Privacy Policy

The short version: we collect very little by default, we never sell personal data, and nothing non-essential loads until you allow it. Analytics and advertising tools run only after you choose “Accept all” on the cookie notice.

1. Who we are

Innworthy (“Innworthy”, “we”, “us”) operates the website innworthy.com — an independent, reader-supported guide to design and luxury hotels. We act as the data controller for the personal data described in this policy. For anything privacy-related, write to [email protected].

2. What we collect, and why

We deliberately keep the list short:

• Outbound click data. When you follow a “Book” or “Check availability” link, we record the time of the click, the page it came from, your browser type, your approximate location (country and city, derived from your IP address) and a one-way cryptographic hash of your IP. We never store the IP address itself, and the hash cannot be reversed into it. This tells us which hotels and pages perform — it is how a free, reader-supported guide stays alive.
• Newsletter data. If you subscribe to The Shortlist, we store your email address and the date you subscribed. Nothing else is attached to it.
• Messages you send us. If you email us, we keep the correspondence for as long as it is useful to answer you.
• Basic technical logs. Our servers keep standard, short-lived logs (requested URL, status code, user agent) for security and debugging.
• Analytics & advertising data (only with your consent). If you choose “Accept all” on the cookie notice, we load measurement and advertising tools — Google (Tag Manager, Analytics, Ads), Meta and TikTok pixels — which collect usage data and identifiers under their own policies to measure campaigns and site performance. If you choose “Essential only”, none of these load, and the site works exactly the same.

We never sell or rent personal data to anyone.

3. Legal bases

Where the GDPR or similar laws apply, we rely on: legitimate interest for click measurement and security logs (it is minimal, aggregated and expected of an affiliate-funded publication); consent for the newsletter and for all analytics/advertising cookies — both can be withdrawn at any time (unsubscribe link in every email; clear your browser storage to reset the cookie choice); and contract where we respond to your enquiries.

4. Affiliate links and third parties

Booking links on Innworthy lead to Booking.com. Once you land there, Booking.com processes your data under its own privacy policy — we never see the details of your reservation, your payment information or your identity as a guest. Booking.com reports commissions to us in aggregate form only.

Other processors we use to run the site: hosting and content-delivery providers (server logs), an email-delivery provider (newsletter only), and Google Fonts served from Google's servers, which means Google receives your IP address when fonts load.

With your consent only: Google (Tag Manager, Analytics 4, Ads), Meta Platforms (Meta Pixel) and TikTok (TikTok Pixel) act as independent controllers or joint controllers for the data their tags collect — see their privacy policies for details and opt-outs. We configure Google Consent Mode so that all of their storage stays disabled until you accept.

5. Geolocation of clicks

The country and city attached to a booking click are derived from your IP address at the moment of the click, using an IP-geolocation lookup. The IP itself is discarded immediately after the lookup; only the country, the city and the irreversible hash remain. This data is used exclusively in aggregate (“readers from Germany book alpine hotels in January”) and is never combined with your name or email.

6. How long we keep things

• Click records: up to 36 months, then deleted or fully anonymised into aggregate statistics.
• Newsletter address: until you unsubscribe, plus a suppression entry so we do not email you again.
• Server logs: up to 30 days.
• Correspondence: up to 24 months after the last message.

7. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to the processing of your personal data, the right to data portability, and the right to lodge a complaint with your supervisory authority. Write to [email protected] and we will respond within 30 days. Note that click records are keyed by an irreversible hash — we usually cannot link them back to you even if you ask us to.

8. Cookies and local storage

Essential storage is always minimal; analytics and advertising cookies exist only behind your consent. The full table lives in the Cookie Policy.

9. Children

Innworthy is not directed at children under 16 and we do not knowingly collect their data.

10. International transfers

Our providers may process data outside your country. Where they do, we rely on recognised safeguards such as the EU Standard Contractual Clauses or adequacy decisions.

11. Changes to this policy

When we change this policy we update the date at the top. If a change is material — new data, new purpose — we will say so plainly on this page rather than hide it in legalese.

12. Contact

Privacy questions, access requests, complaints: [email protected].