Privacy & Cookie Policy

1. Who is responsible

Detor B.V. is the data controller for personal data processed on the platform. We’re a company registered in the Netherlands. Our Chamber of Commerce (KvK) number is 42163696 and our VAT ID is NL869993033B01. Our address is Sonny Rollinsstraat 23, 3543 GR Utrecht, the Netherlands. We process personal data under the EU General Data Protection Regulation (GDPR) and the Dutch GDPR Implementation Act (UAVG). Reach our privacy contact at support@godetor.com.

Hosts who receive guest details for a booking process that data for their own hosting activity; the Host Terms strictly limit what hosts may do with it (only what’s needed to host that booking). A Detor Original is different: Detor sells it, and the host who runs the session uses guest details on our behalf, only to run that session.

2. What we collect

If you book or browse as a traveller

• Account & contact data — name, email, phone, password (stored hashed), language, currency and preferences.
• Booking data — the experiences you book, party details (adults/teens/children/infants), special requests, and any accessibility or dietary notes you choose to share.
• Payment data — handled by Stripe on Stripe-hosted pages; we never see or store your full card number. We keep booking amounts, refunds and invoice records.
• Trip-safety data (optional) — an emergency contact if you add one, and check-in confirmation (location verified around the start time, used only to confirm attendance).
• Messages & reviews — your on-platform messages, reviews and reports.

If you book a Detor Social Table seat

• Your table answers — the languages you speak, your birth year, where you grew up (if you want to say), the field you work in, how you describe yourself, what you normally spend on dinner out, how talkative you are, what you like talking about, how you eat, allergies, access needs and your pronouns. We use them to put tables together. Socials is only for people aged 18 and over. If you were born in the year people turn 18, we also ask you to confirm you are 18 or older, and keep a note of when you did. The Social Table privacy note has the full list and who sees what.
• Your phone number — required for a seat. Our team uses it to reach you about your table, including on the night. Another guest gets it only if you both choose “stay in touch” with each other afterwards.
• Your profile photo — if you add one, shown only to the people at your table, and only once you have met.
• Table and private chats, kudos and blocks — what you write in your table’s group chat and in a private chat with someone you both chose, the kudos you give, and who you blocked.
• Push token — if you turn on notifications in the Detor Social app, the token your phone gives us so we can send them. Turn notifications off and we delete it.

If you apply to host

• Application data — legal name, display name, date of birth, gender (optional), address, phone, email, bio, motivation, languages, categories and cities, profile photo.
• Verification data — the checks we run before approving you, and photos of your ID document. If you are not an EU, EEA or Swiss citizen, also photos of your residence permit. We use them to confirm who you are and that you are allowed to work where you host. An AI tool reads them first to help our reviewer, but a person makes every decision.
• Payout & tax data — bank account holder and IBAN, VAT registration status and VAT ID, and the identifiers EU law (DAC7) requires us to collect and verify, such as your tax identification number (BSN or RSIN).
• Hosting records — your listings, availability, bookings hosted, earnings, payouts, reviews and any incident reports.

Everyone

• Technical data — IP address, device/browser type and app events in server logs, used for security and troubleshooting.
• SOS alerts — if you raise an SOS from a booking, your booking pass or the Detor Social app, we take your location at that moment (if your device can find you) and, if your device shares them, your battery level and your device’s language. Our team gets all of it with your booking. Your emergency contact gets your name, your booking reference and your location. We never take your location at any other time.

3. Why, and on what legal basis

• To provide the service (contract): creating accounts, processing bookings and payments, sharing with your host/guests the details needed for the booking, messaging, reviews, and paying hosts.
• To meet legal obligations: tax and accounting records, invoice retention, verifying host information and reporting host earnings to the Dutch Tax Administration under DAC7, responding to lawful requests from authorities, and GDPR compliance itself.
• Legitimate interests: keeping the platform secure, preventing fraud and abuse, moderating content, improving the product using aggregate usage data (including counting visits to the Social Table pages ourselves, without cookies, to know which pages work — see section 8), and defending legal claims. We balance these against your rights; you can object (section 7).
• Consent: checking your ID document and residence permit when you apply to host (you agree to this on the application, and can withdraw before a decision), newsletters and marketing (double opt-in, unsubscribe any time), optional WhatsApp updates, and any cookies/storage that aren’t strictly necessary (see section 8 — currently that is Google Analytics and nothing else). You can withdraw consent at any time.
• Vital interests: in an emergency during an experience or a Social Table, we may share relevant details (such as your emergency contact) with first responders. When you raise an SOS we share your location at that moment, where you are booked and how to reach you with our team, your emergency contact and, if needed, first responders.

Dietary and allergy information can reveal health or religious details. We process it only to keep you safe and fed on the experience you booked, share it only with the relevant host, and hosts may not record or reuse it.

4. Who we share it with

Some of these we send data to ourselves. Others are pieces of the page your browser fetches directly, which means they see your IP address as the page loads — before, and regardless of, anything you choose on the cookie banner. Each entry says which it is.

