Privacy Policy

What we collect

Email address — given voluntarily when you use the Pet Travel Planner's search (required, so we can send you your result and enforce fair usage) or the Concierge waitlist (optional extra details: route, travel month, and what you'd want help with, if you choose to share them).

Pet details you enter — species, breed and weight, and whether your pet travels as a pet, a trained service dog, or an ESA. Used only to compute your results; not linked to your identity beyond your email for the purpose of sending you that result.

Technical & usage data — page views, which step of the planner you reach, outbound clicks, and basic device/browser info, collected through our own first-party track.js script (no third-party analytics SDK, no cross-site tracking pixel).

We do not collect payment details (we never ask for a payment method), passwords (there's no account/login), or location beyond what you type into the route fields.

Why we collect it (legal basis)

Where GDPR/UK GDPR applies: your email for marketing tips is collected on the basis of your explicit opt-in consent (the checkbox is unticked by default and never pre-checked) — you can withdraw it at any time via the unsubscribe link in any email, or by writing to us. Your email for the planner result itself, and the technical data needed to run the search and prevent abuse (rate-limiting, bot-proofing via our self-hosted ALTCHA check), are processed under legitimate interest — operating the free tool you asked to use.

Cookies we use

All cookies on this site are first-party and functional — none are third-party advertising or cross-site tracking cookies.

• mlt_ptp_tok — a secure, httpOnly, 180-day token proving a search or concierge request really came from a verified email gate, not a forged one.
• mlt_ptp_dev — a secure, httpOnly, signed random device ID (about 13 months) used only to give each browser its own fair-use allowance of planner searches, so people sharing the same Wi‑Fi never use up each other's searches. Carries no personal data.
• merlot_admin_session, merlot_admin_csrf — set only if you sign in to this site's private admin dashboard (site owners only). Regular visitors never receive them.

A few small items are also kept in your browser's own storage (not cookies, never sent to any third party):

• mlt_ptp_email (local storage) — your planner email, purely so you don't have to retype it on a return visit. It only leaves your device when you submit a new search or signup.
• mlt_ptp_state_v1 (session storage) — your in-progress planner choices (pet, route, dates), so a page refresh doesn't lose them. Deleted when you close the tab.
• mlt_sid, mlt_last, mlt_sid_fallback (session storage) — a random, anonymous visit ID for our own first-party analytics, reset after 30 minutes of inactivity and deleted when you close the tab. Not linked to your email.
• mlt_optout (local storage) — remembers that you opted out of our analytics, if you did.

Clearing your browser data removes all of the above.

Affiliate links & partners

This site earns a small commission, at no extra cost to you, when you book through certain outbound links — this is how the planner stays free. Current partners: Skyscanner (flights and hotel search) and Stay22 (map-based stay suggestions). When you click through, you leave merlotthegoldie.com and that partner's own privacy policy and terms apply to whatever you do on their site. We don't share your email or pet details with these partners — the link itself carries only an anonymous affiliate/tracking ID.

The planner never shows invented or estimated flight prices — live pricing is always shown on the partner's own site after you click through.

How long we keep it, and who sees it

Email addresses and planner data are stored on our own servers (not sold or shared with data brokers) and kept for as long as needed to run the tool and, if you opted in, send occasional tips — or until you ask us to delete it. Technical/analytics data is retained in aggregate for product improvement. Our site and database are run by DodoLabs BV; no third-party marketing platform receives your raw email address.

Your rights

Wherever GDPR/UK GDPR applies, you can ask us at any time to: see what we hold about you, correct it, delete it, export it, or object to/restrict how we use it. Unsubscribing from emails is always one click, in every email. To exercise any of these rights, email collab@merlotthegoldie.com — we'll respond within 30 days. You also have the right to lodge a complaint with your data protection authority — in the UK, the ICO — if you believe we haven't handled your data properly.

Children's privacy

This site isn't directed at children, and we don't knowingly collect data from anyone under 16. If you believe a child has given us their email, contact us and we'll delete it.

Changes to this policy

If this policy changes in a meaningful way, we'll update the "last updated" date above. Significant changes affecting how we use your email will be flagged in the next email we send you.