1. What we collect
What you type in
- Passenger details — given name, surname and gender for each traveller. Gender is collected only because a booking confirmation carries a title (MR / MS), and for no other purpose.
- Contact details — your email address, and a phone number if you choose to give one.
- Your itinerary — departure and destination airports, travel date, number of travellers, and whether you took the flexible-dates option.
- Your answers in the booking flow — including what you need the reservation for. We use these to understand who buys and where people give up, so we can make the process shorter.
We do not ask for your passport number, date of birth, nationality or address, and you should not send them to us.
What your browser sends
- Browser and device type (user-agent), screen size, language and time zone.
- The country your connection appears to be in. We do not collect precise location.
- The page you arrived from, and which pages and steps you moved through.
- Advertising and referral identifiers in the link you clicked — such as
a Google Ads click ID (
gclid), campaign tags, or therefcode of the site that sent you. These tell us which advert or partner produced an order. Without them we would be spending advertising money blind and unable to pay the partners who earned it.
What is created by your order
An order reference, the amount and currency, a payment identifier from Stripe, the reservation document itself, and the timestamps of payment, generation and delivery.
2. Why we are allowed to use it
| Data | Purpose | Basis |
|---|---|---|
| Passenger and contact details, itinerary | Producing and emailing your document; answering your messages | Performance of our contract with you |
| Payment records | Taking payment, issuing refunds, preventing fraud, keeping accounting records | Contract, and our legal obligations |
| Funnel steps, answers and technical data | Seeing where the process fails and fixing it | Our legitimate interest in a working product |
| Advertising and referral identifiers | Measuring which adverts produce orders, and paying partners for the orders they refer | Our legitimate interest in not wasting advertising spend and in paying partners correctly |
Where we rely on legitimate interests, we have weighed them against your privacy. The data involved is limited, is not used to build a profile of you, is not sold, and is not used to target you elsewhere on the internet.
We do not use your data to make any decision about you by automated means alone, and we do not send marketing email. The emails you receive from us are about the order you placed.
If you apply to the affiliate programme
We keep your name, email, site and what you told us about your audience, so we can assess the application and run the account. If you are approved we also keep your payout method and handle, and the record of what we have paid you, which tax law requires us to keep. Applying does not put you on any marketing list.
3. Card details
We never receive your card number. Card details are entered into a payment form hosted by Stripe and go straight to Stripe. We only ever see the result — whether it succeeded, the amount, and a reference. Stripe is certified to PCI DSS Level 1.
4. Who else processes it
We use a small number of established providers. Each processes data only to provide its service to us.
| Provider | What it does | Where |
|---|---|---|
| Stripe | Takes payment and processes refunds | USA / EU |
| Supabase | The database holding orders and funnel data | USA |
| Hostinger | Hosts this website and our automation server | EU |
| Sends your email (Gmail); measures advertising results (Google Ads) | USA / EU | |
| Apify | Looks up live airline schedules for your route | EU |
Your passenger names and email are shared only where they are needed — to take payment and to deliver your document. The schedule lookup receives a route and a date, never your name or email.
Some of these providers are in the United States, so your data may be transferred outside the UK and EEA. Those transfers rely on the providers' standard contractual clauses and, where applicable, their certification under the EU–US Data Privacy Framework.
We will also disclose data where the law requires it, or to establish or defend a legal claim. We do not sell personal data, and we never have.
5. Cookies and browser storage
This site sets no cookies of its own, and no advertising or analytics cookies. There is no Google Analytics, no Meta pixel and no session recording on this site.
We use your browser's sessionStorage to remember your progress through the booking steps and which advert brought you here. It is deleted when you close the tab, it never leaves your device except as described above, and the booking flow cannot work without it.
One thing outlives the tab. If you arrived from a partner site through a referral link, that partner's referral code — and nothing else — is kept in your browser's localStorage for 90 days, so that a partner who recommended us is still credited if you come back and buy a week later. It holds no name, no email and nothing about you: just a short code identifying the site that sent you, plus the date. You can clear it at any time by clearing site data for this domain, and doing so costs you nothing.
On the payment step, Stripe sets its own cookies to detect fraud. That is part of taking a card payment safely. Stripe's own privacy policy governs them.
6. How long we keep it
- Orders, including passenger names and your document — kept while we may still need to resend or refund, and then as long as tax and accounting law requires us to keep the transaction record. In practice this means several years for the financial record.
- Enquiries that did not become an order — deleted within 24 months.
- Funnel and advertising data — kept for analysis and then deleted. It is not linked to a name or an email unless you completed an order.
You can ask us to delete your details sooner — see below.
7. Your rights
Depending on where you live, you have some or all of these rights: to see the data we hold about you, to have it corrected, to have it deleted, to restrict or object to how we use it, to receive it in a portable format, and to withdraw consent where we relied on it.
If you are in California, you also have the right to know what we collect and to ask us to delete it, and the right not to be discriminated against for asking. We do not sell or share personal information as those terms are defined by the CCPA.
To exercise any of these, use the contact form or reply to any email we have sent you. We will respond within 30 days. There is no charge, and we will not make it difficult — if you ask us to delete your details, we will, keeping only the financial record the law requires.
If you are unhappy with how we have handled your data, you can complain to your national data protection authority. In the UK that is the Information Commissioner's Office (ico.org.uk).
8. Security
Everything is transmitted over HTTPS. Our database is not publicly reachable and enforces row-level access control; access to it is limited to the systems that need it. Card data never touches our servers.
No system is perfect. If we ever discover a breach affecting your data, we will tell you and the relevant regulator as the law requires.
9. Changes
If we change this policy we will update the date at the top of the page. Material changes will be described here rather than slipped in quietly.