Privacy policy

1. Who is responsible?

The operator of Las Vegas Buff is responsible for data processing on this website:
RGE MEDIA LLC
9620 Las Vegas Blvd S, STE E4 #1060
Las Vegas, NV 89123, USA
Email: Show email address

2. What data we process

• Account data: Your email address and the information you provide in your profile (e.g. title for participant colors) when you create an account or sign in with Google or Apple.
• Travel and planning data: Your trips with travel dates, participants, preferences, budget entries and the booking requests you create in the planner. Trips belong to the trip owner; others only see what you share.
• Wishlists: Items you save using the heart icon. If assigned to a trip, they belong to your account; without an account, they remain only in your browser.
• Messages: We store content from the contact form (name, email, optional phone number, subject, message) so we can reply. We answer chat questions without an account: the text is sent to the AI service (Section 4) only to generate the answer, and we do not save it as chat history.
• Usage data: Pages and sections viewed, clicks and other interactions, time, referring page, and browser and device information. Our own statistics record page, ad, and booking clicks with a session ID and, for logged-in visitors, an account ID as well. Our own usage counters are separate from processing by Google Analytics and advertising pixels: These services may also process IP addresses, cookie or device IDs, and event data.
• Browser storage: Display mode (day or night), language, and – if you don’t have an account – your wishlist are stored in your browser and can be deleted there at any time. Analytics and advertising services may also use cookies or similar identifiers; these are not required for your account or trip planning.

3. Purpose and basis of processing

We process your data to provide the agreed features: account and login, planner, wishlists, booking requests, and replies to your messages. Usage counters help us operate the website securely and keep its operation traceable. Google Analytics helps us analyze how our services are used. Facebook and TikTok pixels are used to measure advertising results, attribute interactions to ads, and – where permitted and appropriately authorized – build advertising audiences and optimize advertising. Data is transmitted to the respective platforms in the process; you can find details in the following section.

4. Maps, weather, and third-party providers

Google Maps: On pages with a map, your browser loads map data from Google. Your IP address is transmitted to Google in the process. If you don’t have a Google account, Google’s ability to link this to you is limited; see Google’s privacy policy for details.

Weather data: We retrieve the forecast from the weather service Open-Meteo. Only location coordinates and time are requested – no personal data.

Google Analytics: Google’s analytics service processes usage and event data as well as technical identifiers. Google may receive IP addresses for technical processing; according to Google, these are not logged or stored in GA4. Processing therefore cannot be considered anonymous across the board. Depending on the region, the recipient is Google LLC in the US or Google Ireland Limited. More information: Privacy at Google.

Facebook pixel (Meta Pixel): The pixel transmits page views and configured events, along with technical data such as IP address, browser information, and cookie IDs, to Meta. Meta may link this information to a Facebook or Instagram account and process it for ad measurement, audience building, and personalized advertising. Depending on the region, the recipient is Meta Platforms, Inc. in the US or Meta Platforms Ireland Limited. More information: Privacy at Meta.

TikTok pixel: The pixel transmits page views and configured events, along with technical data such as IP address, browser and device information, and cookie IDs, to TikTok. TikTok may link this data to a user account and process it for ad measurement, audience building, and personalized advertising. The responsible TikTok entity depends on your region and is named in the provider’s privacy notices. More information: Privacy at TikTok.

Consent and opt-out: Where prior consent is required, particularly for nonessential analytics and advertising technologies in the EEA and the United Kingdom, these services may only be used after you have given your consent. Consent is voluntary and can be withdrawn for the future. You can contact us via the Contact form or change your choice here at any time. Open privacy settings

Our own usage statistics only record new events after you consent to the “Analytics” category. Your choice is stored in your browser for up to six months. When a Global Privacy Control signal is detected, the “Advertising” category remains disabled. Google, Meta, and TikTok also offer their own privacy and advertising settings; for Google Analytics, a browser opt-out add-on is available. Deleting cookies alone does not constitute a lasting opt-out from processing.

Processing outside your country of residence: Data may be processed in the US and other countries. Where the GDPR applies, transfers require a valid basis under Art. 44 et seq. of the GDPR, such as an applicable adequacy decision or appropriate safeguards such as standard contractual clauses. You can obtain information about the safeguards actually used for your data via the Contact form.

AI chat assistant: Your question is sent to an OpenAI AI service, integrated through this website’s operating platform (Lovable AI Gateway), and processed there solely to generate a response. We do not create a history or profile from the chat.

5. Retention period

Account, trip, and booking data is retained for as long as your account exists. We delete contact messages once the inquiry has been resolved and no retention obligation remains. We do not store chat questions. Our own statistics contain event data with a session ID and, where applicable, an account ID; this data cannot be considered anonymous across the board. It is retained only for as long as necessary for the respective purpose and legal obligations.

For Google Analytics and advertising pixels, cookie lifetimes and retention periods depend on the settings actually used, the service, and the type of data. Processing by the platforms is also governed by their privacy notices. You can request the specific periods applicable to our services via the Contact form upon request.

6. Your rights under US law

Under the laws of several US states – including the California Consumer Privacy Act (CCPA, as amended by the CPRA) and Nevada’s privacy law (NRS 603A / SB 220) – depending on where you live and to the extent that the respective law applies to the operator, you can:

• request information about the personal data we have stored about you,
• request the correction of inaccurate data,
• request the deletion of your data,
• receive a copy of your data in a commonly used, machine-readable format,
• opt out of the sale of your data, sharing for behavioral advertising, or targeted advertising, where provided for by applicable law,
• exercise these rights without discrimination.

Transmitting identifiers and event data to Meta or TikTok may qualify as “sharing” or a “sale” under certain US privacy laws, even without payment. Where required by law, the relevant opt-outs and recognized signals such as Global Privacy Control (GPC) must be respected. You can submit an opt-out request via the Contact form ; we may require reasonable identity verification to process your request.

The quickest way: Contact us via the Contact form and tell us what you want done with your data. We will confirm your request and process it within the statutory deadlines.

7. Notice for visitors from the EU

If you visit us from the European Union, you also have rights under the General Data Protection Regulation (GDPR): access, rectification, erasure, restriction of processing, data portability, objection, and the right to lodge a complaint with a data protection supervisory authority. Where the GDPR applies, account and planning services are provided on the basis of Art. 6(1)(b) GDPR, necessary operational and security processing on the basis of Art. 6(1)(f) GDPR, and analytics and advertising processing requiring consent on the basis of Art. 6(1)(a) GDPR. Access to your device is also subject to the applicable national regulations. The operator’s location in Nevada does not exclude mandatory rights under other jurisdictions.

8. Security

Only those authorized under the database access rules can access saved trips, wish lists, and messages: you and the people you have granted access to. Administrative access is separate from customer accounts.

9. Changes

We update this policy when features or legal requirements change. Last updated: October 18, 2026