Privacy

OTAless collects as little as it can. There are two logs and they are deliberately kept apart: an analytics log that carries no identifier, and a security log that does.

OTAless is operated by Shibusa Ventures Private Limited, the company responsible for the data this page describes. Questions and requests about it: [email protected].

What is and is not stored

Handoffs: when you or an agent opens /go we store a timestamp, the stay id, an opaque ref, the agent name from the user agent, the dates and guest count, and the outbound URL
Agent calls: MCP calls store the tool name, the agent name, whether it succeeded, how long it took, the bounded parameters and the number of results
Analytics: what was searched for — place, guests, dates, filters — and how far the request got. It has no column for an IP address, a raw user agent or a cookie, so it cannot hold one
Not stored: no accounts and no payment details. OTAless itself sets no cookie; the tags described below can
Sharing: nothing is sold; nothing is shared except what the tags below send the companies that run them; the manager's own site sees only the query string of the link you open
Deletion: mail [email protected]

Google Tag Manager on this website

The otaless.com website loads Google Tag Manager, a Google script that in turn loads the tags configured in it. Those tags can set cookies in your browser and send the company that runs each one the pages you view, along with your IP address, browser details and a cookie identifier. Each company handles that data under its own terms.

Which tags: only these may be loaded: Google Analytics, Google Ads, the Meta (Facebook) Pixel, the LinkedIn Insight Tag and Microsoft Clarity. Your browser is told to refuse scripts and requests from anyone else
Analytics and ads: Google Analytics counts page views and how visitors move between pages. Google Ads, Meta and LinkedIn measure whether a visit came from one of their ads and can add your browser to an audience they later show ads to
Session recording: Microsoft Clarity records how you interact with each page — clicks, scrolling, mouse movement, what the page shows you and, unless it is masked, text typed into the search box — and replays those sessions and builds heatmaps from them, so we can see where the site is hard to use
Where: the website's pages only. Not the MCP endpoint that AI assistants call, not the JSON versions of the pages, and not the Chrome extension, which never loads it
Avoiding it: most of the tags' cookies are set on otaless.com itself, so blocking third-party cookies does not stop them. Block scripts from www.googletagmanager.com (which stops every tag above) or cookies for otaless.com in your browser's settings, use a content blocker, turn JavaScript off, or install Google's Analytics opt-out browser add-on. The catalog works the same without them
Deletion: clearing this site's cookies in your browser removes the identifier; for anything else, mail [email protected]

The security log

Separately from the analytics above, every request to the MCP endpoint and the handoff is written to a security log. That log does record identifying data, because abuse prevention is not possible without it.

What it records: your IP address, your user agent, the request method and path, the response status, how long it took and how many bytes it returned, and the API key id when a request carried one
Why: abuse prevention only: rate limiting, blocking, and recognising bulk extraction of the catalog. It is never used for analytics, advertising or profiling, and it is never joined to the analytics log
How long: 30 days, then it is deleted
Removal: to have your address removed from it sooner, mail [email protected]

What we keep about property managers

The catalog is built from managers' own public listing pages. Besides the stay facts it publishes, it keeps one thing it never publishes: the business contact details a manager states on their own site.

What: email addresses, phone numbers, a postal address, a contact-form URL and social links, as the manager publishes them on their own home, contact or about page, with the page each came from and when we saw it. Nothing about guests, and nothing from anywhere but the manager's own site
Why: to reach the manager about their own listings: a correction, a removal, and later the claim that lets them manage how their stays appear here. Never for marketing lists, never sold or shared
Where: a private table that no page, JSON twin, MCP tool, sitemap or export can read. None of it is ever shown on this site
Opt-out: mail [email protected] from the domain (or see /claim): opting out removes the site's stays from the catalog and deletes every contact detail we hold for it

The Chrome extension

The OTAless extension answers one question about the Airbnb listing or Booking.com property page you are looking at: is the same stay (or, for a hotel, B&B or guesthouse, the same property), or a close one, bookable direct on the property's own site? At install it asks only for Chrome's activeTab and scripting permissions, so it cannot see any page until you click it.

