cruise.honeefy.de — honeefy Cruise Guide
As of: October 2026
Deutsche Fassung (German version)
The controller within the meaning of the GDPR for the operation of the AI-based advisory platform (honeepot technology, honeebot Cruise Guide) is:
honeepot GmbH
Bornkamp 2a, 22043 Hamburg, Germany
Email: team@honeepot.com
Telephone: +49 160 97779007
Commercial register: HRB 181649, Amtsgericht (Local Court) Hamburg
Managing Director: Torsten Ostmeier
honeefy is a brand of honeepot GmbH.
This section applies exclusively to bookings made through honeefy. If you use honeebot under another brand or through another provider, the booking partner named there applies.
For bookings made through honeefy, honeepot GmbH (section 1.1) acts as the travel agent (travel intermediary). The booking is processed (handling, payment processing, customer service) on its behalf by:
onlineweg.de Touristik GmbH
Ortlerstr. 2, 81373 München
Email: datenschutz@onlineweg.de
Telephone: +49 89 700 966-0
Registry court: Amtsgericht Dresden, HRB 21457
To do so, onlineweg.de Touristik GmbH processes the details required for the booking (section 3.5). Further information on the processing at onlineweg.de Touristik GmbH is in its privacy policy: https://www.honeefy.de/datenschutz
Data protection officer of onlineweg.de Touristik GmbH:
RA Christian Krösch, SLK Compliance Services GmbH, Königsbrücker Straße 76, 01099 Dresden
Email: datenschutz@slk-compliance.de
honeepot is an AI-based advisory platform (AI Advisory Platform) developed as a technological infrastructure layer for personalised travel advice. The platform provides so-called Guides — specialised AI advisers for individual travel categories (e.g. cruises, package holidays, hotels). These Guides are orchestrated by a central Master agent.
The honeepot technology is operated as:
The honeebot Cruise Guide is the chat interface of the honeepot platform, specialised in cruises. In dialogue with the AI adviser, users can state their travel wishes, compare offers and initiate a booking.
We also offer our cruise advice through the Model Context Protocol (MCP). It lets an AI assistant of your choice (for example Claude by Anthropic or ChatGPT by OpenAI) query cruise offers, ports, ships and cruise lines from us at your request. There are two forms:
Who is responsible? For processing on our server we (honeepot GmbH, section 1.1) are the controller. Your conversation with the assistant itself takes place with the assistant's provider (for example Anthropic PBC or OpenAI) and is governed by their privacy policy, not this one. We do not receive that conversation.
What data do we receive? Our server receives only what the assistant sends for the request: destination, travel period, number of travellers and the age of accompanying children, preferences such as nights, ports, cruise line or flights, for an opinion on an offer possibly a short description of the travel party, and technical information about the assistant (application name and version). We receive neither your name nor your email address nor your conversation history, and the network address that reaches us is that of the assistant provider, not yours. Please do not pass sensitive information (for example about your health) through the assistant; we do not need it.
What do we store, and for how long?
With sign-in we additionally process your email address: the sign-in service Clerk (see 5.1) verifies your access token and tells us your email address; we check whether you are a member of the client. For security we remember which access token (as a hash) was most recently valid for your account — for at most 30 days. Your email address also appears in our usage log (at most 13 months, see above).
Purposes and legal bases:
| Purpose | Legal basis |
|---|---|
| Answering your requests through the assistant (search, cards, opinion), advice handle, offer cache | Art. 6(1)(b) GDPR (pre-contractual steps at your request) or (f) (interest in working advice), to the extent personal data is involved at all |
| Usage log, server logs, error monitoring, daily counter | Art. 6(1)(f) GDPR (operational security, abuse prevention, cost control) |
| Sign-in and membership check (with sign-in) | Art. 6(1)(b) GDPR (contract with you or your company), alternatively (f) |
| Opinion on an offer ("advise") | as advice; processing by Anthropic see 6.1 |
Recipients: Railway (hosting, 4.1), Supabase (database, 4.2), our cache (Redis, run at Railway, 4.1), Clerk (sign-in only, 5.1), Anthropic (opinions only, 6.1), travel data providers (search parameters without personal reference, section 7), Sentry (error monitoring, 4.3). Passing data on to the assistant provider is done by you; the offers we return contain public offer data and booking links.
Booking: The service does not book. If you open a booking link you reach the booking partner's site (section 1.2); its privacy policy applies in addition.
Your rights (section 14) apply here too. Because we cannot identify you through the advice handle, we can handle access or deletion requests about a handle only if you tell us the handle. Requests: team@honeepot.com.
When the platform is accessed, the following data is recorded automatically:
Purpose: Operational security, troubleshooting
Legal basis: Art. 6(1)(f) GDPR (legitimate interest)
Storage period: 30 days. After that, the logs are deleted automatically by our hosting provider. We do not truncate the IP address; the address is needed solely to defend against attacks and for troubleshooting and is not merged with the advisory conversation. For calls through the MCP interface (2.3), the IP address transmitted is that of the assistant provider, not yours.
