Hospitality
A stay often puts your passport on the record, sometimes as an image, and in several countries the law keeps a copy for the state to read. Beyond that, the file is kept as long as they judge necessary, with figures the exception.
The read at a glance
Hotels keep your document details, and booking platforms hold the same stay.
A leak exposes your ID, where you stayed, and when.
Guest and payment records are kept for years; registers are required by law.
Check-in takes ID and payment; some hotels add a face scan.
Industry profile reviewed 23 August 2026. Also machine-readable via the free API.
If it leaks
A stay record says who you were with and where, and hotel files keep passport numbers to prove it. One group's breach exposed 5.25 million unencrypted passport numbers and ran undetected for four years.
What repeats in the policies
The passport goes on the record
Booking a stay or a flight often means handing over a passport or national ID number, and often an image of the document with it. Some services hold that picture for a set number of days, others fold the number into your booking record with no end date. One turns a photo of your face into a scan it can match you against later. This usually happens at check-in or when you book a flight, rather than on every visit.
The law keeps a copy for the state
In the UK a hotel must keep every guest's name and nationality, and a foreign guest's passport details, for at least twelve months and open them to any police officer. In Spain, traveller data goes to a state security office and is held for three years. Germany keeps a foreign guest's signed arrival form for a year after departure and hands it to police on request. This runs by law, whatever a privacy policy says.
Leaving does not clear the file
Most give no number and keep the record as long as they judge necessary. Where a figure does appear it runs long: one operator holds booking and complaint history for seven years, another keeps account details up to five years after you close it. Tax, accounting or anti-money-laundering rules are the usual reason a record outlives the stay, and several policies keep data wherever the law permits it, not only where it requires it.
What a company here typically holds
Worked out from the industry, not from any one company. What you actually handed over is yours to record.
What this can reveal about you
Built only from what this kind of service actually collects. A dimension that the data does not support is not listed.
Where you go Likely
Stay records map your travel.
Who matters to you Possible
Who you stay with can be inferred.
What lawfully stays after you leave
Two kinds of hold. Law sets it: a statute makes them keep it. They set it: a ground the company grants itself.
Policing / immigration records Law sets it years, sometimes decades
Policing and immigration records carry very long statutory retention.
Fraud-prevention markers They set it about 2 to 6 years
To flag suspected fraud, often on a shared industry database you cannot reach through the company.
Tax and accounting records Law sets it about 6 years
Tax and company law makes them keep billing and payment records.
Records tied to a live or potential dispute They set it the limitation period of the claim
They can keep records to defend a live or possible legal claim.
Who wants this data
A single hotel group's breach exposed roughly 339 million guest records and 5.25 million unencrypted passport numbers, and it went undetected for four years. Passport numbers pile up at the booking sites as much as at the front desk. The fix came only when a regulator forced a deletion path the company had not offered on its own.
Sold or shared Possible
Guest data is shared with booking platforms and partners.
AI training Low
Training use is limited beyond internal analytics.
Even anonymised, this can still be you
A guest register names you, your document and your dates, which is enough to single you out.
Name, date of birth, postcode Typical
Fifteen demographic attributes re-identify 99.98% of Americans in a released dataset (Rocher, Hendrickx and de Montjoye, Nature Communications, 2019); date of birth, postcode, and sex alone did it for most people in the first study of the problem (Sweeney, 2000).
Location traces Sometimes
Four time-and-place points single out 95% of people in mobility data (de Montjoye et al., Scientific Reports, 2013).
Payment patterns Typical
Four card transactions identify 90% of people in payment data (de Montjoye et al., Science, 2015).
Browsing fingerprint Sometimes
Browser and device fingerprints were unique for 84% of visitors in the first large study (Eckersley, 2010), and sparse histories of what people viewed re-identified them against public reviews (Narayanan and Shmatikov, 2008).
The studies Estimating the success of re-identifications in incomplete datasets using generative models (Nature Communications 10, 3069, 2019)·Simple Demographics Often Identify People Uniquely (Carnegie Mellon University, Data Privacy Working Paper 3, 2000)·Unique in the Crowd: The privacy bounds of human mobility (Scientific Reports 3, 1376, 2013)·Unique in the shopping mall: On the reidentifiability of credit card metadata (Science 347 (6221), 2015)·How Unique Is Your Web Browser? (Privacy Enhancing Technologies Symposium (PETS 2010), 2010)·Robust De-anonymization of Large Sparse Datasets (IEEE Symposium on Security and Privacy, 2008)
The wording that does the work
Clauses that recur across this industry, and what each one actually permits.
“to provide and improve our services”
The catch-all purpose. Analytics, profiling, personalisation and AI training all fit under it. When they want to do something new with your data, this sentence usually already allows it.
The move An objection tells them to use your data to run the service and nothing more.
“we do not sell your personal information”
Usually this means no cash changes hands. Your data can still go to ad networks, analytics firms and partners, because they count that as sharing rather than selling.
The move Use the do-not-sell switch where there is one, and put an objection in writing as well.
“service providers, partners, and affiliates”
This is how your data leaves with no name attached. Recipients are described by what they do rather than named, and you cannot send a request to a company you cannot name.
The move An access request can ask for recipients by name rather than by category, and UK and EU law put that choice with you.
“aggregated or de-identified information”
Taking your name off does not take away the pattern, and the pattern often still points at you. Policies give themselves free use of this data with no end date, on the basis that it is no longer about you.
The move If a deletion comes back as 'anonymised', keep the reply. It usually means de-identified, and it is their claim, not a fact you can check.
“retained as long as necessary, or as required by law”
They can keep it for legal duties, tax rules, fraud prevention, possible lawsuits and their own business reasons. None of those has a firm end date, so deletion turns into something you have to argue for.
The move Which reasons apply to you, and how long each runs, is a request of its own.
“you grant us a licence to use your content”
This is a contract term rather than a data setting, so a privacy request cannot undo it. A careful version ends when your account does. A broad one can be passed on, never expires and survives deletion.
The move Their terms say whether the licence ends when the account does. Close the account and log the date here.
“unless a longer period is required or permitted by law”
Permitted is doing the work here. It lets an operator keep your record even where no law compels it, turning something the law allows into a standing reason to hold on.
The move How long they read that as, and what it covers, is theirs to state.
“when disclosure is required by law or to protect the safety of guests, employees, the public or our property”
This pairs a legal duty with a broad ground the operator judges for itself. They can hand over guest data without a court order whenever they decide safety or property is at stake.
The move What counts as a safety or property reason, and who has received data under it, is theirs to answer.
“to comply with local registration, permit or short-term rental laws where registration is necessary”
This pulls the government lodging registers into the policy. It allows guest or host identity data to go to the authorities wherever local law runs a register, notification or permit scheme.
The move Which authorities have received your details under a local register is theirs to answer.
Their own policy is the one that binds them. Pin it down with a request, and keep the reply.