Privacy Policy

When you search without an account, we receive the search details you enter (origin, destination, dates, cabin class and number of passengers) along with standard technical data such as your IP address, browser type and device information.

When you create an account, we collect your email address and, if you sign in with Google, Apple, Facebook or Microsoft, the basic profile details that provider shares with us (typically your name, email address and profile photo). We never see the password for your social account.

Information you add to your account, which may include:

• an optional profile photo;
• loyalty programme details such as membership numbers, tier, Avios or miles balances, tier points and companion voucher status and expiry dates — all of which you enter yourself;
• saved searches, wishlisted flights, tracked flights and pinned locations.

If you take out a paid plan, we also keep your plan, billing status and renewal date, plus the card brand and last four digits that our payment processor, Stripe, returns. We do not ask for or store your airline account passwords, passport details or full payment card details. Bookings are made directly with the airline, not through us.

• to run flight searches and show fares, Avios estimates and companion voucher savings;
• to price and personalise results using the loyalty programme numbers you have saved, where an airline supports this;
• to save your searches, wishlist and preferences so they are available whenever you sign in;
• to email you alerts about flights you have chosen to track;
• to keep the service secure, prevent abuse and fix problems;
• with your consent, to understand how the site is used through analytics so we can improve it.

Where UK or EU data-protection law applies, we rely on the following legal bases:

• Contract — to provide the account features and flight alerts you sign up for.
• Legitimate interests — to operate, secure and improve the service, provided those interests are not overridden by your rights.
• Consent — for non-essential cookies and analytics. You can withdraw consent at any time using Cookie Settings in the footer.
• Legal obligation — where we must keep or disclose data to comply with the law.

We do not sell your personal data. We share it only with service providers that help us run the site:

• Google Firebase and Google Cloud — sign-in, database storage and hosting of our API.
• Vercel — hosting of this website.
• Duffel — our flight data provider. It receives your search details and, when you have saved them, your loyalty programme numbers so airlines can return member pricing.
• Stripe — processing subscription payments. Stripe collects your card details directly in a secure form on our site and handles them under its own privacy policy.
• Resend — delivery of tracked-flight alert emails.
• HubSpot — receiving and managing messages you send through our contact form.
• Elasticsearch hosting (Bonsai) — airport and flight search indexes. These hold flight and airport data, not your account details.
• Google Analytics and Google Tag Manager — usage analytics, only with your consent.
• Cookiebot (Usercentrics) — recording and managing your cookie choices.
• Sign-in providers — Google, Apple, Facebook or Microsoft, if you choose to sign in with them.

When you follow a link to book with an airline, you leave our site and the airline's own privacy policy applies. We may also disclose data if required by law or to protect our rights, users or the public.

Some of our providers process data outside the UK and European Economic Area, including in the United States. Where they do, we rely on adequacy decisions or standard contractual clauses (and the UK addendum) to make sure your data stays protected.

We keep your account data for as long as your account is open. If you ask us to delete your account, we delete your profile, loyalty details, saved searches, wishlist and tracked flights within 30 days, except where we must keep something to meet a legal obligation. Server logs are kept for a limited period for security and troubleshooting. Analytics data is retained according to our Google Analytics settings.

Depending on where you live, you may have the right to:

• access the personal data we hold about you;
• correct inaccurate data — most of it you can edit directly on your account page;
• delete your data or account;
• restrict or object to certain processing;
• receive a copy of your data in a portable format;
• withdraw consent at any time, without affecting processing that happened before.

To exercise any of these rights, email support@loyaltyflights.com. You can remove individual loyalty accounts, saved searches, wishlist items and tracked flights yourself at any time. If you are unhappy with how we handle your data, you can complain to your local data-protection authority — in the UK, that is the Information Commissioner's Office (ico.org.uk).

Data is encrypted in transit and stored with our cloud providers, who encrypt it at rest. Access to your account data requires you to be signed in, and only our backend can read or write it. No system is completely secure, so please use a strong, unique password and let us know if you suspect any unauthorised access to your account.

Loyalty Flights is not intended for anyone under 16, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

We may update this policy from time to time. We will change the “last updated” date above and, for significant changes, let signed-in users know by email or on the site.

Questions about this policy or your personal data? Email support@loyaltyflights.com.

We use strictly necessary cookies and similar storage to keep you signed in and remember your preferences. With your consent, we also use analytics cookies. You can change your choices at any time using Cookie Settings in the footer. The full list of cookies we use is below.