pops.gourmand.dev
Last Updated: January 10, 2026
Pops Technologies, LLC ("Company," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Pops browser extension, website at pops.gourmand.dev, and related services (collectively, the "Service").
This Privacy Policy applies to all users of the Service worldwide, including residents of the European Economic Area ("EEA"), United Kingdom, California, and other U.S. states with comprehensive privacy laws. Jurisdiction-specific rights and disclosures are provided in Sections 11-14.
BY INSTALLING OR USING THE SERVICE, YOU CONSENT TO THE COLLECTION, USE, AND PROCESSING OF YOUR INFORMATION AS DESCRIBED IN THIS PRIVACY POLICY. IF YOU DO NOT AGREE WITH THIS PRIVACY POLICY, PLEASE DO NOT USE THE SERVICE.
For purposes of the General Data Protection Regulation ("GDPR") and other applicable data protection laws, the data controller is:
Pops Technologies, LLC
Email: privacy@gourmand.dev
Website: pops.gourmand.dev
For users in the European Economic Area or United Kingdom, our representative can be contacted at:
Email: gdpr@gourmand.dev
For data protection inquiries:
Email: dpo@gourmand.dev
We collect information in the following categories:
When you create an account or contact us, we may collect:
When you browse hotel and travel websites with the Service active, we automatically collect data from the pages you view, including:
Important: We only collect hotel data from pages you actively view. We do not crawl, scrape, or collect data from pages you have not visited. All data originates from your direct browsing activity.
To improve the Service and learn your preferences, we collect Real User Monitoring data including:
RUM data is used exclusively to understand your preferences and improve recommendations. We do not record keystrokes, form inputs, passwords, or any text you type outside the Service interface.
⚠️ IMPORTANT DISCLOSURE: We use browser fingerprinting technology to create a unique identifier based on technical characteristics of your browser and device.
This includes:
Unlike cookies, browser fingerprint data cannot be deleted through your browser settings.
This data is used for:
You may withdraw consent for personalization-related fingerprinting through your account settings, which may affect certain Service features. Fingerprinting used for security and fraud prevention cannot be disabled.
We automatically collect:
We may receive information from:
We use collected information for the following purposes and legal bases:
| Purpose | Data Used | Legal Basis (GDPR) |
|---|---|---|
| Providing core Service functionality | Hotel viewing data, account info | Contract performance (Art. 6(1)(b)) |
| AI preference learning and personalization | RUM data, viewing patterns, hotel data | Consent (Art. 6(1)(a)) |
| Browser fingerprinting for personalization | Browser/device technical data | Consent (Art. 6(1)(a)) |
| Browser fingerprinting for security | Browser/device technical data | Legitimate interest (Art. 6(1)(f)) |
| Fraud prevention and security | IP address, fingerprint, usage patterns | Legitimate interest (Art. 6(1)(f)) |
| Affiliate commission tracking | Click data, booking attribution | Legitimate interest (Art. 6(1)(f)) |
| Service improvement and analytics | Aggregated usage data | Legitimate interest (Art. 6(1)(f)) |
| Customer support | Communications, account data | Contract performance (Art. 6(1)(b)) |
| Legal compliance | As required | Legal obligation (Art. 6(1)(c)) |
Where we rely on legitimate interests, we have conducted balancing tests to ensure our interests do not override your fundamental rights. You may request details of these assessments by contacting dpo@gourmand.dev.
The Service uses artificial intelligence and machine learning to:
Our AI system does not fabricate or "hallucinate" hotel information. All recommendations are based exclusively on real hotel data that you have viewed during your browsing sessions. If information becomes outdated, the Service will indicate when data was last seen.
We do not permit our AI service providers or subprocessors to use your Inputs or data to train their own AI models. When we use third-party AI services, contractual restrictions prevent them from using your data for their model improvement.
The recommendations provided by the Service are suggestions to assist your decision-making and do not constitute automated decisions that produce legal effects or similarly significant effects on you. You always retain full control over booking decisions.
However, you have the right to:
To exercise these rights, contact us at privacy@gourmand.dev.
