Privacy Policy

What you give us

• Account: Your name, email address and password (stored only as a one-way hash, never in plain text). If you sign in with Google, we receive your name, email address and profile photo from Google, and keep your name and email address.
• Profile: An optional phone number, and the country and language settings of your account.
• Saved travellers: For you and people you choose to save with their permission — names as on the passport, title, date of birth, gender as on the travel document, nationality, passport number, expiry and issuing country, and optionally their own email and phone, Known Traveler and redress numbers, frequent-flyer numbers, and seat and meal preferences. A meal preference can reveal religious beliefs or health information: it is optional, shown only to you, and not currently sent to airlines.
• Chats with Fai: The messages you send Fai, our AI travel assistant, and its replies.
• Voice input: If you use the microphone button in the chat or the trip planner, we receive only the text your browser makes from your voice, as if you had typed it.
• Searches: What you search for on the Site, linked to your account if you are signed in.
• Booking data: If you book through checkout, your travel dates, flights and booking history; passenger details, including passport and ID details when the route requires them; the booking contact's email and phone; and where you live (your country and, in the US, your state), which we ask to check that we can sell to you.
• Payment information: Processed securely by Razorpay if your account region is India, or by Stripe for all other accounts. When you pay through Stripe, you enter your billing address on Stripe's payment page; Stripe uses it to verify the payment and to calculate any sales tax. We do not keep your card numbers, bank account details, UPI IDs or billing address in our booking systems. Stripe holds your billing address, and the tax reports Stripe provides to us, which include the address used to calculate tax, are kept with our tax records. When Stripe confirms a payment, we also check the state in the billing address, only to confirm we can sell to you. We don't store the address from this check, only whether it let the payment through; the tax areas Stripe reports, which can include your state, are kept with your booking records.
• Messages: What you send us, including support messages and privacy requests.

What we collect automatically

• Technical data: With every request to the Site, your IP address, browser and device type, the page and the time, which we use to deliver the Site, keep it secure, limit abuse and fix faults, and work out which country you're in, to know whether to ask before analytics run (section 4).
• Server monitoring: When your browser asks our servers for a page, they send JustAnalytics the path of that page request (the part of its address after fairtravels.ai, up to any "?", which can include a booking or other record number), the request method, the host name your browser asked for, your browser's user-agent string, the response status and timing, the addresses our servers call while handling the request, and details of any server error (its message and technical trace, sent as they are), which can quote a page address or other parts of the request. Requests whose address carries query details, such as a search term or a sign-in link's token, are not sent, though a server error's details can still quote such an address. A request whose only query is a technical one the Site adds as you move between pages is sent without that query. Your IP address is not sent, and nothing is stored on your device.
• Browser error reports: If a page fails, your browser sends our servers the error and the page address without any query string. We remove email addresses, IDs and long numbers from them where we can, and nothing is stored on your device.
• Browser analytics (JustAnalytics): The pages you visit (their full address, including anything after "?", and their title) and how long you spend on them, the page that referred you and any campaign tags in the link, page speed, errors in your browser, signs that clicks aren't working (the clicked element's technical description and where on the screen you clicked), and your browser type, language, time zone and screen size. JustAnalytics collects these with a random identifier stored in your browser and an identifier calculated from your browser and device characteristics, and receives your IP address. Section 4 says when browser analytics run.
• Browser analytics (Google Analytics): Google Analytics, an analytics service run by Google, also collects browser analytics on the Site. It records the full address of each page you visit (including anything after "?", apart from the values it removes, below) and its title, how long you spend on it, the page that referred you and any campaign tags in the link, and your browser, device, operating system, language and screen size. It also records when you scroll to the bottom of a page, click a link to another site, search the Site, watch an embedded YouTube video or download a file, and these actions, with these details as well as the page details above:
  • Starting a trip plan: where on the Site you started it, how you entered your request (for example, typed or spoken) and, if you started from a link that already names them, the destination and number of days.
  • Searching for flights: the city or airport code your search was matched to (or that it couldn't be matched), never the words you typed; whether the trip is one-way or return; the number of travellers; whether you searched with the form or in your own words; how many results were shown; and whether booking was open.
  • Booking, where checkout is offered: choosing a flight, adding it to your booking, starting checkout, going on to payment and completing the booking, with the route, flight, price per traveller, number of adult travellers, total value, currency, payment type and your booking reference, and whether you picked the flight from search results or a chat.
  • Creating an account or signing in: only the method you used, such as email or Google.
  • Using a share button: which network and which post you shared.
  • Clicking a contact email link: only the type of contact, such as support.

  We do not send Google Analytics the text of your chats with Fai, or the names, email addresses, phone numbers or passport details of you or the travellers you add. It is set up to remove email addresses, and the values of the token, callbackUrl and session_id parts of a page address, before anything is sent. Google Analytics collects these with a random identifier stored in a cookie in your browser. As with any site your browser contacts, Google receives your IP address. Google says Google Analytics uses it to work out your approximate location, down to your city, and to protect its service, and then discards it. Section 4 says when Google Analytics runs, and the pages where it never does.

What we receive from others

Booking status, ticket numbers and schedule changes from airlines and our booking partner, Duffel; confirmation of your payment, the tax charged, the tax areas it applies to and the state in your billing address from Stripe; and your name and email address from Google, if you sign in with it.

