Privacy Policy
CheapTripps plans cheap multi-city trips around Europe and searches flights. This policy explains who processes your personal data, why, on what legal basis, for how long we keep it and what you can demand from us. It is written to meet Articles 13 and 14 of the GDPR (Regulation (EU) 2016/679).
We do not sell your personal data, we do not use it for advertising and we do not share it with ad networks.
1. Who is the controller of your data
The controller is naSpotted sp. z o.o., al. Jana Pawła II 43A/37B, 01-001 Warsaw, Poland, NIP (Polish VAT ID) 5273228667, KRS 0001255909, REGON 545316965; registry court: District Court for the Capital City of Warsaw in Warsaw, Commercial Division of the National Court Register (“we”, “us”) – the operator of the CheapTripps service.
Contact in all data-protection matters: support@cheaptripps.com, or by post to the address above.
Data protection officer: we have not appointed one, and we are not required to under Art. 37 GDPR. Send every request about your data to the contact address above.
2. What we collect, why, and on what legal basis
Every category of data has its own purpose, its own legal basis under Article 6(1) GDPR and its own retention period.
| Category of data | Purpose | Legal basis (Art. 6(1) GDPR) | Retention |
|---|---|---|---|
| Email address | Creating and running your account, passwordless sign-in by magic link, service messages about your account | (b) performance of the contract – our Terms of Service | For the life of the account, then 30 days after deletion (encrypted backups: up to 90 days) |
| Anonymous device identifier (a random ID in your browser) | Counting the free trip plans available before sign-up and stopping the free limit from being circumvented | (f) legitimate interest – protecting the free tier from abuse | Until you clear your browser storage; on our side no longer than 12 months from the last request |
| Usage data (number of searches and trip plans, plan tier, search parameters) | Delivering a metered service, enforcing plan limits, diagnosing failures | (b) performance of the contract; (f) legitimate interest – stability and security of the service | 12 months from the event |
| Payment and subscription data (Stripe customer and subscription reference, plan, payment status). We never receive your card number. | Running paid plans, issuing invoices, handling complaints and withdrawals | (b) performance of the contract; (c) legal obligation – accounting and tax law | 5 years from the end of the accounting year in which the payment was made, or the period required in the seller’s country |
| Price alerts (route, dates, price threshold) | Sending you an email or push message when a price drops | (b) performance of the contract; (a) consent for the push channel | Until you delete the alert or your account |
| Web-push subscription (browser endpoint and keys) | Delivering the price-drop notifications you asked for | (a) consent (Art. 6(1)(a) GDPR and Art. 5(3) of the ePrivacy Directive) | Until you withdraw consent or the browser revokes the endpoint |
| Email address given for marketing (waitlist, newsletter) | Sending deals and product news | (a) consent | Until you withdraw consent or unsubscribe |
| Product analytics (pseudonymous event data: pages viewed, features used, device type, approximate region derived from IP) | Understanding how the service is used so we can improve it | (a) consent – collected only after you accept analytics in the cookie banner | 12 months |
| The sentence you type into the planner (e.g. “2 weeks around Italy from Krakow”) | Turning your request into a trip plan; the text is sent to Anthropic’s Claude API for interpretation | (b) performance of the contract | Up to 30 days in request logs; not used to train any model |
| Server logs (IP address, user agent, time and type of request) | Security, preventing abuse and fraud, diagnosing failures | (f) legitimate interest – keeping the service available and secure | Up to 12 months |
| Correspondence (emails you send us, complaints, withdrawal statements) | Answering you, handling complaints and withdrawals, keeping evidence | (b) performance of the contract; (c) legal obligation; (f) legitimate interest – establishing and defending claims | Up to 3 years from the end of the matter |
Where the basis is consent (a), you can withdraw it at any time; the withdrawal does not affect processing carried out before it. Where the basis is our legitimate interest (f), you can object – see section 6. Providing an email address is voluntary, but without it we cannot create an account or run a paid plan.
3. Who else processes your data (sub-processors)
We use the providers below as processors. They act only on our documented instructions and under data-processing agreements.
| Provider | What it does | Where the data is processed |
|---|---|---|
| Supabase | Authentication and the application database | EU (Frankfurt region); parent company in the USA |
| Stripe | Payments, subscriptions and invoices. Card details go straight to Stripe – we never see them. | EU (Stripe Payments Europe Ltd., Ireland) and the USA |
| Vercel | Hosting of the website and its edge network | EU regions for serving the app; parent company in the USA |
| Railway | Hosting of the backend API and the price database | EU (Amsterdam region); parent company in the USA |
| PostHog | Product analytics – loaded only after you accept analytics in the cookie banner | EU (PostHog EU Cloud, Germany) |
| Brevo | Transactional email, price alerts and the newsletter | EU (France) |
| Anthropic | Claude API – turns the sentence you type into a trip plan | USA |
This list is the current one. When a sub-processor changes we update this page. Ask us at the contact address if you want the data-processing agreement covering a specific provider.
