This policy explains what happens to data on Doalu. The site asks nothing of you and builds no profile of you; the booking links that fund it take you to third parties with their own policies.
Who is responsible
Doalu is operated by Applitron Datasystem AB (Swedish company registration number 556226-4001), Marieholmsgatan 10 C, 415 02 Göteborg, Sweden. We are the data controller for this site. For any privacy question, or to use any of the rights below, write to [email protected].
What this site does not do
Doalu sets no cookies of its own, runs no analytics, and embeds no advertising, social or tracking scripts. There are no user accounts and no newsletter. We do not ask for, sell or profile personal data about visitors. The only visitor data processed is the connection data described under Server logs, and any email you send us.
Place search
What you type in the place search becomes part of the page address. It is used only to find matching places for that request. We do not store it; like any page address, it appears only in the short-lived connection logs described below.
Server logs
To deliver pages and protect the site against abuse and attacks, our hosting provider Fly.io (servers in Stockholm) and our content-delivery provider Cloudflare process technical connection data: IP address, time, the requested page address and browser type. Cloudflare may also ask your browser to report connection errors to it. The legal basis is our legitimate interest in running a secure and available website (GDPR Article 6(1)(f)). We keep no copy of these logs ourselves, do not use them to identify visitors, and never use them for marketing; our providers keep them only for their short security and diagnostics period. Fly.io and Cloudflare are US companies and process this data on our behalf under data processing agreements; transfers to the USA rely on the safeguards in those agreements (the EU–US Data Privacy Framework or the EU Standard Contractual Clauses).
When you follow a booking link
A third party is involved only when you choose to follow a booking link. The link passes first through doalu.com, then through the CJ Affiliate network (CJ), to Booking.com's search for that place:
- CJ records the click and gives it an identifier, so that a booking you make can be credited to Doalu. To do that it may set a cookie or a similar identifier on its own domain.
- With the click, we pass the address of the page the link is on, plus the area for an area link (for example /se/stockholm-county/stockholm or …/stockholm/area/gamla-stan). It identifies a page, not you.
- Booking.com then applies its own cookies and privacy statement to your visit and to any booking you make.
CJ and Booking.com process this data as independent controllers; we do not receive the click identifier, and they do not give us your name, contact details or payment details. We see which of our pages led to bookings and the commission due. Their own policies apply: CJ privacy policy and Booking.com privacy statement. Our affiliate disclosure explains the commercial relationship.
If you email us
If you write to us, we use your address and message only to reply, on the basis of our legitimate interest (Article 6(1)(f)), and delete them when the matter is closed.
Your rights
Under the GDPR you may ask for access to personal data we hold about you, and for its rectification, erasure or restriction. You have the right to object at any time to processing based on our legitimate interest (Article 21). Because the site holds no personal data about visitors, the honest answer to an access request will usually be that we hold nothing — we would still rather you asked than assumed. Write to [email protected] and we will respond within one month.
Complaints
If you believe we have handled your data improperly, you may complain to the Swedish supervisory authority, Integritetsskyddsmyndigheten (IMY), Box 8114, 104 20 Stockholm, [email protected] — or to the supervisory authority in your own country of residence.
Changes
If this policy changes materially, we update this page and the date below.
Updated 19 October 2026