Privacy Policy

1. Who We Are

Wayflo Travel Technologies ("Wayflo", "we", "us", or "our") operates the Wayflo platform — a travel search, planning, and booking service available at wayflo.ai. We are the data controller for the personal data collected through the platform.

For any privacy-related questions, requests, or complaints, please contact us at privacy@wayflo.ai.

2. Data We Collect

We collect personal data that you provide directly, data generated by your use of the platform, and data received from third-party services you connect to Wayflo:

• Identity and contact data — your full name, email address, and phone number provided at registration or checkout.
• Payment data — billing address and payment card details. All payment processing is handled by Stripe; we never store raw card numbers or CVV codes on our servers.
• Travel details — origin, destination, travel dates, trip type (solo, couple, family, group), number of travelers, budget range, and seat or room preferences.
• Family member profiles — names, ages, dietary preferences, and interests entered by the account holder to enable Family Lens personalisation. This data relates to family members, potentially including minors, and is managed solely by the adult account holder.
• Booking records — confirmation numbers, supplier PNRs, itinerary details, fare classes, and travel documents (e.g., passport numbers where required by airlines).
• Device and usage data — IP address, browser type, operating system, referring URLs, pages visited, features used, and session timestamps. This data is collected automatically via server logs and analytics tools.
• Behavioural inferences (Trip DNA) — aggregated preference signals derived from your bookings and searches (e.g., preference for aisle seats, beach destinations, or budget accommodation), used exclusively to personalise your experience within Wayflo.

3. Why We Collect Your Data

• Booking fulfilment — to search inventory, process payments, communicate booking confirmations to you and to travel suppliers, and manage itinerary changes.
• Customer support — to respond to enquiries, resolve disputes, and assist with disruptions or cancellations.
• Fraud prevention and security — to detect and prevent fraudulent transactions, unauthorised account access, and abuse of our platform.
• Personalisation — to tailor search results, AI recommendations, and city guides using Trip DNA and Family Lens.
• Analytics and product improvement — to understand how our platform is used so we can improve features and fix issues. We use PostHog for product analytics, aggregated heatmaps, and session replay. Session replay is configured to mask all form inputs (including email, password and passenger fields) and any element marked sensitive (such as passport and booking references), and payment card entry is handled entirely within Stripe and is never recorded. We do not record your keystrokes in those fields.
• Transactional communications — to send booking confirmations, itinerary updates, disruption alerts, and receipts via email (powered by Resend).
• Legal and regulatory compliance — to meet our obligations under applicable tax, financial, and travel regulations, including retention of financial records.

We never sell your personal data to third parties. We do not run third-party advertising on Wayflo.

4. Legal Bases for Processing

Where privacy laws require us to identify a legal basis for processing, we rely on the following:

• Contract performance — processing your booking, managing your account, and delivering the services you have purchased.
• Legitimate interests — fraud prevention, platform security, improving our services, and direct communications about your existing bookings, where our interests are not overridden by your rights.
• Consent — optional analytics cookies (PostHog) and any marketing communications. You may withdraw consent at any time.
• Legal obligation — retention of financial records and compliance with law enforcement requests where legally required.

5. Third-Party Processors

We share personal data with the following trusted service providers. Each acts as a data processor, handling your data only as instructed by us and bound by appropriate data processing agreements.

We may also disclose personal data to travel suppliers (airlines, hotels, car rental providers) as necessary to fulfil your booking. These disclosures are made under the supplier's own privacy terms.

6. International Data Transfers

Your data is primarily stored in the United States via Supabase. If you are located in the European Economic Area (EEA), the United Kingdom, Brazil, or India, your personal data will be transferred outside your jurisdiction when processed by Wayflo or our processors.

For transfers from the EEA and UK, we rely on the European Commission's Standard Contractual Clauses (SCCs) as the lawful transfer mechanism. We ensure each processor has executed SCCs or equivalent safeguards before any personal data is transferred. Where required by the UK GDPR, we additionally rely on the UK International Data Transfer Addendum.

