There is no single deadline for travel booking data. Based on public policy statements reviewed as of September 22, 2026, Expedia, Booking.com, and Airbnb all use purpose-based retention, which means data is kept for as long as it is needed for service, legal, fraud, dispute, tax, or backup reasons.
If you want the short answer, here it is:
- Expedia, Booking.com, and Airbnb do not publish one fixed retention period for all booking data
- Most booking, account, and payment records have no public end date
- Expedia is the only one in this review with clear examples for some records
- Call recordings: up to 90 days
- Chat transcripts: up to 90 days
- SMS logs and linked phone numbers: 12 months after the travel date
- Airbnb also gives some narrow examples for certain record types
- Government ID images: often 3 years in many regions
- Some insurance-program records: up to 4 years
- Deleting an account is not the same as deleting every stored record
- A booking can disappear from your profile but still remain in restricted systems or backups , which can be vulnerable during a data breach
About 2 out of 3 platforms in this review give no broad fixed timeline at all for booking history. And even where a time limit appears, it usually applies to one narrow data type, not the full reservation file.
If I were reducing the article to one plain-English takeaway, it would be this: travel platforms often keep different pieces of your data for different lengths of time, and public policies rarely tell you the exact end date for all of it.
Quick comparison
Travel Booking Data Retention: Expedia vs Booking.com vs Airbnb
| Platform | Main retention approach | Public fixed periods mentioned? | Main reasons data may stay longer |
|---|---|---|---|
| Expedia | Kept while needed for stated purposes | Yes – some calls, chats, and SMS records | Legal duties, disputes, investigations, backup copies |
| Booking.com | Kept while needed for services and recordkeeping | No broad fixed period disclosed | Tax, accounting, fraud, claims, safety, legal duties |
| Airbnb | Kept while needed for processing and account relationship | Yes, for some narrow record types | Legal, tax, audit, anti-money-laundering, claims, statutes of limitations |
Bottom line: if you plan to ask for deletion or access, I’d treat booking history, account data, payment records, support messages, and phone-number records as separate things, because each may follow a different rule.
sbb-itb-5a89343
What Expedia, Booking.com, and Airbnb say about data retention
None of these three platforms gives a set deletion date across the board. Instead, each says it keeps data for as long as it’s needed for a stated purpose, a legal duty, or a dispute. The wording changes from company to company, but the basic idea is the same.
Here’s the side-by-side view:
| Platform | Stated retention approach | Retention factors | Fixed duration disclosed? |
|---|---|---|---|
| Expedia | Retain while needed for stated purposes; longer when law requires. | Service relationship, legal duty, disputes, investigations, backups | No fixed period disclosed. Examples: 90 days for certain call/chat records; 12 months after travel for specific text records |
| Booking.com | Retain while needed to provide services or meet recordkeeping duties. | Tax, accounting, insurance, safety, fraud, disputes, legal obligations | No fixed period disclosed |
| Airbnb | Retain as long as needed for processing, subject to law. | Active account, legal/tax/audit duties, anti-money-laundering, claims, statutes of limitations | No fixed period disclosed. Examples: three years for government-ID images in many regions; up to four years for certain insurance-program records |
Expedia: Purpose-based retention with legal, dispute, and backup exceptions
Expedia links retention to relevance. It says data stays on file for as long as it’s needed for the stated purposes, unless a longer period is required or allowed by law. In practice, that can depend on how long the customer relationship lasts, whether an account is still open within Expedia Group, and whether there have been recent bookings or transactions.
So what stretches that timeline? A few things can. Legal duties, contract duties, active litigation holds, statutes of limitations, and regulatory investigations may all support keeping records longer. Expedia also says it may deidentify, aggregate, or anonymize data when it wants to use it for longer-term analytics or trend analysis. That matters because it’s different from keeping personal records tied to a named user forever.
Booking.com and Airbnb: Similar criteria-based models
Booking.com takes a similar route. It says data is kept for as long as it’s needed to provide services or meet legal and recordkeeping duties. Tax, accounting, insurance administration, safety, fraud prevention, disputes, and claims can each be enough on their own to keep a booking record in place.
Airbnb works in much the same way, but it adds one clear reference point: the active account relationship. Even after a stay ends, Airbnb may keep information for as long as it has a legitimate need to run its business, handle disputes, or defend claims. It also ties retention to anti-money-laundering rules and statutes of limitations, which can push retention much farther than many travelers would guess after checkout. Some data types come with stated time limits, but many do not.
