Privacy Policy

Last updated: 6 October 2026

The short version. We collect only what's necessary to send you a hotel voucher. No ad tracking, no profile building, no selling your data. If you book anonymously, we don't keep anything beyond the booking record.

1. Who we are

This policy describes how Nomada ("we", "us") collects, uses, and shares personal data in connection with the service at trynomada.com. For privacy questions, contact privacy@trynomada.com.

2. What we collect

From everyone (anonymous bookings included)

Email address — required to send your confirmation voucher.
Lead guest first and last name — passed to the hotel for the reservation record.
Booking details — hotel, dates, number of guests, room type, price.
Payment metadata — crypto currency used, payment status, our payment processor's invoice reference. We do not store your private keys or wallet seed.
Optional wallet address — if you choose to enter one at checkout, it's stored alongside your booking for your reference.

From account holders (if you sign up)

Email address and hashed password (handled by Supabase Auth; we never see the plaintext password).
Display name (if you set one).
Optional wallet address and preferred cryptocurrency, if you add them to your profile.
Session cookies to keep you signed in.

Automatically

Standard web server logs (IP address, user agent, pages visited) retained for up to 30 days for security and debugging.
Authentication session cookies, essential for signed-in users.

We do not use third-party advertising cookies, analytics beacons that follow you across the web, or data brokers.

3. How we use your data

To complete your hotel reservation and deliver a confirmation voucher.
To process your crypto payment and respond to related support requests.
To let you look up your booking by email + reference number.
To comply with legal obligations (tax, anti-fraud, sanctions screening).
To prevent abuse and secure the service.

4. Who we share data with

We share only what is necessary with the following service providers:

LiteAPI — our hotel and flight supply partner. Receives guest name, email, booking dates, and room/seat selection to make the reservation. liteapi.travel
Bitrefill — our fulfillment partner for gift cards and eSIMs. Receives the product and package identifier needed to generate your code or eSIM QR. bitrefill.com
CryptAPI — our non-custodial crypto payment forwarder. Only sees the on-chain transaction and the booking reference used as a webhook identifier. We never custody your funds. cryptapi.io
Supabase — database and authentication provider that stores booking records and account data on our behalf. supabase.com
Vercel — our hosting platform. Processes web requests and serves the site. vercel.com

We do not sell personal data to anyone. We only share with law enforcement when legally compelled.

5. International transfers

Our service providers process data in multiple regions, including the European Economic Area, the United States, and the Asia-Pacific region. Where we transfer personal data outside your home jurisdiction, we rely on the standard contractual protections offered by each provider.

6. How long we keep data

Booking records: retained for 7 years after the stay for tax and audit purposes.
Account profile data: retained until you request deletion.
Server logs: 30 days.
Session cookies: expire at logout or after 30 days of inactivity.

7. Your rights

Depending on where you live, you may have the right to:

Request a copy of the personal data we hold about you;
Correct inaccurate data;
Request deletion (subject to legal retention obligations such as tax records);
Object to or restrict certain processing;
Lodge a complaint with your local data protection authority.

To exercise any of these rights, email privacy@trynomada.com from the address associated with your booking or account. We respond within 30 days.

8. Cookies

We use the minimum cookies needed to run the service:

Session cookies (Supabase Auth) — required to keep you signed in.
Admin cookie (nm_admin) — only set for operators of the booking console.

We do not use advertising, tracking, or analytics cookies.

9. Security

Data in transit is encrypted via HTTPS. Account passwords are hashed by Supabase Auth; we cannot see them. The database runs under row-level security policies that prevent cross-user data access. However, no system is 100% secure — we encourage you to use a strong, unique password for your Nomada account.

10. Children's privacy

Nomada is not intended for anyone under 18. If you believe a minor has created an account, email us at privacy@trynomada.com and we will delete it promptly.

11. Changes to this policy

We will update this page when we materially change how we handle data, and we'll update the "Last updated" date. For significant changes affecting account holders, we'll also email you.

12. Contact

Privacy questions or requests go to privacy@trynomada.com. General support is hello@trynomada.com.