Privacy
This notice applies to the website ospitra.com and to the public search of Ospitra Nexus, including in ChatGPT and other AI assistants. The Ospitra app, accounts and the demo have their own privacy notices, shown there. Last updated: October 2026.
This English version is provided for convenience. The German version prevails. Open German version
1 Controller
billiton internet services GmbH, Tölzer Str. 1, 82031 Grünwald, Germany Represented by Patrick Schulte Email: info@billiton.de · Phone: +49 271 30386-0
2 Summary
The website ospitra.com is a static website. It sets no cookies, uses no analytics or tracking and embeds no third-party services. We serve fonts and scripts ourselves. There is no form and no sign-in on the website. The public search of Ospitra Nexus processes search requests without any information about the traveller as a person (section 7). The hotel index contains only public business information about hotels (section 8).
3 Hosting and server logs
The website and Ospitra Nexus are hosted by Vercel Inc., USA. With every request the server processes technically necessary data: IP address, time, requested address, referring page and information about browser and operating system. Purpose: to deliver the website and the service and to protect them against misuse. Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is secure and reliable delivery. Vercel processes this data on our behalf (Art. 28 GDPR) and deletes the logs within the periods set out in its data processing agreement. We do not analyse the logs or combine them with other data.
4 Cookies and local storage
The website sets no cookies. If you choose a language, the website stores that choice in your browser's local storage under the key "ospitra.sprache". This is strictly necessary for the function you requested (Section 25(2) no. 2 TDDDG) and never leaves your device. You can delete the entry in your browser at any time.
5 Contact by email
If you email us, we process your email address, your name if given and the content of your message in order to answer your request. Legal basis: Art. 6(1)(b) GDPR if your request concerns a contract, otherwise Art. 6(1)(f) GDPR. We delete the data once the request is settled, unless statutory retention duties require longer storage.
6 Moving to the Ospitra app
The buttons "Try it now" and "Sign in" lead to the Ospitra app. Session and account data only arise there. The app has its own privacy notice.
7 Ospitra Nexus in ChatGPT and other AI assistants
Ospitra Nexus can be used from AI assistants such as ChatGPT without signing in. When you ask for hotels there, the assistant sends a search request to Nexus: place or hotel, travel dates, number of guests and, where applicable, a hotel's identifier. Nexus does not ask for names, contact details or payment details of travellers. Nexus does not book and does not take payments. The request reaches us from the assistant's servers, for ChatGPT from OpenAI. We use their IP address to limit the number of requests per origin and to prevent misuse. We log the requests themselves (tool, time, search details) without any information about you as a person, in order to run the service and measure its quality. Assistants may attach technical information to a request, such as language or approximate location; Nexus neither evaluates nor stores it. When Nexus checks availability at your request, it queries the hotel's booking engine or system with travel dates and occupancy only, never with information about you. We use the result for at most 15 minutes and delete it after 24 hours. The Nexus database is operated on our behalf (Art. 28 GDPR) by Supabase Inc., USA, in a data centre in Frankfurt am Main, Germany. Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is to answer the search you requested and to protect the service against overload. What you enter in the assistant and how its provider handles it is governed by the assistant's privacy policy; its provider is responsible for that.
8 Hotels in the Nexus index (information under Art. 14 GDPR)
So that travellers can find hotels through AI assistants, Nexus keeps an index of independent hotels. For a hotel that has not claimed its entry, we keep public business information only: name, address, geo-coordinate, website, public phone number and email address, category or stars, facilities and the link to its own booking engine. Sources are the hotel's website and official or open directories. We do not take photos, descriptions or names of people. Every such entry carries the note "Information from public sources, not confirmed by the hotel" with the source and age of each item. Where the information is personal data, for example for a sole trader, the legal basis is Art. 6(1)(f) GDPR. Our legitimate interest, and that of travellers, is to make independent hotels findable. Recipients are AI assistants and their users searching for hotels. You can object at any time (Art. 21 GDPR) without giving reasons: via the link "Remove entry" on the entry or by email to nexus@ospitra.com, sent from an address on the hotel website's domain as proof. We delete all information within 48 hours. To avoid adding the hotel again, we keep only a checksum of domain and address.
9 Transfers to third countries
Vercel Inc. and Supabase Inc. are based in the USA. Transfers rely on the European Commission's adequacy decision on the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795) and additionally on the Commission's standard contractual clauses (Art. 46(2)(c) GDPR) in the providers' data processing agreements.
10 Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR). Please write to info@billiton.de.
11 Right to lodge a complaint
You may lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). Our competent authority is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany.
12 Obligation to provide data
You are not obliged to provide us with any data. Without the technically necessary data described under hosting, the website and the service cannot be delivered. There is no automated decision-making under Art. 22 GDPR.