💰 IMPORTANT: The Company participates in affiliate marketing programs with hotel booking platforms, online travel agencies, and travel partners. When you click on hotel recommendations or make bookings through links provided by the Service, we may receive compensation from our affiliate partners.
This affiliate relationship means:
We disclose this relationship in compliance with the Federal Trade Commission's Endorsement Guides (16 CFR Part 255).
We share limited information with affiliate partners:
We do not share your complete browsing history, AI preference profiles, email address, or other personal contact information with affiliate partners.
We may share your information with the following categories of recipients:
We share data with third-party service providers who perform services on our behalf, including:
| Category | Purpose | Data Shared |
|---|---|---|
| Cloud hosting | Infrastructure | All data (encrypted) |
| Analytics | Usage analysis | Aggregated/pseudonymized data |
| Customer support | Support tickets | Account and communication data |
| Email services | Notifications | Email address, name |
| Security services | Fraud prevention | IP, device fingerprint |
These providers are contractually obligated as data processors under GDPR Article 28 agreements to:
A list of our current subprocessors is available upon request at privacy@gourmand.dev.
As described in Section 6.1, we share limited attribution data with affiliate partners.
We may disclose your information when required by law or in good faith belief that such action is necessary to:
Law Enforcement Request Procedures: We evaluate all government and law enforcement requests and may challenge requests we believe are overbroad or legally deficient. We will notify affected users of requests for their data unless prohibited by law or court order.
In the event of a merger, acquisition, bankruptcy, reorganization, or sale of assets, your information may be transferred to the acquiring entity. We will:
We may share your information with third parties when you have given us explicit consent to do so.
We do not sell your personal information to third parties for monetary consideration.
We do not share your personal information for cross-context behavioral advertising.
See Section 13 for specific disclosures regarding California law definitions of "sale" and "sharing."
We retain your information for the following periods:
| Data Type | Retention Period | Justification |
|---|---|---|
| Account information | Until account deletion + 30 days | Backup and legal compliance |
| Hotel viewing history | 24 months from viewing | Service functionality |
| AI preference models | Until deletion/opt-out + 30 days | Service improvement |
| RUM session data | 90 days (identifiable) | Product analytics |
| RUM session data | 2 years (aggregated) | Long-term analytics |
| Browser fingerprint | 12 months from last activity | Security and fraud prevention |
| Server/access logs | 90 days | Security and debugging |
| Support communications | 3 years | Legal compliance |
| Affiliate attribution | 2 years | Partner reconciliation |
When you delete your account:
We implement appropriate technical and organizational measures to protect your information:
In the event of a personal data breach that poses a risk to your rights and freedoms:
No method of transmission or storage is 100% secure. We cannot guarantee absolute security of your data.
Your information may be transferred to and processed in countries outside your country of residence, including the United States.
When we transfer data from the EEA, UK, or Switzerland, we ensure appropriate safeguards:
We conduct transfer impact assessments to evaluate the legal framework of destination countries and implement supplementary measures where necessary.
You may request a copy of the transfer safeguards we use by contacting privacy@gourmand.dev.
If you are located in the European Economic Area or United Kingdom, you have the following rights:
| Right | Description | How to Exercise |
|---|---|---|
| Access (Art. 15) | Obtain a copy of your personal data | Email privacy@gourmand.dev |
| Rectification (Art. 16) | Correct inaccurate or incomplete data | Account settings or email |
| Erasure (Art. 17) | Request deletion ("right to be forgotten") | Account settings or email |
| Restriction (Art. 18) | Limit processing in certain circumstances | Email privacy@gourmand.dev |
| Portability (Art. 20) | Receive data in machine-readable format | Email privacy@gourmand.dev |
| Object (Art. 21) | Object to processing based on legitimate interests | Email privacy@gourmand.dev |
| Withdraw Consent | Withdraw consent at any time | Account settings or email |
| Automated Decisions (Art. 22) | Not be subject to solely automated decisions | Email privacy@gourmand.dev |
You have the right to lodge a complaint with your local supervisory authority. A list of EEA supervisory authorities is available at: https://edpb.europa.eu/about-edpb/board/members_en
For UK residents: Information Commissioner's Office (ICO) at https://ico.org.uk
We recognize and honor the Global Privacy Control (GPC) signal.
