Privacy for travel

A search (route or destination, dates, traveller counts, cabin or rooms) is sent to our server, which asks Google Flights or Google Hotels through SerpApi and keeps the answer for 15 minutes so that others searching the same thing get it without a new call. Searches are kept for a week with the IP address they came from, for abuse control and so that a request can show what you saw. They are not tied to an account unless you ask for a quote.

A quote request keeps the flight or stay you chose, the traveller counts, your name and the mobile number or email you want the quote at, and a note if you left one. Quotes, approvals and payments are kept with it as part of the order record.

After you approve a flight quote you enter each traveller’s name as on the passport, date of birth, nationality, passport number and expiry; for a stay, the guests’ names and nationality, the rest only if you choose to give it. They are stored encrypted with a key separate from the database, shown back to you masked, and read in clear only by the staff member who makes the booking, each read being logged. They are shared only with the airline or the ticketing supplier to issue the ticket.

They are erased seven days after the trip ends, seven days after a request is cancelled, declined or lapses, and in any case within 180 days. You can ask for them to be erased earlier once the ticket is issued. Backups hold only the encrypted form.

Saved travellers (under Account) are passport details you choose to keep for your next trip: one encrypted record per person, read back only to you when you fill a form, kept until you delete them or close your account. A trip you book keeps its own copy, erased after travel as above.

The e-ticket or voucher PDF is kept on our server for 90 days after the trip ends so you can download it again, then deleted. The booking reference stays with the order.

We send SMS and email about your request, quote, payment and ticket or voucher to the contact details on the request, through the providers named in the NovaCodes policy. The ticket or voucher link opens without signing in: anyone with the link can see it, so keep it to yourself.

We count the steps people take on this site (a search, a pick, a request, a payment) without names, as a hash of the connection for the day, to see where the service works and where it does not. Nothing is sent to an advertising network.

You can see your trips under My trips, cancel a request before paying, and ask us to erase passport details early or to correct a contact detail. Records we must keep for accounting stay for the period the law requires.