GeoFares is operated by {{LEGAL_ENTITY}} (“we”, “us”). We act as the data controller for the personal data described here. The short version: we collect what we need to run a flight search service with accounts and subscriptions, we don't sell your data, and you can delete everything yourself from your dashboard.
1. What We Collect
- Account data: email address, name, and a hashed password when you sign up. If you sign in with Google or Apple, we receive your name and email from them. If you enable SMS alerts, your phone number.
- Search data: flight search queries — origin, destination, dates, cabin class, passenger counts — plus saved and tracked flights and price alerts you create.
- Preferences: home country, home airports, notification and email settings.
- Payment data: your card details are entered into a form served by Stripe and go directly to Stripe — they never touch our servers. We store only what Stripe gives us back: subscription status, plan, and the last four digits of your card.
- Usage data: pages visited, features used, approximate country (from your IP, to localize prices), and device information.
- AI concierge data: if you use the AI travel concierge, the messages and trip preferences you give it.
2. Why We Use It (and the Legal Basis)
- Running searches, alerts, and your account — performance of our contract with you.
- Processing subscription payments and preventing fraud — contract and legitimate interest.
- Sending price alerts, deal digests, and service emails you opted into — consent, withdrawable anytime in settings or via the unsubscribe link.
- Fixing bugs, keeping the service secure, improving features — legitimate interest.
- Anything requiring non-essential cookies — consent, via the cookie banner.
3. Who Processes Your Data
We use a small set of service providers, each only for what's listed:
- Supabase — authentication and database hosting (your account, searches, preferences).
- Stripe — payment processing and subscription billing. Card data is handled entirely by Stripe.
- Vercel — application hosting and content delivery.
- Upstash — short-lived caching and rate limiting (search results, request counters).
- Resend — transactional and digest email delivery.
- Twilio — SMS delivery and phone number verification, if you enable SMS alerts.
- Anthropic — powers AI insights and the travel concierge. Your prompts and trip context are processed under their commercial API terms and are not used to train their models.
- Inngest — background job processing (e.g. scheduled price checks for your alerts).
- Flight data providers (Amadeus, Kiwi.com) — receive route and date queries to return fares. Your searches are sent without your name or email attached.
- Travelpayouts — affiliate network behind our booking links. When you click through to book, they receive the click and route details to attribute the booking.
Some of these providers process data in the United States. Where GDPR applies, transfers rely on Standard Contractual Clauses or an adequacy decision. Questions about the list: contact@geofares.com.
4. Cookies
We use essential cookies for login sessions and remembering your cookie choice, and one non-essential third-party script (affiliate attribution) that loads only if you choose “Accept All”. The full list, with names and lifetimes, is in the Cookie Policy.
5. Affiliate Links
GeoFares earns commissions when you book flights through our partner links. This does not affect the prices you see — we rank results by price, not by what pays us more.
6. How Long We Keep It
- Account data: for as long as your account exists.
- Search history: deleted automatically after 90 days.
- Deleted accounts: all personal data permanently removed within 30 days of deletion.
- Billing records: kept as long as tax and accounting law requires, then deleted.
7. Your Rights
Under the GDPR and UK GDPR you can access, correct, delete, export, restrict, or object to our processing of your data. Under the CCPA/CPRA, California residents can additionally ask what categories we collect (it's all listed above), request deletion or correction, and opt out of “sale” or “sharing” — though we don't sell personal data and don't share it for cross-context behavioral advertising. We honor Global Privacy Control signals for that purpose. We will never treat you worse for exercising any of these rights.
- Delete everything yourself: Dashboard → Settings → Delete Account.
- Everything else: email contact@geofares.com — we respond within 30 days.
- Complaints: you can also lodge one with your local data protection authority.
8. Security
Data is encrypted in transit (TLS) and at rest. Access to production data is restricted and logged. No system is perfectly secure — if a breach affects you, we'll notify you as the law requires.
9. Children
GeoFares is not directed at children and requires users to be 18 or older. We don't knowingly collect data from anyone under 18.
10. Changes to This Policy
We may update this policy from time to time. Significant changes get an email or an in-app notice; the date at the top always reflects the current version.