The next section separates published timeframes from policies that leave retention open-ended.
Retention periods users can actually identify
Set those broad retention rules aside, and a clear pattern shows up: only a small number of record types come with published time limits. Most of the policies reviewed don’t give a set calendar deadline. Instead, they explain retention based on purpose, legal duties, or other conditions.
Published examples with stated durations
Expedia’s privacy policy names three communication-related record types with exact time windows:
- Call recordings: kept for no longer than 90 days from the interaction date
- Chat transcripts: kept for no longer than 90 days from the interaction date
- SMS logs and linked phone numbers: kept for 12 months after the travel date tied to the booking
That timing detail matters. The 90-day period starts on the date of the call or chat itself, not the booking date, departure date, or account-deletion date. These are the only cases where Expedia’s policy gives a specific number. Everything else uses purpose-based language.
Records with no fixed period disclosed
These are the only public timeframes found in the reviewed policies.
| Data category | Explicit period if published | Reason a longer period may apply |
|---|---|---|
| Call recordings (Expedia) | 90 days from interaction date | Law, regulation, or ongoing legal proceeding |
| Chat transcripts (Expedia) | 90 days from interaction date | Law, regulation, or ongoing legal proceeding |
| SMS logs and linked phone numbers (Expedia) | 12 months after travel date tied to the booking | Law, regulation, or ongoing legal proceeding |
| Booking details and reservation history | – | Tax, accounting, disputes, investigations, safety, or legal holds |
| Account information and identifiers | – | Legal, regulatory, fraud-prevention, or claim-related needs |
| Payment and accounting records | – | Regulatory requirements or unresolved disputes |
| Fraud-prevention, legal-hold, and backup records | – | Active investigation, legal obligations, safety concerns, or technical deletion schedules |
No fixed period disclosed for the final four categories.
These are the clearest fixed windows. The next section explains why booking records often stay on file after travel ends.
Why booking history may stay on file after a trip ends
Checking out of a property doesn’t mean the record disappears. In many cases, booking data stays on file for operational, legal, or security reasons.
Operational and legal reasons platforms keep records longer
One big reason is simple: the account relationship may still be active. Airbnb says retention can depend on the ongoing relationship with a guest or host. So even after a stay is over, an older booking may still matter if the account remains open or if there are later bookings, refunds, or disputes tied to it.
Platforms may also need those records for receipts, refunds, and chargebacks. Say a traveler contacts support months later about a disputed charge. The platform may need the original reservation details to look into it. Booking.com says it may keep booking identifiers for tax, accounting, and recordkeeping duties. In the U.S., tax records tied to a return are generally kept for three years. Those same records can also help with fraud checks and disputes.
Fraud, disputes, investigations, and backups
Fraud and safety reviews can keep data around longer. Booking.com says data may be retained to detect and prevent fraud and other illegal activities, often by using temporary phone numbers for privacy. Airbnb also cites individual safety, money-laundering prevention, and fraud prevention as reasons to retain personal information. That can include payment references and account identifiers that still matter long after the trip ends.
Disputes can stretch retention even more. If a traveler files a complaint, a host or property makes a damage claim, or a chargeback is still unresolved, the platform may need booking records, messages, and payment proof until the issue is settled. Expedia specifically lists litigation holds and statutes of limitations among its retention criteria. In plain English, deletion may be delayed if a dispute is pending or even just expected.
Backups are another piece of the puzzle. Expedia says residual copies may remain in backup systems to protect against data loss, and those backups follow their own expiration or overwrite cycle apart from the live database. That’s why a deletion request may first affect what you can see before it removes every copy.
How to handle deletion requests and what your phone number has to do with it
A practical checklist for deletion and access requests
Retention depends on why a company keeps the data. So if you want something deleted, your request needs to be specific.
Before you send anything, check the platform’s current privacy policy, privacy center, and account-deletion instructions. Rules and request paths can change by region. Something that was true six months ago may not be true now.
The first thing to do is save your records. Download booking confirmations, receipts, cancellation records, invoices, loyalty details, and any tax documents. If the account gets closed, you may lose access to all of that.
