Legal
Privacy Policy
Last updated: 28 September 2026
1. Introduction
FlyVill ("we", "us") is the data controller for personal data collected through the FlyVill website and mobile app (the "Platform"). This policy explains what we collect when you search, register or book a flight, why we collect it, who we share it with, and the rights you have over it under UK data protection law.
2. Data we collect
Depending on how you use the Platform, we collect:
- Account data — name, email address and password (stored as a salted hash) when you sign up.
- Search data — the origin, destination, dates, cabin class and passenger counts you search with.
- Booking and traveller data — passenger names, dates of birth, contact details, passport/travel document details where an airline requires them, and any special requests.
- Payment data — handled directly by Stripe; we receive only a payment confirmation and a masked card reference, never your full card number.
- Technical data — IP address, device/browser type, and approximate location if you allow us to use it to suggest a nearby departure airport.
3. How we use your data
We use your data to search and return fares, create and manage bookings, process payments, send booking confirmations and important travel updates, provide customer support, and — where you've opted in — send marketing about fares and destinations. We rely on performance of a contract (to complete your booking), legitimate interests (to keep the Platform secure and improve it), and consent (for marketing and non-essential cookies) as our legal bases.
6. How long we keep your data
We keep booking records for as long as needed to handle post-travel queries, refunds and our legal/tax obligations (typically up to six years after your trip), and account data for as long as your account is active. You can ask us to delete your account at any time, subject to records we're legally required to retain.
7. Your rights under UK GDPR
Under UK data protection law you have the right to access, correct, delete or restrict the data we hold about you, to receive a portable copy of it, to object to certain processing (including marketing), and to withdraw consent at any time. To exercise any of these rights, contact us using the details below. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.
8. International transfers
Some of our processors (including Duffel and Stripe) may process data outside the UK. Where they do, we rely on appropriate safeguards, such as the UK International Data Transfer Addendum or an adequacy decision, to make sure your data stays protected to UK standards.
9. Security
We use encryption in transit, access controls and regular security reviews to protect your data. No online service can guarantee perfect security, but we work to keep the Platform and its processors to a high standard, and we'll notify you and the ICO of any breach where the law requires it.
10. Changes to this policy
We may update this policy as the Platform evolves or the law changes. We'll update the "Last updated" date above whenever we do, and tell you directly if a change materially affects how we use your data.
11. Contact us
For any privacy question or to exercise your rights, email our data protection contact at privacy@tripicall.example.