When we detect a valid GPC signal from your browser or device, we will automatically treat it as:
You can enable GPC in supporting browsers or through browser extensions. Learn more at https://globalprivacycontrol.org
We also recognize Do Not Track browser signals. When we detect a DNT signal, we will limit non-essential tracking to the extent technically feasible.
If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) provides you with specific rights.
You have the right to request disclosure of:
You have the right to request deletion of your personal information, subject to certain exceptions (legal obligations, security, completing transactions).
You have the right to request correction of inaccurate personal information.
We do not "sell" personal information for monetary consideration.
We may "share" personal information with affiliate partners for attribution purposes, which may constitute "sharing" under CCPA. You may opt out by:
We do not use sensitive personal information for purposes beyond those permitted under CCPA.
We will not discriminate against you for exercising your CCPA rights. However, opting out of certain processing may affect Service functionality.
In the preceding 12 months, we have collected:
| CCPA Category | Examples | Sold? | Shared? |
|---|---|---|---|
| Identifiers | Email, IP address, device IDs, fingerprint | No | Limited (attribution) |
| Commercial information | Hotel viewing history | No | No |
| Internet activity | Browsing on travel sites, clicks, RUM data | No | No |
| Geolocation | Approximate location from IP | No | No |
| Inferences | AI-derived preferences | No | No |
We comply with comprehensive privacy laws in the following states. Residents of these states have rights similar to those described in Section 13:
Virginia residents have rights to access, correct, delete, obtain a copy, and opt out of targeted advertising, sale, and profiling. Appeal requests can be submitted to privacy@gourmand.dev within 45 days of denial.
Colorado residents have rights to access, correct, delete, obtain a copy, and opt out of targeted advertising, sale, and profiling. We honor universal opt-out mechanisms including GPC.
Connecticut residents have rights to access, correct, delete, obtain a copy, and opt out of targeted advertising, sale, and profiling.
Utah residents have rights to access, delete, and obtain a copy, and to opt out of targeted advertising and sale.
We monitor privacy legislation and will update this policy as new state laws take effect, including laws in Oregon, Texas, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, and others.
If we deny your privacy request, you may appeal by:
If your appeal is denied, you may contact your state's Attorney General.
| Technology | Purpose | Duration |
|---|---|---|
| Essential cookies | Authentication, security | Session |
| Preference cookies | Remember settings | 1 year |
| Analytics cookies | Usage statistics | 2 years |
| Browser fingerprinting | Security, personalization | 12 months |
You can control cookies through:
Note: Disabling cookies may affect Service functionality.
For browser fingerprinting, use the opt-out mechanism in your account settings. Security-related fingerprinting cannot be disabled.
The Service is not intended for users under the age of 18.
We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will:
If you believe we have collected information from a child, please contact us immediately at privacy@gourmand.dev.
The Service may contain links to third-party websites. We are not responsible for the privacy practices of these websites. We encourage you to read the privacy policies of any third-party sites you visit.
We may update this Privacy Policy periodically. We will notify you of material changes by:
Your continued use of the Service after the effective date constitutes acceptance of the updated policy. If you do not agree, you must discontinue use before the effective date.
If you have questions about this Privacy Policy, your personal data, or wish to exercise your rights:
| Purpose | Contact |
|---|---|
| General privacy inquiries | privacy@gourmand.dev |
| GDPR/EU inquiries | gdpr@gourmand.dev |
| Data Protection Officer | dpo@gourmand.dev |
| CCPA/California requests | ccpa@gourmand.dev |
| Other U.S. state requests | privacy@gourmand.dev |
| Website | pops.gourmand.dev |
Response Times:
If you are unsatisfied with our response, you may lodge a complaint with your local data protection authority or state Attorney General.
BY USING THE SERVICE, YOU ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTOOD THIS PRIVACY POLICY AND AGREE TO THE COLLECTION, USE, AND PROCESSING OF YOUR INFORMATION AS DESCRIBED HEREIN.