When it runs: only when you click its toolbar button, and only on the tab you are looking at. On anything other than a single Airbnb listing page (an address with /rooms/ in it) or a single Booking.com property page (an address with /hotel/ in it) it reads nothing and sends nothing, unless you press “Suggest this site to OTAless” there, which sends that tab's site address (the scheme and host, no path) as a suggestion. The first click shows what is sent and asks before anything is
Automatic checks: off by default. After the first click the popup offers a switch, “Check listings automatically”. Only if you turn it on, and allow Chrome's prompt for access to Airbnb's and Booking.com's sites, does the extension read every Airbnb listing page and Booking.com property page you open, without a click, and send it to OTAless: the same facts, address and random id as a click, at most once per listing every 10 minutes, so its button can show whether the stay can be booked direct. It reads no other site and no other page of those sites. Turning the switch off stops it and gives the access back to Chrome
What it reads on Airbnb: the listing's facts: its title, the host's name, its location line and the map position the page shows for it, the property type, the bedroom, bathroom and guest counts, the names of its amenities, and the nightly price the page shows (when it shows one), so each match can show its lowest published rate beside it. It takes them from the data the page itself carries, or from the visible text of the page's main content (at most 8,000 characters). Not the page's code, images or links, not the site header with your account menu, not hidden text or anything typed into a form, not the guest reviews or the host's profile, not lines that greet you by name, and not e-mail addresses or phone numbers, which it removes. It never reads cookies, other tabs or your browsing history
What it reads on Booking.com: the property's facts: its name, its kind (hotel, B&B, inn, guesthouse, aparthotel, hostel, or a whole villa or apartment), its address line and the map position the page shows for it, the names of its facilities, and for a whole villa or apartment its size and how many it sleeps. It reads the room types the page lists but sends none of them. It never reads the page's text, the review score, the reviews, the Genius label, prices, or the dates and party in the search box, nor cookies, other tabs or your browsing history
What it sends: those facts, once per click (or, with automatic checks on, once per listing or property page you open), to https://otaless.com/mcp (the same public endpoint AI assistants use), which compares them with each stay it knows and answers with the same stay or property or the closest ones. Only when an Airbnb page does not say where the listing is in a way the extension can read does it send the visible text as well, so the service can look for the place there; a Booking.com page's text is never sent. With it go the page's web address cut to the page itself (https://www.airbnb.com/rooms/…, https://www.booking.com/hotel/…: nothing after the question mark, so not the dates, guest counts, party or search you arrived with), and a random id the extension made when it was installed, so that rate limits apply per install; it is not derived from you, your account or your browser
If you press Continue: on a matched stay, it sends that stay's id (no dates or guest count), and opens the link that comes back: a /go handoff to the manager's own site, recorded like any other handoff above
What it keeps: in your browser, two things only: that you accepted the first-click notice, and the random id. Nothing about the pages you look at or the answers you get. With automatic checks on, it also keeps that setting and, until the browser closes, the answer for each tab, so the popup can show it without asking again; turning automatic checks off deletes these. Removing the extension removes everything
What OTAless keeps: what any call to the MCP endpoint leaves, as described above: the analytics log keeps the facts compared (place, guests, bedrooms, bathrooms, type, kind of lodging, amenities, and the other site's nightly price if text was sent) and the listing's address as sent, grouped by a one-way hash of the random id; the call log keeps the call's parameters cut to their first 600 characters, which for the extension is the listing's title, host or property name, location and the facts that follow them; the security log keeps the request's IP address and user agent for 30 days. None of it is sold or shared
Removal: uninstall the extension; to have what the service logged deleted, mail [email protected]

Suggesting a site

The suggest page and the extension's “Suggest this site to OTAless” button send us the address of a site that you say takes direct bookings.

What is kept: the site's address as given, the note you wrote (if any), where it came from (the page or the extension) and when. No name, no e-mail, no account
Your network address: never stored. A one-way keyed hash of it is kept for two days so that one place cannot send an unlimited number of suggestions, then deleted
What happens: the site is checked automatically like every other site we find; only a site that takes bookings for stays on its own pages is listed
Deletion: mail [email protected]

Reference data

Place names, regions and coordinates outside the United States come from GeoNames, used under CC BY 4.0. US city centroids come from the US Census Bureau Gazetteer files, which are in the public domain.