In short
- Reading the site requires no account. Our own visitor counter uses no cookies and stores no IP addresses.
- Trip plans are deleted automatically after seven days.
- Google Analytics and advertising cookies are used only if you accept them.
- We never see or store your card details.
- You can download or delete your data at any time from My account.
Who is responsible
Bookskies (also published as Bookskies, سماء مفتوحة, आसमान तक and Cielo Abierto) is run by Sereyan for Private Software Services Design and Programming (commercial permit no. 343175) ("we"), based in the State of Qatar, which is responsible for your personal data. Contact: info@sereyan.com.
We process personal data in line with Qatar's Law No. 13 of 2016 on the Protection of Personal Data Privacy and, for readers in the European Economic Area and the United Kingdom, the General Data Protection Regulation (GDPR).
What we collect and why
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Visitor statistics: page viewed, referring site, country and city (derived from the IP address by our host, the address itself is not stored), device type, browser, operating system, browser language and time on page | To understand which pages are read and improve the site | Legitimate interests | 25 months, then deleted |
| Account: email address, optional name, language, and a password stored only as a secure hash (if you choose a password) | To create your account and sign you in | Contract | Until you delete your account |
| Membership status, plan, amounts and dates | To give members access and keep payment records | Contract; legal obligation | As long as tax and accounting law requires |
| Trip plans: destination, dates, number of travellers, budget level and currency | To build your plan and let you share or download it | Contract (providing the service you asked for) | 7 days, then deleted automatically |
| Email address given to download a plan as a guest | To unlock the download and, if you ticked the box, to send our newsletter | Consent | Deleted with the plan after 7 days; newsletter until you unsubscribe |
| Newsletter: email address and language | To send the newsletter you confirmed | Consent | Until you unsubscribe; unconfirmed sign-ups are deleted after 30 days |
| Comments: name, text, language and a hashed IP address | To publish and moderate comments and prevent spam | Legitimate interests | While the comment is published; rejected and spam comments are deleted after 90 days |
| Star ratings | To show a guide's rating, one per reader | Legitimate interests | While the guide is online |
| Error reports and optional email | To correct guides and reply to you | Legitimate interests | Deleted 12 months after they are handled |
| Security data: hashed IP address for rate limits and sign-in links | To stop abuse and protect accounts | Legitimate interests | Deleted once expired, at most a few days |
| Analytics and advertising data (Google) | To measure readership and show ads | Consent (cookie banner) | Set by Google; see our cookie policy |
A hashed IP address is a one-way code: it can't be turned back into your IP address.
Our visitor statistics
We count visits with our own counter rather than a third-party tracker. It sets no cookies and stores nothing in your browser. To tell visits apart, it creates a code from your IP address and browser that changes every day, so the same person can't be followed from one day to the next, and the IP address itself is never saved. Visits from our staff and from browsers that send a "Do Not Track" or "Global Privacy Control" signal are not counted. Statistics are kept for 25 months so we can compare one year with the next.
Trip plans
When you create a plan, we store what you entered (destination, dates, travellers, budget level, currency) and the generated plan, under a random link. Anyone with the link can view the plan, so share it only with people you trust. Plans are deleted seven days after they are created; after that the link opens the planner. If you are signed in, the plan also appears in your account until it is deleted.
To download a plan as a PDF, members download directly. Guests are asked for an email address and must tick a box to agree to receive our newsletter; that subscription must be confirmed by email (double opt-in), and you can unsubscribe at any time.
Payments
Payments are made on the payment provider's secure checkout page. We receive confirmation of the payment, the amount, the plan and the date, but never your card details.
Service providers
We use these providers to run the site. They process data on our behalf, only for these purposes:
- Vercel (hosting and image storage). Our servers run in Frankfurt, Germany.
- Supabase (database), hosted in Frankfurt, Germany.
- An email service (Resend, Brevo, Mailchimp or MailerLite) to send sign-in links, receipts and the newsletter.
- The payment provider shown at checkout (Stripe, PayPal, Tap Payments, Paddle or Lemon Squeezy). Paddle and Lemon Squeezy act as the seller of record and are responsible for the payment data they collect.
- Cloudflare Turnstile, to tell people from bots on sign-up, sign-in and other forms.
- Google (Analytics, Tag Manager, AdSense, Google Ads), only if you accept analytics or advertising cookies, and Google Sign-In if you choose to sign in with Google.
- An AI service (such as DeepSeek), if enabled, to help our editors draft and check guides from public sources. It never receives readers' personal data.
- Public data sources for exchange rates, travel advice and public holidays. We send them no personal data.
Some providers process data outside Qatar, including in the European Union and the United States, under their contractual data-protection commitments.
Your rights
You can ask to access, correct or delete your personal data, withdraw consent at any time, object to processing based on legitimate interests and, where it applies, receive your data in a portable format. In practice:
- Download or delete your data, and change your email preferences, from My account. Deleting your account cancels any active membership.
- Unsubscribe from any email with the link at its end.
- Change your cookie choices from "Cookie settings" at the bottom of every page.
- For anything else, email info@sereyan.com with the subject "Privacy". We reply within 30 days and may ask you to confirm your identity.
If you believe we have mishandled your data, please contact us first. You may also complain to Qatar's National Cyber Security Agency, which supervises Law No. 13 of 2016, or to the data protection authority in your country.
Children
Bookskies is not directed at children. Accounts, comments and the newsletter are for people aged 16 or over. If you believe a child has given us personal data, contact us and we will delete it.
Security
Connections are encrypted (HTTPS). Passwords are stored only as salted hashes (Argon2), never in readable form. Payment and email service keys are stored encrypted. Sessions use secure, signed, HTTP-only cookies; sign-in and sign-up are protected against bots and repeated attempts; administrator accounts can use two-step verification.
Changes to this policy
We update this page when our practices change. The date at the top shows the latest version. If a change significantly affects how we use your data, we will tell account holders by email.