For transfers under India's Digital Personal Data Protection Act 2023 (DPDP) and Brazil's Lei Geral de Proteção de Dados (LGPD), we apply equivalent contractual and organisational safeguards as required by those frameworks.

7. Your Rights

Depending on where you are located, you have the following rights over your personal data. To exercise any right, email privacy@wayflo.ai. We will respond within 30 days.

• Access — request a copy of the personal data we hold about you.
• Correction — request that we correct inaccurate or incomplete data.
• Deletion — request erasure of your personal data, subject to legal retention obligations (see Section 9).
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests; we will cease unless we have compelling grounds to continue.
• Restrict processing — request that we limit how we use your data in certain circumstances.
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting past processing.

Brazil — LGPD (Lei 13.709/2018)

If you are in Brazil, the Lei Geral de Proteção de Dados applies to the personal data we process about you. Our legal bases are the performance of your booking contract (Art. 7, V), compliance with legal obligations (Art. 7, II), our legitimate interests in fraud prevention and service improvement (Art. 7, IX), and your consent for optional analytics (Art. 7, I), which you may withdraw at any time from the cookie preferences or by email.

You have the rights in Art. 18: confirmation of processing, access, correction, anonymisation or deletion, portability, information about the entities we share data with, and revocation of consent. Complaints may be lodged with the Autoridade Nacional de Proteção de Dados (ANPD).

Encarregado (data protection officer)

Encarregado: to be appointed. Until an encarregado is published here, LGPD requests are handled through privacy@wayflo.ai.

India — Digital Personal Data Protection Act 2023 (DPDP)

This is the itemised notice the DPDP Act and the DPDP Rules 2025 require before we process your personal data. It is available in English, हिन्दी, తెలుగు, தமிழ் and ಕನ್ನಡ through the language menu.

What we process, and why

• Name, email, phone — to create your account, send booking confirmations and reach you during a disruption.
• Passenger details and travel documents — passed to the airline or hotel to issue your booking; kept for 7 years to meet tax and financial-record obligations.
• Payment data — handled by Stripe; we never hold your card number (RBI card-on-file rules — saved cards are network tokens).
• Usage data — only with your consent, to improve the product.

Withdrawing consent

Withdrawing consent is as easy as giving it: switch off analytics in the cookie preferences at any time, or email privacy@wayflo.ai. Withdrawal does not affect processing needed to complete a booking you have already made, or data we must retain by law. You may also nominate another person to exercise your rights if you are unable to.

Grievance contact

Grievance Officer: to be appointed. Until a named officer is published here, grievances go to privacy@wayflo.ai and are acknowledged within 48 hours.

8. Cookies

We use cookies and similar technologies to maintain authentication sessions, prevent fraud, record your cookie consent, and (with your consent) analyse platform usage. For full details on which cookies we set and how to opt out, see our Cookie Policy.

9. Data Retention

We retain your personal data for as long as your account is active or as necessary to provide our services. Specific retention periods are:

• Booking data — retained for 7 years from the date of travel to satisfy tax and financial reporting obligations.
• Analytics data — retained for 2 years, then automatically deleted or anonymised.
• Account data — purged within 30 days of account deletion, except where legal retention applies.

Anonymised, aggregated data — such as aggregate search trends — may be retained indefinitely as it cannot be linked to any individual.

10. Children

Wayflo is not intended for users under the age of 18. We do not knowingly collect personal data directly from children. Family member profiles for minor children (such as dietary preferences or travel interests) are created and managed by the adult account holder, who is responsible for ensuring the accuracy and appropriateness of that information. If you believe a child has provided personal data without appropriate parental consent, please contact us so we can delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes — those that significantly affect how we process your data — we will notify registered users by email at least 14 days before the changes take effect. Continued use of Wayflo after the effective date constitutes acceptance of the updated policy.

The effective date at the top of this page indicates when this version was last updated. Previous versions are available on request.

12. Contact

All privacy requests, subject access requests, and complaints should be directed to privacy@wayflo.ai. We aim to respond within 30 calendar days.