Registration is required for access as an adviser, tester or partner user. The following is processed:
Purpose: Access control, authentication
Legal basis: Art. 6(1)(b) GDPR (performance of a contract)
In dialogue with the honeebot Cruise Guide, the content of your conversation is processed, in particular:
Important: The content of the conversation is transmitted to the AI service provider Anthropic to generate AI responses (see section 6.1). Anthropic does not train its models on API data of business customers.
Purpose: Personalised travel advice
Legal basis: Art. 6(1)(b) GDPR (performance of a contract / pre-contractual steps) and Art. 6(1)(a) GDPR (consent) for optional storage
Storage period: Conversation histories are deleted automatically after 180 days. Earlier deletion takes place at any time on request to team@honeepot.com.
Users can save their travel preferences in a persistent note function ("Spickzettel", cheat sheet). This data is stored in the database and assigned to the respective session/user account.
Legal basis: Art. 6(1)(a) GDPR (consent by deliberate use of the function)
Storage period: Until deleted by the user, at the latest 180 days after the last use. Earlier deletion takes place at any time on request to team@honeepot.com.
If you initiate a booking, submit a callback request or contact us by email, the following is processed:
For a booking made through honeefy, this data is forwarded to onlineweg.de Touristik GmbH, which processes the booking on behalf of honeepot GmbH (section 1.2), for the performance of the contract.
Legal basis: Art. 6(1)(b) GDPR
Storage period: In accordance with statutory retention obligations, up to 10 years at onlineweg.de
Testers of the honeebot Cruise Guide receive a personal access link and agree to separate tester terms on first use. The following is processed:
Legal basis: Art. 6(1)(a) GDPR (consent)
We count how far a consultation gets, so that we can improve the service and show our partners how it performs. Only steps are counted, never content: consultation started, travellers, period and destination known, offer shown, link to the booking page opened.
What we store: the time; a random consultation identifier that is not linked to your name or email address; the identifier of the offer shown or clicked (public offer data); the origin (for example chat on our own site, widget on a partner's site, ChatGPT, Claude, summary email); the catalogue provider; and, for each detail, only yes or no whether it was known (for example "travellers: yes"). We do not store what you entered, the age of children travelling, notes, or any health information.
What we do not store: your IP address, your browser identifier, your name, your email address. The identifier of an ad click (for example from an ad in ChatGPT) is read only to recognise the origin; we do not store it, do not pass it on to the booking page, and do not report it back to the advertising provider.
In MCP apps (ChatGPT, Claude) the display of the offers reports that it was drawn, and a click on a booking link reports that it happened, to our server, where the operator of the respective service has switched this on. The assistant receives only the answer "ok".
Purpose and legal basis: improvement and secure operation of the service and evidence towards our partners, Art. 6(1)(f) GDPR. We read nothing from your device and store nothing on it.
Retention: the individual events for 13 months, then they are deleted. Daily figures derived from them, per origin, tenant and step, which carry no personal data, are kept.
Recipients: Railway (hosting, 4.1) and Supabase (database, 4.2). There is no disclosure to advertising networks, to OpenAI or to Anthropic.
You may object (section 14, Art. 21 GDPR) at any time: team@honeepot.com, with the consultation identifier if you have it (it is in the address you received). Because we cannot identify you through that identifier, we can only act on an objection for an identifier you name.
The honeebot application is hosted by:
Railway Corp.
340 S Lemon Ave #4133, Walnut, CA 91789, USA
Railway processes technical access data in the course of operating the application. A data processing agreement (DPA) is in place. Data is transferred to the USA on the basis of Standard Contractual Clauses (Art. 46(2)(c) GDPR).
Note: We use EU server options where available in order to minimise transfers to third countries.
User data, conversation data and configuration data are stored by:
Supabase Inc.
970 Toa Payoh North, Singapore (legal entity)
Data storage: EU region Ireland (AWS eu-west-1)
Because the data is stored in the EU, no transfer to a third country takes place. A data processing agreement is in place.
If technical errors occur in the application, error data (error message, location in the program code, function called, time, technical information about the environment) is transmitted to:
Functional Software, Inc. (Sentry)
45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA
Data storage: US region
The transmission is configured so that no personal headers, cookies or IP addresses are sent along; card and account numbers are filtered out before sending.
Purpose: Detecting and fixing errors
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in error-free operation)
Storage period: 90 days, after which the provider deletes the error data automatically.
A data processing agreement is in place. Data is transferred to the USA on the basis of Standard Contractual Clauses (Art. 46(2)(c) GDPR).
User authentication (login, password management, secure access tokens) is carried out through:
Clerk, Inc.
548 Market St PMB 72878, San Francisco, CA 94104, USA
Clerk processes login data, email addresses and session tokens. Data is transferred to the USA on the basis of Standard Contractual Clauses. A data processing agreement is in place.