• Between guests and hosts: hosts see the booking details needed to host you (name, party size, dietary/accessibility notes, a contact method around the experience). Guests see the host’s public profile.
• Between guests at a Social Table: the people at your table see your first name and your pronouns, and your profile photo once you have met. The venue gets the allergies, diets and access needs for the table, and first names.
• Your emergency contact — if you raise an SOS, gets an email if we have their email address, and a WhatsApp message if we have their phone number, with your name, your booking reference and your location at that moment.
• Stripe — payment processing (PCI-DSS certified). Stripe is an independent controller for the payment itself; see Stripe’s privacy policy.
• Infrastructure & email — our hosting and database providers (Microsoft Azure, Supabase) and transactional email service, processing on our instructions under data-processing agreements.
• Authorities — the Dutch Tax Administration (Belastingdienst) for DAC7 host reporting, and courts/regulators/police where the law requires or allows it (we assess every request).
• Anthropic — the AI features (Genie, trip planning, the review summary on a listing). We send it only the text the feature is working on: what you typed into it, a host’s own listing text, or reviews already published on that page — never your account, contact or payment details. For host applicants who agree to it, we also send the photos of their ID document and residence permit, so the AI can read them for our reviewer. Anthropic processes all of this on our instructions under a data-processing agreement and may not use it to train its models.
• Google sign-in — signing in with a Google account. Choosing it sends you to Google’s own page, so Google knows you signed in here, and it returns us the name, email address and profile picture on the account you pick.
• Meta — Facebook sign-in and WhatsApp updates. The Facebook script loads only when you choose that sign-in, and sets a cookie on this site so it can finish; WhatsApp booking messages carry your phone number and the booking details, and go out only if you asked for them. An SOS alert to an emergency contact with a phone number on file also goes by WhatsApp.
• Apple Wallet & Google Wallet — the booking pass, and only if you save one. The pass carries the experience, date, time and meeting point.
• Trustpilot — reviews. When a booking, social table, activity meetup or event is over, we send your name, email address and booking reference to Trustpilot (Trustpilot A/S, Denmark), so they can invite you to write a review. Writing a review is your choice.
• Google Analytics — website statistics, and only if you accepted analytics cookies. It never receives your name, email, booking reference or payment details. See section 8.
• Google Maps — the map and the address box. It sees your IP address on any page that shows a map, and the address text a host types when setting a meeting point; it loads with the page rather than on your cookie choice. When someone raises an SOS, our server also sends Google the coordinates, to turn them into a street address for our team.
• Google Fonts — the typefaces, fetched from Google as every page loads. That request shows Google your IP address and nothing else, and it happens before you have answered the cookie banner.
• komoot — address suggestions, through its Photon service built on OpenStreetMap. It receives the address you are typing — on the host application that is your home address — or a point you place on a map, and we attach nothing else to the request.
• Apple and Google push services — notifications in the Detor Social app. The notification and your phone’s push token pass through Apple Push Notification service (iPhone) or Firebase Cloud Messaging (Android), and only if you turned notifications on.
• Open-Meteo — the forecast shown on an experience page. It receives that experience’s coordinates and date, and your IP address; nothing about you or your booking.
• Never: we don’t sell personal data, and we don’t share it for advertising or ad targeting.

5. International transfers

We keep data in the EEA where we can. Where a provider processes data outside the EEA (for example some Stripe, Microsoft or Anthropic services), we rely on safeguards such as adequacy decisions (including the EU–US Data Privacy Framework where the provider is certified) or the European Commission’s Standard Contractual Clauses.

6. How long we keep it

• Bookings, invoices and payout records — 7 years (Dutch tax and accounting law).
• DAC7 collection & verification records — as long as the reporting rules require.
• Account data — for as long as your account exists; deleted or anonymised after account closure except what law requires us to keep.
• Photos of your ID document and residence permit — deleted as soon as there is a decision on your application, or after 30 days if nobody works on the application. What the AI read from them is deleted at the same time. We keep a record that the check was done, but not the photos.
• Host applications that aren’t approved — kept briefly for reapplication and fraud prevention, then deleted.
• SOS alerts — kept with the safety report while we may still need them for that incident, then deleted.
• Social Table group chats — deleted when the chat closes, unless a report is open.
• Check-in location confirmations — kept only for a short retention window, then removed automatically.
• Server logs — short rotation, security purposes only.
• Visit counts (godetor.com and joinsocials.app, see section 8) — each counted visit is deleted after 30 days; only daily totals are kept, and they say nothing about anyone.

7. Your rights

Under the GDPR you can, at any time:

• access the data we hold about you, and get a copy (data portability for data you gave us);
• correct inaccurate data — much of it directly in your account;
• delete data ("right to be forgotten") where no legal duty requires us to keep it;
• object to processing based on legitimate interests, and to any direct marketing (always honoured);
• restrict processing while a dispute about it is resolved; and
• withdraw consent without affecting past processing.

Exercise any of these via Contact or support@godetor.com, or by post to Detor B.V., Sonny Rollinsstraat 23, 3543 GR Utrecht, the Netherlands. Write from the email address on your account so we know the request is yours. We respond within one month. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).

9. Changes & contact

We’ll update this policy as the service evolves and show the "last updated" date at the top; for significant changes we’ll notify you in the app or by email. Questions, requests, or concerns: Contact us or email support@godetor.com.

Your data, handled like we’d want ours handled. — The Detor team