Privacy at PanaBooking.

Updated 27 September 2026

Mythfinity R&D, based at Suhata Reka, Sofia 1517, Bulgaria, operates PanaBooking and is responsible for the personal information described in this notice.

What we save

We save your account name, email, hashed password, trip conversations, preferences, research, source references, and comparison results. Essential cookies keep you signed in and protect requests. Your trip pages are private to your account; authorized administrators can access records to operate the service and investigate problems.

AI and research providers

When email confirmation is required, your email address and a one-use confirmation link are sent through our configured mail service. The link expires after 30 minutes. We store a hash of the token and short-lived delivery and resend-limit records.

Signup protection stores keyed hashes of email addresses and session identifiers with attempt counts for up to an hour. When enabled, Cloudflare Turnstile loads a security widget in your browser and validates a verification token before an account is created.

Free-text trip messages and relevant trip details and preferences are sent to OpenAI when AI is configured. Comparison requests include selected saved source excerpts. Requests set storage off. We do not include your account name, email or password. Quick-choice answers update your brief directly without an AI request.

Web search uses Brave or Serper, including an explicitly configured fallback. Queries can contain your destination, dates, party, and preferences, including accessibility needs you provide. Optional deeper research uses a separate worker to fetch permitted pages with Scrapling or an isolated browser, and TypeSafe to judge relevance. That worker receives selected source details and relevant destination information. Relevance judgments do not verify facts.

We retain provider-call outcomes, timing, reported token counts, and configured cost estimates for troubleshooting. Destination information can be reused within the same trip; reused evidence keeps its retrieval date and is excluded from new price estimates. Currency conversion can use the public ECB feed without sending trip or account information.

Photos and external sources

Photos load from Pexels or Wikimedia, which receive your browser’s image requests. To find a saved trip cover, we send only the destination name to Wikipedia/Wikimedia, without your account details or trip conversation. Photo metadata is cached separately from your account. Opening a source link connects your browser to that website. See photo and icon credits.

Your control

Delete a trip from its details panel. Clear saved preferences or delete your account from Travel preferences. Account deletion requires your current password and removes associated trips, conversations, research and usage counts. Clearing preferences does not change copies already saved with existing trips. Daily usage counts remain after individual trip deletion; shared source URLs may remain without your account association. Hosting logs and backups follow the hosting provider’s retention policy.

Optional analytics cookies

If you accept analytics and the service is enabled, we use Google Analytics 4 to understand visits and actions such as account creation, starting research and viewing saved plans. Google receives technical information about your browser and device and processes your IP address when receiving requests. Analytics cookies distinguish browsers and visits. Advertising personalization and Google signals are disabled.

Our manually measured events do not include your name, email, trip messages, destinations, account ID, trip ID or URL query parameters. Your choice is remembered on this browser for up to 180 days. Declining keeps the Google tag unloaded; withdrawing consent stops further measurement and clears accessible Google Analytics cookies. This does not remove data already received by Google. Essential account and security cookies remain necessary to provide the service.

You can change your choice at any time using Cookie settings. See Google’s privacy policy for its processing and retention practices.

Payments and planning credits

We store credit balances, credit activity, order references, pack details, payment status and refund adjustments. To create checkout, we send your email address, order reference and selected credit pack to the payment provider. We do not send your trip conversation or receive your full card number. Stripe Managed Payments, through Link, or the merchant identified at checkout processes payment and billing details under its own privacy notice. See Stripe’s Privacy Policy and Link’s Privacy Policy.

Purposes and retention

We use account and trip information to provide the service you request, payment records to deliver and reconcile purchased credits, and security records to prevent abuse. We rely on performance of our agreement for service delivery, legitimate interests for security and troubleshooting, and legal obligations where records must be retained. Optional information is used only for the purpose for which you provide it.

Account and trip data remain until you delete them or your account. Account deletion removes your wallet and credit activity and detaches payment orders from your user account. Order references, amounts, payment status and related transaction records can remain for payment reconciliation, disputes and legal retention requirements. Payment providers maintain their own records and retention periods. Backups may retain deleted information until their normal replacement cycle.

Privacy requests

Contact PanaBooking at support@panabooking.com to ask about your data, request access, correction, deletion, portability or restriction, or object to processing where those rights apply. We may need to verify your account before responding. You may also complain to your local data protection authority, including Bulgaria’s Commission for Personal Data Protection.

Some service providers process data outside your country, including outside the European Economic Area. Their privacy notices describe relevant locations and transfer safeguards. Please avoid including sensitive identity, health or payment information in trip messages.

Early access

Do not put passport numbers, payment details, or sensitive documents into trip messages. Research is planning assistance; availability, final prices, and suitability need checking with original sources.