When you submit the request, say exactly what you want. Keep account deletion, booking-history removal, access requests, and erasure requests separate. Include your account email address, username, reservation numbers, and rough travel dates. Then ask what will be deleted, anonymized, restricted, or kept, and why. If deletion is delayed, ask for the reason and the timeline in writing.
| Request type | What it generally means | Key question to ask |
|---|---|---|
| Account deletion | Close or deactivate the user profile | Will login credentials, profile data, and saved preferences be deleted? |
| Booking-history removal | Remove visible booking history or delete records where permitted | Will the booking disappear only from the dashboard, or also from backend systems? |
| Data-access request | Obtain a copy or description of stored personal data | Which systems, communications, payment records, and identifiers are included? |
| Retained records | Data kept after deletion or restriction | What data is retained, why is it needed, who can access it, and when will it be deleted or anonymized? |
The same purpose-based rules still apply after a deletion request. Retention still varies by platform and region. Booking.com directs users to its Data Subject Request form for access or erasure. Airbnb provides region-specific privacy contacts, including email, mail, and a US toll-free number. Expedia points users to account access and its contact process for privacy requests.
Phone numbers in booking records and where MobileSMS.io fits
One detail deserves extra attention: the phone number linked to the booking or account.
A phone number can end up in account, reservation, and communication records when it’s used for account setup, login checks, booking alerts, itinerary changes, or customer support. Once that happens, retention may follow the platform’s general rules instead of the end date of one trip.
One Expedia-related policy example makes this pretty clear: mobile phone numbers and SMS message logs may be kept for 12 months after the associated travel date for customer-service purposes. That’s a policy tied to a specific type of communication. It should not be treated as a blanket rule for all Expedia services or other travel platforms. Still, it shows how a phone number can stay in platform records after the trip is over.
If you want to limit exposure of your personal number during SMS verification, MobileSMS.io offers real SIM-based numbers for SMS verification where permitted.
Here’s the line to keep in mind: using a separate verification number can help keep your personal phone number out of a platform’s records going forward. It does not affect how a travel platform stores booking history, identity details, payment data, or support messages. And if a number tied to your account expires or gets reassigned, you could lose access to account recovery, refunds, or later support. It’s smart to keep a record of which number is tied to which account.
Methodology and key takeaways
This review uses current first-party privacy policies and help-center notices from Expedia, Booking.com, and Airbnb. It looks at current first-party policies for retention terms, durations, and exceptions. Because privacy notices and regional terms can change, you should recheck the policy that applies to you before sending any request.
A few patterns show up again and again:
- Criteria-based language is the norm. Published policies usually explain when data may be kept – such as for legal compliance, dispute resolution, fraud prevention, or backups – instead of giving one fixed number of days for all booking data.
- Explicit durations are rare. When a policy does give a time period, it often applies to a narrow data type, like communication records, not every part of a booking.
- Visibility is not the same as deletion. A booking that disappears from your dashboard may still exist in backend systems, legal or compliance files, or backup copies.
- Policies can change. Wording, regional terms, and help-center steps are updated from time to time. Check again before you act.
Conclusion: What users can reasonably take from published retention policies
The published policies all point in the same direction: Expedia, Booking.com, and Airbnb do not set one universal deletion deadline for every piece of booking data. Instead, they keep data based on specific criteria tied to legal duties, internal business use, and safety issues. The main thing that changes the timeline is the type of record.
When a platform does give a set time period, that window usually covers only one narrow group of records, not the entire booking file.
That’s why visible deletion can give the wrong impression. A booking may vanish from your dashboard, while related records still sit in restricted systems or backup storage.
Before you request deletion, check the current privacy policy for your region. These rules can change based on jurisdiction and data type. For any request, check the current regional policy first.
FAQs
Can I force a travel platform to delete all my booking data?
You can ask for your booking data to be deleted. Whether a platform has to honor that request depends on the privacy law that applies to you, such as the CCPA in the U.S. or the GDPR in Europe.
That said, a deletion request doesn’t always mean everything disappears. Platforms may still keep some records for tax, legal, or day-to-day compliance reasons.
If you want to share less personal data from the start, MobileSMS.io can help keep your personal phone number out of travel databases.
Why is my booking data still stored after I delete my account?
Even after you delete your account, travel platforms often keep some data. That usually happens because they still have to meet legal, tax, and day-to-day business requirements.
For example, a company may need to hold onto billing records and transaction histories for audits.
It may also keep anonymized operational logs for a limited period. Those logs help the platform keep systems running smoothly and fix technical problems when they come up.
What records should I request before closing my travel account?
Before you close your travel account, ask for a full record of the data the platform has on you. Many sites offer this through a page such as Get My Info.
It’s also smart to save your confirmation numbers and booking details in a secure place. Once the account is closed, you may lose access to them.