4. Transfers outside the European Economic Area
Most of your data stays inside the EEA. Two situations can involve a transfer to the United States: the Claude API (Anthropic, USA), which interprets the sentence you type into the planner, and support or administrative access by the US parent companies of Supabase, Stripe, Vercel and Railway.
Those transfers rely on the European Commission’s Standard Contractual Clauses (Art. 46(2)(c) GDPR) included in each provider’s data-processing agreement and, where the provider is certified, on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR).
You can ask us for a copy of the safeguards applied to a specific transfer, at the contact address in section 1.
5. How long we keep your data
The period for each category is in the table in section 2. In short: account data lives as long as the account, accounting records for the statutory period, analytics for 12 months, technical logs for up to 12 months.
When you delete your account we erase your data within 30 days, except records we have to keep by law (invoices) or need in order to establish or defend a legal claim.
6. Your rights
Under the GDPR you have the right to:
- access your data and obtain a copy of it (Art. 15)
- have inaccurate data corrected and incomplete data completed (Art. 16)
- have your data erased – the “right to be forgotten” (Art. 17)
- restrict processing (Art. 18)
- data portability – receive the data you gave us in a structured, machine-readable format and have it transmitted to another controller (Art. 20)
- object to processing based on our legitimate interest, and at any time and without reason to direct marketing (Art. 21)
- withdraw any consent at any time, as easily as you gave it – without affecting the lawfulness of processing before the withdrawal (Art. 7(3))
- not be subject to a decision based solely on automated processing which produces legal effects concerning you (Art. 22) – we take no such decisions
To exercise any of these rights, write to support@cheaptripps.com. We reply within one month; for complex requests we may extend that by two further months and will tell you why. Deleting your account in the app erases your data as well.
You also have the right to lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl. You may also complain to the authority in the EU country where you live or work, or where the alleged infringement took place.
Our supervisory authority is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland (uodo.gov.pl). You may also lodge a complaint with the supervisory authority in the country where you live or work.
7. Automated decisions and profiling
We do not profile you for advertising, and we make no decisions about you by automated means that produce legal effects or similarly significantly affect you (Art. 22 GDPR).
The trip planner is automated, but it only ranks flight connections by price and schedule. It does not assess you as a person, and its output is a suggestion you are free to ignore.
Product analytics (PostHog), if you accept it, is pseudonymous and used in aggregate: we look at how features are used, not at individual people.
8. Cookies and local storage
We use no advertising cookies and share nothing with ad networks. Anything that is not strictly necessary is loaded only after you accept it in the cookie banner.
You can change your decision at any time using the button below, or by clearing this site’s storage in your browser. Refusing analytics removes any PostHog cookies already set.
- Strictly necessary (no consent required, Art. 5(3) ePrivacy): your sign-in session (Supabase), the anonymous device identifier that counts free trip plans, the record of your cookie choice, and Stripe’s fraud-prevention cookies during checkout.
- Preferences (local storage only): language, currency, saved plans and favourites. This never leaves your browser.
- Analytics (consent only): PostHog, EU servers, an identifier kept for up to 12 months. Loaded only after you click “Accept”.
9. Security
Data travels over TLS. There are no passwords to leak – we sign you in with one-time magic links. Access to production data is limited to the people who run the service.
No system is perfectly secure. If a breach is likely to result in a risk to your rights, we notify the supervisory authority and, where required, you – in line with Articles 33 and 34 GDPR.
10. Children
The service is not aimed at children under 16 and we do not knowingly collect their data. If you believe a child has given us personal data, write to us and we will erase it.
11. Where the data comes from
All personal data comes from you: either directly (your email address, the sentence you type, the alerts you set) or automatically from your browser (device identifier, technical logs, and analytics events once you have consented).
We do not buy personal data and we do not obtain it from third-party databases or data brokers. Flight and price data we process comes from public airline sources and contains no personal data.
12. Changes to this policy
We may update this policy – the date at the top always shows the current version. If a change materially affects your rights, we will tell you by email or in the app before it takes effect.
13. Contact
Questions about this policy or about your data: support@cheaptripps.com, naSpotted sp. z o.o., al. Jana Pawła II 43A/37B, 01-001 Warsaw, Poland.