Privacy
Last updated: 3 November 2026
Who is responsible
4me - Best Hotels (besthotels4.me) is operated by 4me.network inc, part of the 4me.network group. For anything data-related: support@besthotels4.me.
What we collect
Sign-up: your e-mail (it identifies your account — there is no password, access is by a link sent to your e-mail). Booking: guest names, contact e-mail, phone, city/country and stay details (hotel, dates, room). If you are Brazilian (the nationality chosen in the search) and book a hotel in Brazil, we also collect the CPF (Brazilian tax ID) and the full address (with CEP, the postal code) of the person making the booking, as required for tax purposes and by the supplier; they are stored with the order and, for now, are not shared with anyone. To fill in the address automatically, the CEP you type is looked up in the public CEP database (ViaCEP, with BrasilAPI as a backup), with no other data. Searches: the destinations and dates you look for. Browsing: which pages of this site you open, with the page title and where the click came from — tied to your account while you are signed in, and kept for 180 days. Search and map use: the neighborhoods, landmarks and budget ranges you pick to filter results and, on the map, when it opens, how long it takes to load (and whether it fails), whether your device cannot open the map (no WebGL support), how long it stays open, which “Go to” shortcuts you use (they only move the map), the hotels you select, what you share and clicks to see rooms — tied to the same session (customer or guest), with no new cookie, and kept for 180 days. Checkout use: how far you got in the booking — whether you started and submitted the form (never what you type in it), which error notice appeared (only the kind of notice) and whether you came back from the payment page without paying — tied to the same session, with no new cookie, to understand where booking gets stuck, and kept for 180 days. Hotel page visits: which hotel was opened, the page language and, if you came from a Google ad, the ad campaign and a code derived from the click (the click identifier itself is not stored here) — no account, no session, no new cookie and no name, e-mail or IP; that code links the visit to a search made from the same click, to learn how many visits turn into a search. Kept for 180 days. Usage: technical access logs (IP and timestamp) for security and abuse limiting. Quotes you send: the hotels, rooms, prices checked, dates, occupancy and nationality of the search and, if you type it, only your first name — the link is valid for 7 days and the quote is deleted after 30. The quote itself only counts views and clicks to book by whoever opens the link, without identifying anyone; but if that person already has a session on this site (customer or guest), the visit enters the browsing record described above like any page — with the quote's address and title (hotel and price) — and is kept for 180 days.
What we do NOT collect
Card data. Payment happens on Stripe's or Mercado Pago's own page — your card number never touches our servers. Apart from the Google ads measurement described below, we use no tracking or advertising cookies, and we do not profile you for third parties: the browsing, map-use and checkout-use records described above are ours, stay with us, and are used for support and to improve the site. E-mail addresses, passwords and tokens appearing in page addresses are stripped before storage. The creator referral cookie (cr_ref, described below) only attributes the booking to the creator who referred you.
Google ads
When the Google Ads tag is active it loads only for visitors who arrived from one of our ads (marked by the ad_g cookie, 90 days) and Google sets cookies (_gcl_au and, if you arrived from one of our ads, _gcl_aw with the click identifier). When you pick a room we notify Google of a quote (no amount, no name, e-mail or contact details); when a booking is confirmed we send Google the order code, amount and currency — never names, e-mail or guest details — only to measure whether the ad produced the booking. Alongside your search we also store the details of the ad that brought you, read from our ad_attr cookie (90 days): the click identifier (gclid, gbraid or wbraid), the campaign, ad group, keyword, match type, landing page and click time — so we know which ad led to the search or booking. Google handles that data under its own privacy policy. You can block these cookies in your browser without affecting your booking. Legal basis: legitimate interest in measuring our ads.
AI assistants
If you use 4me - Best Hotels through an AI assistant (via our MCP server and your personal key), we record on the searches, quotes and bookings made that way that they came from the assistant, plus the app's name (e.g. Claude, ChatGPT, Cursor) as it identifies itself when connecting — only the name, no version and nothing from the conversation — so we know where each booking comes from. It is kept for the same period as the search or booking.
Support chat
The site's support chat keeps the conversation and, when you share it, your e-mail (verified with a code we send to it) for up to 180 days, to assist you and show prices. We don't use this data for any other purpose.
Why we use it
To create your account, place the booking with the hotel, send confirmation and voucher, provide support and meet tax/accounting obligations. Searches, browsing, map use and checkout use help us understand what you are looking for, support you better when you contact us and improve the site. Legal basis: performance of the contract (the booking you asked for), legal obligation, and legitimate interest for the browsing, map-use and checkout-use records, which you may object to by writing to support@besthotels4.me.
How long we keep it
Booking data for the legal tax retention period (5 years). Technical logs for 12 months. Browsing, map-use, checkout-use, hotel-page-visit and search records for 180 days — deleted automatically after that. Your account stays as long as you want it — you can request deletion at any time. The CPF and the address of the person making the booking are deleted after 90 days if the booking is not completed and, in any case, after 5 years.
Your rights
You may request access, correction, deletion or portability of your data, and withdraw consent where it applies. Write to support@besthotels4.me — we reply within 15 days. Completed bookings may need to be retained for the tax period even after account deletion.
Tours and activities (Civitatis)
If you buy a tour, we collect the lead traveller's first name, last name, e-mail and phone, plus the answers that activity requires — they vary by activity and may include details of each participant, such as name, ID document or date of birth. This data goes to Civitatis (Civitatis Tours S.L., based in Madrid, Spain), the tour supplier, and through it to the local operator that runs the activity, in the country where it takes place: the booking is made and the voucher issued with it. Civitatis handles that data under its own privacy policy. Legal basis: performance of the contract (the purchase you asked for). We keep this data with the order for the same period as booking data (5 years, for tax purposes); the technical log of the call to Civitatis, which also contains it, follows the technical-log period (12 months). Tour payment happens on Stripe — your card number never touches our servers.
Creator Program
If you arrive through a partner content creator's link (an address with ?ref=), we set the cr_ref cookie (ours, 30 days) with the creator's code and the click time; if you book a hotel within that period, the order records which creator referred you and when, so we can calculate their commission. Another creator's link replaces the previous one. This does not change the price or give a discount. The creator only sees booking data — purchase date, hotel, stay dates, status and amount — and never your name, e-mail, phone or any contact details. Legal basis: legitimate interest in correctly paying whoever referred the booking.
International transfer
Our servers and those of the payment partners are in the United States. When you book a hotel abroad, the stay details go to the hotel's country — that is what makes the booking possible.
Cookies and consent (Europe)
If you visit the site from Europe (European Union, European Economic Area, United Kingdom or Switzerland), we ask for your consent before storing the advertising and referral cookies (ad_g, ad_attr, cr_ref) and before Google Ads uses cookies; until you choose, or if you reject, they are not stored and Google receives only cookieless signals with consent denied. If the server does not notice that you are in Europe (only the browser time zone indicates it), the first page may set them before the notice; as soon as it appears we set the essential ck_eu cookie and, until you accept, they are deleted on the next page. You can change your choice at any time on the Cookies page. Outside Europe the site works as described above.