BookingBridge is a product of Second Step, a marketing firm based in Dehradun, Uttarakhand, India. Second Step is the data controller for everything described here. Questions, corrections and deletion requests go to shiv@getsecondstep.com.

Two situations. Reading the site, and asking for an audit.

1. 3.1If you only read. We collect nothing. No analytics script runs, no advertising pixel fires, no cookie is set by us. Our web host records ordinary server logs, including IP address and browser type, as every web server does; those are retained for a short period for security and are not used to build a profile of you.
2. 3.2If you request the audit. The form asks for four things: your name, your work email address, your company website, and a range describing your monthly Google Ads spend. That is the entire set. There are no hidden fields.
3. 3.3What travels with the submission. Alongside those four answers we record the page you submitted from, the referring page if your browser sent one, and your browser's user-agent string. This exists so we can tell a genuine request from automated form spam.
4. 3.4A copy stays in your own browser. Your submission is also written to your browser's local storage under the key bb_leak_requests, so nothing you typed is lost if the network fails. That copy lives on your device, not ours, and clearing your browser data removes it.

The free attribution audit is performed against your public website. We load the pages a visitor could load, and we look at which tags are present and where your booking checkout sends people. That is information anyone with a browser can see.

We do not access your Google Ads account, your analytics property, or your property management system. If you later decide you want the full reconciliation, that requires you to grant access deliberately and separately, under its own agreement. Nothing on this page grants it.

1. 5.1Submissions are transmitted over HTTPS to the BookingBridge application at api.bookingbridge.getsecondstep.com and stored in its database. The application is hosted on Railway, whose servers for this deployment are in the United States.
2. 5.2Access is limited to Second Step personnel working on your audit. The endpoint that lists stored leads is authenticated; it is not public.
3. 5.3We use no third-party advertising, analytics, remarketing, or data-broker service on this site. Your details are not sold, rented, or shared for anyone else's marketing.
4. 5.4This page and the rest of the site load a typeface from Google Fonts. That request tells Google your IP address and browser, as any request to any server does. It is the only third party this site contacts. If you would rather it did not, a content blocker will stop it and the site will still work in a system typeface.

Audit requests are kept for as long as it takes to prepare and deliver your file, and afterwards for up to 24 months so that we can answer questions about work already done and so we do not audit the same site twice by accident. After that they are deleted. If you ask us to delete sooner, we delete sooner.

Email shiv@getsecondstep.com and we will act within 30 days. You do not need to cite a regulation, and you do not need to explain why.

1. 7.1A copy of everything we hold about you.
2. 7.2Correction of anything wrong.
3. 7.3Deletion of the record entirely.
4. 7.4An end to any further contact from us, which we will honour without argument.

Depending on where you live these may be legal entitlements rather than courtesies, including under the UK and EU GDPR, the California Consumer Privacy Act, and India's Digital Personal Data Protection Act. Where they are, we treat them as such. Where they are not, we behave the same way anyway.

One thing worth stating plainly: we do not sell personal information, and we never have. There is nothing for you to opt out of on that front.

This is a business tool for people who manage rental properties. It is not directed at anyone under 18 and we do not knowingly collect anything from them.

If this notice changes, the effective date in the letterhead changes with it. If a change materially affects people whose details we already hold, we will email them rather than quietly amend the page.