Our accounts on social platforms

We run our own fairtravels.ai accounts on X, Facebook, Instagram, Threads, Pinterest and LinkedIn, and publish to them through each platform's API (the connection a platform offers apps). We use these connections only to publish our own posts. When we publish, the platform sends back details of the post, such as its ID, its web address and whether it was published. We do not use these connections to collect our followers' personal information.

The platforms also show us statistics about our accounts and posts, such as how many people saw or interacted with a post, in summary form. For our Facebook Page, Meta provides these statistics under its Page Insights Controller Addendum (https://www.facebook.com/legal/terms/page_controller_addendum), and for our LinkedIn page, LinkedIn provides them under its Page Insights Joint Controller Addendum (https://www.linkedin.com/legal/l/page-joint-controller-addendum). Under these, Meta and LinkedIn take responsibility for meeting the GDPR's obligations for these statistics, including answering people's requests about them. What you do on a platform, such as following, messaging or commenting on our accounts, is covered by that platform's own privacy policy. To ask us to delete personal information, see "How to delete your data" in section 7.

Everyone

• See and change your details in Profile. You can edit or remove any saved traveller, and any of their saved documents, at any time in Profile > Travellers.
• Delete your account in Profile.
• Ask us for a copy of your personal information, or ask us to correct or delete it.
• Turn browser analytics off at any time with Cookie settings, at the bottom of every page (section 4).
• We send service emails only, such as sign-in, booking and receipt emails. We don't send marketing emails.

To make a request, email privacy@fairtravels.ai or use our privacy request form, where we confirm it comes from you with a code we email you. We check that a request comes from you before we act on it, except an opt-out of sale or sharing sent by email, for which we don't ask you to prove who you are. We reply within 30 days. Someone you authorize can make a request for you, with proof that you authorized them. We won't treat you differently for using your privacy rights.

How to delete your data

You can delete your account in Profile. To ask us to delete your personal information, use our privacy request form at fairtravels.ai/privacy-request, or email privacy@fairtravels.ai. The form emails you a one-time code to confirm the request comes from you. Once we have confirmed a request, we delete the personal information we can find about you, except what section 6 says we keep, such as booking records.

Google Analytics data is tied to a random identifier in your browser, not to your account or email address. We can find it only if you send us that identifier, which is in the _ga cookie, or, for some bookings completed where checkout is offered, through the booking reference. JustAnalytics browser analytics data is tied to a random identifier stored in your browser, not to your account or email address, so we can find it only if you send us that identifier, which is kept as ja_visitor_id in your browser's local storage. Turning analytics off, or clearing your cookies and site data, removes both identifiers from your browser, so send them to us first if you want us to find that data. Deleting data from Google Analytics doesn't change totals in its standard reports, such as how many people visited a page.

The same route covers any request about our accounts on social platforms (section 1).

People in the EU and UK

You have the right to access, rectify and erase your personal information, to restrict or object to how we use it (including where we rely on legitimate interests), and to data portability. Where we rely on your consent, you can withdraw it at any time. You can complain to your data protection supervisory authority; in the UK, that is the Information Commissioner's Office (ICO), ico.org.uk. We reply within one month.

We rely on your consent for browser analytics: in the UK, Switzerland and the EEA, they run only if you accept them in our cookie banner, and you can withdraw your consent at any time with Cookie settings, at the bottom of every page (section 4). The rights above and the legal bases in section 2 also apply to people in Switzerland, Iceland, Liechtenstein and Norway. In Switzerland, your supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC), edoeb.admin.ch.

Your California Privacy Rights

• If you live in California, you can ask to know what personal information we collect, use and disclose, and ask us to delete or correct it.
• We do not sell personal information or share it for cross-context behavioral advertising (as the CCPA defines "sell" and "share"), and we have not done so in the past 12 months. We do not knowingly sell or share the personal information of consumers under 16. See Do Not Sell or Share My Personal Information.
• Passport and ID numbers are sensitive personal information. We use them only to provide the bookings you ask for, and we do not sell them or share them for advertising.
• We use sensitive personal information only to provide the services you ask for, so there is no separate choice to limit its use.
• Shine the Light: we do not disclose personal information to third parties for their own direct marketing purposes.

Notice at collection

The categories of personal information we collect, where each comes from, why we collect it, who we disclose it to and how long we keep it:

We do not collect precise geolocation, and we do not sell or share any category of personal information. Our hosting and background-task services (Railway and Inngest) handle all of these for us. The location in the Geolocation data row is approximate, worked out from your IP address.

Other US states

If you live in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Florida or another US state with a consumer privacy law, you can ask to access, correct or delete your personal information, get a copy of it, and opt out of targeted advertising, the sale of personal information and profiling (we do none of these). If we decline your request, you can appeal by replying to our decision; we answer an appeal within 45 days. If we deny your appeal, you can contact your state attorney general.

Nevada

We do not sell covered information as Nevada law (NRS 603A) defines it. You can still send us an opt-out request at privacy@fairtravels.ai.

India

If you are in India, under the Digital Personal Data Protection Act, 2023, you can ask for a summary of your personal data and how we use it, ask us to correct, complete, update or erase it, and nominate someone to exercise these rights if you die or cannot do so yourself. For a grievance, contact privacy@fairtravels.ai; we respond within 30 days. You may also approach the Data Protection Board of India.