Privacy policy
Last updated
Who we are
Flat Flights (flat.flights) is the data controller for the data described here. Contact: [email protected].
Booking links (flat.flights/go/…)
Booking links redirect you to Aviasales (via Travelpayouts). To know which AI assistant or page sent the visit, the link adds
a short label such as geo_chatgpt_london_to_new_york to the affiliate code. The label contains no
personal data. If you arrive from an AI assistant, the assistant's name is kept in your browser's session storage
(ff_src) until you close the tab; it is never sent to us except inside that label.
For each booking link opened, and each call to our MCP server or JSON API, we keep an anonymous usage record: the route, dates and number of adults searched, the partner, that label, the browser family (for example "chrome"), whether the request came from a person, a browser agent or a bot, and the country Cloudflare reports. No IP address, cookie, full user agent or identifier of you is stored. For MCP requests and API calls we also keep the method or tool, the city pair or city looked up (as airport/city codes) and the client name the connector reports. These records are kept for up to 3 months.
Award booking requests
When you send an award search request we collect your email address, the loyalty programmes and balances you enter, route, dates, cabin, number of passengers and any notes. We use them only to answer your request and, if you go ahead, to send you booking instructions. Legal basis: steps taken at your request before a contract (GDPR Art. 6(1)(b)) and the consent you give in the form.
- We never ask for, receive or store frequent flyer passwords.
- Requests are kept for up to 12 months, then deleted automatically.
- Analytics events about the form contain no email, route, dates or balances.
- We do not sell your data or use it for advertising.
Processors
- Cloudflare — hosting, security and storage of requests.
- Resend — delivery of request emails to our team.
- Stripe — payment of booking fees, when you choose to pay. We never see your card details.
- Google Analytics (via Google Tag Manager) — aggregated usage statistics.
- Travelpayouts — affiliate tracking for Aviasales bookings.
When you leave our site for Aviasales or another partner, the partner's own privacy policy applies.
Your rights
You can ask to access, correct or delete your data, or object to its use, by writing to [email protected]. You can also complain to your data protection authority (in Italy, the Garante per la protezione dei dati personali).
In breve (italiano)
I link di prenotazione aggiungono al codice affiliato Aviasales un'etichetta senza dati personali (es. l'assistente AI da cui arrivi). Per le richieste award raccogliamo email, programmi e saldi, tratta, date, cabina, passeggeri e note, solo per rispondere alla richiesta. Non chiediamo mai password, conserviamo i dati al massimo 12 mesi e non li vendiamo. Per accesso, rettifica o cancellazione scrivi a [email protected]; puoi rivolgerti anche al Garante privacy.