Privacy policy
Last updated: 29 October 2026
1. Who is responsible
The controller under the GDPR is Vanessa Höfner, trading as Fräulein Höfner Pausalni Obrt, Frankopanski Trg 3, 51000 Rijeka, Croatia. Email: hello@doorfarer.com. OIB: 42711083744.
We have no data protection officer (not required for our size). Write to the email above for anything about your data.
2. What Doorfarer is
Doorfarer is a free travel search. You use it through an AI assistant (ChatGPT, Claude or similar) that connects to
our MCP server at doorfarer.com/mcp. This website explains the service. We earn a commission when you book
through affiliate links. You do not need an account.
3. What we process, why, and on what basis
| What | Why | Legal basis | Kept for |
|---|---|---|---|
| Search parameters your AI assistant sends: home town, destinations, dates, trip length, number of travellers. We do not receive your name, your account at the assistant, or the rest of your conversation. | To run the search and return results. | Art. 6(1)(f) GDPR: our legitimate interest in providing the search you asked for. | Not stored with the search. Fare data we fetch is cached by airport and month (no town, no person) and refreshed after 12 hours. What a town needs, see the next row. |
| Your home town, for the train or bus to the airport. A town we have not looked up before is looked up: we send its name and the airport names (no coordinates of you, no other detail) to a web search and to a language model, and to Google Routes the coordinates of the town centre for drive times. The answer (travel times and costs per airport) is kept in a cache under the town's name, like a phone book, not under any person. A small cost record keeps the town's name next to the cost of the lookup. | To show door-to-door options. | Art. 6(1)(f): providing the search you asked for. | Town cache: until it is refreshed or you ask us to delete a town. Cost record: town name blanked after 90 days, the cost stays. |
| Technical request data (IP address, browser, time, address requested), handled by Cloudflare and our server. | Delivery, security, abuse prevention, fixing errors. | Art. 6(1)(f): security and stable operation. | Our server keeps no access log and does not store IP addresses. To enforce fair limits it counts calls per caller, in memory, under a keyed hash of the address (a random key made when the server starts and never saved, so the address cannot be read back from it); the counts are gone within a day and at every restart. Error messages go to a rolling log capped at 30 MB that holds no addresses, towns or report texts. Cloudflare keeps request data under its own terms (section 7). |
Booking-link clicks. A booking link passes through doorfarer.com/go/…. We store
which link was clicked, when, and a coarse client type (browser, automated or other). We do not store your IP address
or browser string with it. |
To know which links work and to reconcile commission. | Art. 6(1)(f): measuring our own revenue. | No end date. These records do not identify you. |
| Feedback from your AI assistant. The assistant can send us a short report about where Doorfarer fell short. A report holds the assistant's own words (names, contact details, links and similar are removed automatically), the kind of problem, the id of the search it is about and, if it is not about a search, whether the caller was identified by its host or by a network address (never the address itself). It is meant to contain nothing about you. Alongside, we keep the shape of each search for 30 days: where to, the dates and trip length, the number of travellers and how many results, never your home town. | To find and fix faults in Doorfarer. | Art. 6(1)(f): improving our own service. | Reports: 90 days. Search shapes: 30 days. |
| Trips your assistant can show step by step. Each result row (airports, dates, airline, prices, how you get to the airport, the times and its booking link) and the number of travellers, so your assistant can show the trip step by step and offer a calendar file. Never your home town. | To show the itinerary and the calendar file. | Art. 6(1)(f): providing the service you asked for. | 72 hours. |
| Email, when you write to us. | To answer you. | Art. 6(1)(f), or 6(1)(b) if it concerns a contract. | Until the matter is closed, then up to one year. |
A town name alone is usually not personal data. If your assistant sent a full street address we could not tell it from a town, so please do not put your address into searches.
4. Backups
Each night we copy the database off the server, encrypted, and keep the copies for 14 days. Data we delete (reports after 90 days, for example) can stay in a backup for up to 14 days more, and is then gone. If you ask us to delete something, we delete it from the live database at once and from backups when they expire.
5. This website
These pages set no cookies, use no analytics, and load no outside fonts or scripts. We will update this policy before adding anything that changes that, such as a chat on the website or accounts.
6. Affiliate partners and their cookies
Booking links lead to our partners (today Travelpayouts and Aviasales, and the airlines or agencies they link to). When you click and arrive on their site, they may set cookies or similar identifiers to credit us with the commission. That happens on their site, under their privacy policy, and we do not receive that data, other than the commission report (what was booked and the commission, no personal details). You can refuse their cookies in their cookie banner.
7. Who else receives data
| Recipient | Role | What | Where |
|---|---|---|---|
| Cloudflare, Inc. | Network and proxy; processor | All traffic to our domain passes through it: IP addresses, request data. | USA and worldwide; EU-US Data Privacy Framework and standard contractual clauses. |
| Hetzner Online GmbH | Server hosting; processor | The server and its error log. | Germany (EU). |
| Travelpayouts / Aviasales | Flight price source and affiliate network; separate controller | Airport codes and months, to look up cached prices. No town and nothing about you. | See their privacy policy. |
| DeepSeek | Web search for new towns; processor | The town's name and airport names, as a search query. | China. The query holds no personal data beyond a place name; see their privacy policy. |
| OpenRouter and the model provider behind it | Reads the search results into travel times; processor | The town's name, airport names and text from public web pages. | USA, and where the model provider runs; standard contractual clauses or Data Privacy Framework. |
| Google (Routes API) | Drive times; processor | The coordinates of a town centre and of airports. | USA and worldwide; Data Privacy Framework. |
| Backup storage | Encrypted copies of our database; processor | The database as encrypted copies. The key is not stored with them. | Cloudflare R2 and a private computer in the EU. |
| Your AI assistant (OpenAI, Anthropic or others) | Independent controller | Your conversation. We receive only the search parameters. | Per their policies. |
We do not sell your data. We do not use it to build profiles or for automated decisions that have legal or similarly significant effects on you.
To stop planted instructions, our server checks the home town and feedback you send, and text from web pages it reads, with a small model on the server itself (Meta's Llama Prompt Guard 2, Built with Llama). Nothing leaves the server for this check, and it keeps no extra data: a feedback report it flags is stored like any other, with a mark.
8. Transfers outside the EU
Cloudflare, OpenRouter and Google may process data in the USA, and a web search goes to DeepSeek in China. The searches carry a place name and nothing about you. We rely on the EU adequacy decision for companies certified under the EU-US Data Privacy Framework and, where that does not apply, on the European Commission's standard contractual clauses. You can ask us for a copy of the safeguards.
9. Your rights
Under the GDPR you can ask us for access (Art. 15), correction (16), deletion (17), restriction (18) and a portable copy (20), and you can object to processing based on our legitimate interest (21). Write to hello@doorfarer.com. We answer within one month. Because we do not keep search data with your identity, we may not be able to find what you ask about unless you give us details (Art. 11); we will tell you if so.
10. Complaints
You can complain to a supervisory authority. For us this is the Croatian Personal Data Protection Agency: Agencija za zaštitu osobnih podataka (AZOP), Selska cesta 136, 10000 Zagreb, Croatia, azop.hr. You may also complain to the authority in your own EU country.
11. Do you have to give us data?
No. But without search parameters we cannot search.
12. Changes
We update this page when the service changes. The date is at the top.