are sent via Resend. Legal basis: performance of a contract or legitimate interest in answering enquiries.

AI Trip Planner

When you use Sara (our AI planner), the prompt you type is sent to Anthropic (Claude) to generate an itinerary. We don’t send your name, email, or account details — just the text of your request and, if you’re refining an existing trip, a list of the saved attractions. Anthropic processes the prompt under their own privacy terms and doesn’t use it to train their models.

Analytics

If you accept analytics cookies, we use PostHog (EU region) to understand how visitors move through the site — which pages they read, where search queries succeed, where they bounce. This helps us improve the guide. We don’t sell this data. Legal basis: consent. You can change your mind any time via the “Manage cookies” link in the footer.

Advertising

If you accept advertising cookies, Google AdSense may set cookies to serve personalised ads. Without consent, AdSense will fall back to non-personalised ads where possible. We don’t run third-party trackers beyond AdSense and analytics. Legal basis: consent.

Affiliate links

When you click a link to a partner site (Viator, Booking.com, GetYourGuide, etc.) we log the click so we can verify our commission. We don’t share your personal data with these partners — only the click itself. See our affiliate disclosure for details.

Server logs

Like every website, our hosting (Vercel) records request logs that include your IP address, browser, and the page requested. These are kept briefly for security and abuse prevention. Legal basis: legitimate interest.

Cookies

We use three categories of cookies, controlled by the banner you saw on first visit:

• Strictly necessary — sign-in session, your saved trip, and your cookie preferences. Always on. Without these the site doesn’t function.
• Analytics — PostHog measurement. Off until you opt in.
• Advertising — Google AdSense personalisation. Off until you opt in.

You can review and change your choices at any time via the “Manage cookies” control or by clearing your browser’s storage for this site.

Who we share data with

We don’t sell your personal data. We use a small set of processors to run the site:

• Vercel — hosting and request logs
• Turso — database (EU region) for accounts and saved trips
• Resend — transactional email (sign-in links, quote replies)
• Google (OAuth + AdSense) — sign-in option and, with consent, advertising
• Anthropic — Claude API for the AI Trip Planner
• PostHog (EU) — product analytics, only when you opt in
• Cloudinary & ImageKit — image hosting / transformations

Each of these processors handles data under their own terms. Some are based outside the UK/EU; in those cases the transfers rely on Standard Contractual Clauses or equivalent safeguards.

How long we keep data

• Saved trips: while your account is active, or until you clear your browser storage for anonymous trips.
• Contact / quote enquiries: 24 months, then deleted.
• Analytics events: per PostHog defaults (rolling 12 months).
• Server logs: typically 30 days at our hosting provider.

Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Correct anything that’s wrong
• Delete your data (subject to legal retention requirements)
• Withdraw consent at any time
• Object to processing based on legitimate interest
• Receive a portable copy of your data
• Lodge a complaint with the UK ICO (ico.org.uk/make-a-complaint)

To exercise any of these, email hello@backpacklondon.co.uk. If you have an account you can also export your data or delete the account from the account page.

Children

BackpackLondon isn’t directed at children under 13 and we don’t knowingly collect data from them. If you believe a child has provided us data, contact us and we’ll delete it.

Changes to this policy

We’ll update this page when we change a processor, retention period, or anything else that affects how we handle data. The “Last updated” date at the top will change with each revision.