The honeebot's advisory responses are generated with the help of the AI language model Claude from:
Anthropic PBC
548 Market St #31284, San Francisco, CA 94104, USA
The content of the conversation (your questions and travel wishes) is transmitted to Anthropic for processing. Anthropic does not use API data to train its AI models. A data processing agreement and a Data Processing Addendum (DPA) are in place. Data is transferred to the USA on the basis of Standard Contractual Clauses.
Purpose: Generating contextual, personalised advisory responses
Legal basis: Art. 6(1)(b) GDPR; Art. 6(1)(f) GDPR (legitimate interest in high-quality AI advice)
For semantic search in offer and information databases (so-called Retrieval-Augmented Generation, RAG) we use:
Voyage AI Inc.
USA
Voyage AI processes text content to create vector data (embeddings). Personal user data is processed in this context only in anonymised or aggregated form. A data processing agreement is in place. Data is transferred to the USA on the basis of Standard Contractual Clauses.
To create offers, the honeebot Cruise Guide accesses various external travel data APIs. These data sources provide product data (cruise offers, ship data, prices), not personal data of users.
Bookable cruise offers, availability and prices:
XML Team Solutions S.L.
Spain/USA
Travel content and product data:
Passolutions (provider of travel technology solutions)
Bookings are processed through Global Distribution Systems (GDS). In this process, booking-relevant data (name, travel data) is transmitted to the respective systems and ultimately to the tour operator. This disclosure takes place as part of the booking processing by onlineweg.de Touristik GmbH on behalf of honeepot GmbH.
Editorial content, hotel descriptions and reviews are obtained from third-party providers as product data. No personal user data is transmitted in this context.
For booking shore excursions we work with:
Meine Landausflüge (provider details to follow after integration)
When a shore excursion is booked, name, travel data and booking data are transmitted to this provider.
System emails (invitations, access tokens, notifications) are sent through:
Brevo SAS (formerly Sendinblue)
106 Boulevard Haussmann, 75008 Paris, France
Brevo is a provider based in the EU. Processing takes place within the EU. A data processing agreement is in place.
For privacy-friendly analysis of platform usage we use Matomo:
Matomo Cloud
Hosted service of InnoCraft Limited, based in New Zealand; data storage in Frankfurt am Main. The EU Commission has issued an adequacy decision for New Zealand, so there is no transfer to a third country within the meaning of Art. 44 GDPR. A data processing agreement under Art. 28 GDPR is in place.
Matomo records:
Processing takes place on servers in Germany.
Legal basis: Art. 6(1)(f) GDPR
Opt-out: You can object to the analysis by activating "Do Not Track" in your browser. Matomo respects this setting.
The honeebot Cruise Guide uses only technically necessary cookies and Local Storage:
| Purpose | Type | Storage period |
|---|---|---|
| Session management (login) | Cookie | Session duration / until logout |
| Language setting | Local Storage | 30 days |
| Advisory session | Session Storage | Until the browser is closed |
Tracking cookies or marketing cookies are not used.
Because only technically necessary cookies are used, no cookie banner requesting consent is required. A cookie settings page is nevertheless available.
If you use the honeepot technology as a business customer (SaaS or white label), your company is the controller under data protection law towards your end users. In this case honeepot GmbH acts as processor pursuant to Art. 28 GDPR. Concluding a data processing agreement (DPA) is a prerequisite for using the platform.
| Provider | Country | Basis for transfer |
|---|---|---|
| Railway | USA | Standard Contractual Clauses (Art. 46(2)(c) GDPR) |
| Supabase | EU (Ireland) | — (no transfer to a third country) |
| Clerk | USA | Standard Contractual Clauses |
| Sentry (Functional Software) | USA | Standard Contractual Clauses |
| Anthropic | USA | Standard Contractual Clauses |
| Voyage AI | USA | Standard Contractual Clauses |
| XML Team | Spain/USA | Standard Contractual Clauses |
| Brevo | EU (France) | — (no transfer to a third country) |
| Matomo | InnoCraft Limited (Matomo Cloud), data in Frankfurt, registered office New Zealand | — (New Zealand: adequacy decision of the EU Commission) |
We point out that, for transfers to the USA, a residual risk remains despite Standard Contractual Clauses, because US authorities may under certain conditions demand access to data stored there.
You have the following rights against honeepot GmbH:
Please address requests to: team@honeepot.com
For data relating to bookings, please contact: team@honeepot.com or datenschutz@onlineweg.de
You have the right to lodge a complaint with the competent data protection authority. The authority responsible for honeepot GmbH is:
Hamburgischer Beauftragter für Datenschutz und Informationsfreiheit (the Hamburg Commissioner for Data Protection and Freedom of Information)
Ludwig-Erhard-Str. 22, 20459 Hamburg, Germany
Email: mailbox@datenschutz.hamburg.de
This privacy policy applies to cruise.honeefy.de and to the MCP interface at app.honeebot.io/mcp (section 2.3). It is updated when the platform or the legal situation changes. The current date is shown at the top.
For the privacy policy of the booking platform (onlineweg.de) see: https://www.honeefy.de/datenschutz