Privacy Policy

1. Introduction

Travel Smarter Ltd ("we," "our," "us") is committed to protecting your privacy and processing your personal data lawfully under UK GDPR and the Data Protection Act 2018.

2. Information We Collect

You Provide

Name, email address, profile details, loyalty-programme and wallet information, travel preferences, saved flights, goals, support or bug report content, and billing details submitted to our payment providers.

Automatically Collected

Device and browser information, IP address, session and security metadata, cookie and browser-storage preferences, consent evidence records, usage events, and analytics data where the relevant consent has been granted.

3. How We Use Your Information

• Create and secure your account and authenticated sessions
• Store and display your profile, wallet, flights, and goals
• Generate personalised recommendations and AI-assisted features
• Process subscription purchases and manage billing
• Provide support, investigate bugs, and operate admin tools
• Monitor reliability, detect abuse, and protect the Service
• Measure product usage and marketing performance where consent is required and granted
• Keep limited records of consent grants and withdrawals for accountability and dispute handling
• Comply with legal, tax, accounting, and regulatory obligations

Lawful bases: performance of a contract for account, subscription, and product features; legitimate interests for service security, fraud prevention, support, and product operations; consent for non-essential analytics, marketing, and similar technologies where required; and legal obligation where we must keep or disclose data.

4. Sharing & Disclosure

We do not sell or rent personal data. We share only with:

• Supabase for authentication and database hosting
• Stripe for billing and subscription payments
• Support and operations tools such as Intercom and Sentry, where enabled
• Analytics and attribution tools such as Google Tag Manager, Google Analytics, Microsoft Clarity, and Endorsely, where enabled and the required consent has been granted
• Email providers used to send transactional or operational messages
• Legal authorities or counterparties where required by law or needed to establish, exercise, or defend legal claims
• Business transfers such as a merger, acquisition, or asset sale

5. Security

We use technical controls designed to reduce risk, including HTTPS, server-managed authentication cookies, access controls, row-level access restrictions on private application data, and monitoring and rate-limiting controls. Our hosting and infrastructure providers may also apply additional security measures such as encryption at rest.

6. Your Rights (UK GDPR)

You may request to access, rectify, erase, restrict, port, or object to processing of your data, or withdraw consent at any time.

Contact privacy@travel-smarter.com to exercise these rights.

If unsatisfied, you may complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

7. Data Retention

We keep personal data for only as long as it is needed for the purpose for which it was collected, including to operate the Service, provide support, maintain security records, and comply with billing, tax, and legal obligations. Some short-lived security data is automatically expired; other records follow internal retention schedules and may be deleted or anonymised when no longer needed. Consent-evidence records are kept for a limited period so we can evidence consent and withdrawal decisions.

8. Children's Privacy

Our Service is not intended for individuals under 18. We do not knowingly collect their data.

9. International Transfers

Some of our service providers may process personal data outside the UK or EEA. Where that happens, we rely on lawful transfer mechanisms such as adequacy regulations, the UK International Data Transfer Addendum, or Standard Contractual Clauses, as appropriate.

10. Updates

We may update this policy and will notify you of material changes via email or in-app notice.

11. Contact