Privacy Policy

1. Who we are

Vocafly is a travel meta-search platform. We do not issue flight tickets directly; we redirect you to providers/partners for final booking.

Data controller: You can reach us via the email listed on our About page or legal@vocafly.com.

2. Data we collect

We may process the following categories depending on your use:

• Technical data: IP address, browser type, device, pages viewed, referrer.
• Search data: departure/arrival airports, dates (we do not store passport data on our servers).
• Alert data: email and price criteria if you subscribe to price alerts.
• Cookies and similar technologies: see our Cookies Policy.
• Affiliate link click data for performance measurement.

3. Legal basis for processing (GDPR)

We process data based on:

• Performance of the service you requested (flight search).
• Legitimate interest: improving the platform, security, aggregated analytics.
• Consent: when subscribing to email alerts or non-essential cookies where required.
• Legal obligation: when required by competent authorities under law.

4. Data sharing

We do not sell your personal data. We may share limited data with:

• Flight providers and partners (Travelpayouts, Kiwi, etc.) when redirecting you for booking — their policies apply.
• Supabase, Vercel, Railway, Resend — processors with data protection agreements where applicable.
• Analytics tools (GA4/Plausible) when enabled in site settings.

5. International transfers

Data may be processed on servers outside your country of residence (EU, US, etc.). We rely on appropriate contractual safeguards where necessary.

6. Retention period

We retain data for as long as needed to provide the service and comply with legal requirements, then delete or anonymize it. Affiliate records may be kept longer for accounting purposes.

7. Your rights

Depending on your country's law, you may have the right to:

• Access and correct your data.
• Request deletion or restriction of processing.
• Object to processing for marketing purposes.
• Withdraw consent without affecting prior lawful processing.
• Lodge a complaint with a local data protection authority.

8. Security

We use HTTPS, server-side-only API keys, and limited admin panel permissions. No system is 100% secure; please report any suspected breach.

9. Children

The service is not directed to individuals under 16 years of age and we do not knowingly collect their data.

10. Updates

We may update this policy. The 'Last updated' date at the top of the page applies. Continued use after an update means acceptance.