How Airflow handles business and contact details

Who this is for

This notice is for the owners, managers and staff of places to stay — lodges, camps, guesthouses, villas, hotels and rentals — that appear on Airflow Stay, in Airflow Guest trip planning, or in an email from Airflow about a listing. Travellers using Airflow are covered by our Privacy Policy.

Who we are

Airflow is a product of Overtone Limited, a company registered in England and Wales (no. 06964895), registered office c/o Boyett Mayes Limited, The Stables, Moneys Farm, Bottle Lane, Mattingley, Hampshire RG27 8LJ, United Kingdom. We are registered with the UK Information Commissioner’s Office (ICO) as a data controller, registration ZB065549. Questions about this notice, or any request under it, go to [email protected] or the links below. Our data protection contact is Tristan Waterkeyn at that address.

What we hold about a place

To help travellers find and plan a stay, Airflow keeps a directory of places to stay. For each place we may hold: its name, type, location and map pin, website, a short description in our own words, facilities, activities and who it suits, and, where a business publishes them, its public contact details — a booking or enquiry email address, a phone number, and the name and role of a contact person.

Where it comes from

Your own website and public listings — read by Airflow’s research tools, which record what a page says and where it said it.
Trade rate sheets and directories shared in the travel industry.
Google Maps, for a place’s position on the map and its Google place identifier. We do not keep Google’s contact or address text.
Travellers and operators, who can recommend a place or correct a listing.
You, when you check, correct or complete your listing.

A listing built only from public sources is shown to travellers with the words “compiled from public sources — not yet confirmed by the host” until someone from the business looks at it.

Why we hold it, and our lawful basis

To show travellers places to stay and send them to you — Airflow’s legitimate interest, and yours, as a directory that links straight to the business (POPIA section 11(1)(f); GDPR article 6(1)(f)).
To tell you that we hold it and let you check it — a legal duty when details are collected from somewhere other than the person they concern (POPIA section 18; GDPR article 14). Our first email to a business is that notice.
To pass on a traveller’s request when someone asks about your dates — performance of the service the traveller asked for.
To run your listing and your Airflow account once you have confirmed it — communications about your listing, the details we hold, traveller requests and your account are part of the service and are sent to every confirmed listing.
Airflow news and offers — only if you tick the box. You can untick it at any time.

Because Overtone Limited is established in the United Kingdom, UK data protection law (UK GDPR and the Data Protection Act 2018) applies to everything we do with your details, wherever you are. Where the law of your own country also applies — POPIA in South Africa, the Data Protection Act 2019 in Kenya, the GDPR in the EU — we follow it as well.

What travellers see

A place’s name, location, description, facilities and website. Your email address and phone number are never shown to travellers. When a traveller asks about your dates, their request comes to you; you decide whether to reply.

What we never do

We do not sell contact details. We do not send marketing to a business that has asked us not to. We do not send more than one unsolicited email to a business asking it to check its details; after that we write only if you have engaged with us or a traveller has asked about your dates. We do not charge commission on any booking unless you have accepted Airflow’s terms for your account.

Who else sees it

Travellers on Airflow Stay and in Airflow Guest.
Service providers that store or send it for us: Supabase (database), Mailgun (email), Cloudflare (hosting), Google (map pins). Each acts on our instructions under a data-processing agreement.
Nobody else, unless the law requires it.

Your details may be stored outside your country. Our providers are bound by contract to protect them to a standard comparable with the laws that apply where you are.

How long we keep it

A confirmed listing stays for as long as it is on Airflow. A listing that no one from the business has confirmed, and that has not engaged with us, has its personal contact details (contact name, personal email, phone) removed after 24 months; the business itself may remain as a public place. When you ask us to remove a listing, we keep only a record that prevents it being added again.

Your rights

You can, at any time and free of charge:

See what we hold — it is shown in every email we send you and on your listing’s check page.
Correct it — on the check page, or by replying to any email.
Object to us holding or using it, or to any marketing.
Remove it — the listing, your personal details, or both, with one click from any email or from the “Correct it or have it removed” link on the listing page.
Complain — to the UK Information Commissioner’s Office (ico.org.uk), which supervises us, or to the regulator where you are: in South Africa the Information Regulator ([email protected]); in Kenya the Office of the Data Protection Commissioner; in the EU your national data protection authority.

We answer requests within 30 days.

Changes

We will note the date of any change at the top of this page. Where a change affects what we send you, we will say so in the next message.

Last updated: Tue Sep 22 2026 00:00:00 GMT+0000 (Coordinated Universal Time)