Privacy policy

Last updated 29 September 2026

FlyProof LLC collects only what an airline needs to create your reservation, and what we need to run and improve the service.

What we collect

Traveller details you enter: names as in the passport, date of birth, gender and title. If an airline requires it, identity document details.
Contact details: email and mobile number for the booking.
Order details: route, dates, the flight held, prices, and the booking reference the airline returns.
Payment: handled by Stripe. We never see or store your full card number.
Usage: pages visited within our site, the page you arrived on and the campaign or referring website, and funnel steps (for example, that checkout started). IP addresses are stored only as one-way hashes for rate limiting and fraud prevention.

Why we use it

To create, deliver and support your reservation (performance of our contract with you).
To prevent fraud and abuse (legitimate interest).
To understand which pages and channels help travellers, and to pay partners who referred you (legitimate interest).
Analytics cookies from Google, only if you accept them (consent).

Who processes it

Duffel and the airline: to create the reservation.
Stripe: to take payment and issue refunds.
Railway: hosting and database.
Our email provider: to send confirmations.
Google Analytics: only after you accept analytics cookies.

Some of these providers process data outside your country under their own safeguards.

How long we keep it

Traveller and contact details are deleted or anonymised 180 days after the order, except records we must keep for accounting. Sensitive fields are encrypted at rest. Identity document details, when collected, are removed after the reservation expires.

Cookies

Session: keeps your order together while you book (necessary).
fp_ft, fp_lt: the page you first arrived on and the latest campaign or referring site, kept 90 days, first-party only, so we can tell which pages lead to orders.
fp_ref: set only if you arrive through a partner link, so the partner can be credited, for the referral window shown on our partners page.
ap_locale, ap_access: your Arrival Pulse language and pass.
fp_consent: your analytics choice. Google Analytics cookies are set only after you accept.

Your rights

You can ask for a copy of your data, its correction or deletion, or object to its use, by emailing support@flyproof.live. You can also complain to your data protection authority. The controller is FlyProof LLC, 1120 W Peak Ave, Denver, Colorado, USA.