Privacy Policy

1. Who We Are

Wayflo Travel Technologies ("Wayflo", "we", "us", or "our") operates the Wayflo platform — a travel search, planning, and booking service available at wayflo.ai. We are the data controller for the personal data collected through the platform.

For any privacy-related questions, requests, or complaints, please contact us at privacy@wayflo.ai.

2. Data We Collect

We collect personal data that you provide directly, data generated by your use of the platform, and data received from third-party services you connect to Wayflo:

• Identity and contact data — your full name, email address, and phone number provided at registration or checkout.
• Payment data — billing address and payment card details. All payment processing is handled by Stripe; we never store raw card numbers or CVV codes on our servers.
• Travel details — origin, destination, travel dates, trip type (solo, couple, family, group), number of travelers, budget range, and seat or room preferences.
• Family member profiles — names, ages, dietary preferences, and interests entered by the account holder to enable Family Lens personalisation. This data relates to family members, potentially including minors, and is managed solely by the adult account holder.
• Booking records — confirmation numbers, supplier PNRs, itinerary details, fare classes, and travel documents (e.g., passport numbers where required by airlines).
• Device and usage data — IP address, browser type, operating system, referring URLs, pages visited, features used, and session timestamps. This data is collected automatically via server logs and analytics tools.
• Your location — only when you ask — when you tap "Use my location" or "Get my precise location" (emergency screen), your device asks your permission first, then sends us your position: rounded to about 100 metres, or exact on the emergency screen so that it can be read out. We use it once: to name where your trip starts (its what3words address and the airports near it) or to show your exact location to the person you are calling for help, or to find which passenger-rights rules apply where you are. We don't store your position or record it in our logs. what3words and Google Maps, listed below, receive the position to answer that one request.
• Voice — only when you use the microphone — when you speak a request, the recording is sent to our transcription provider (OpenAI, listed below), turned into text and then deleted. We don't keep the recording. The text is handled like anything you type into Wayflo.
• Behavioural inferences (Trip DNA) — aggregated preference signals derived from your bookings and searches (e.g., preference for aisle seats, beach destinations, or budget accommodation), used exclusively to personalise your experience within Wayflo.

Travel documents you keep in the document vault — the files, their names and your notes — are end-to-end encrypted on your device before upload, so Wayflo stores them only as ciphertext it cannot read; the document type, issuing country and expiry date are stored unencrypted, and documents added before you turned encryption on stay unencrypted until you encrypt them.

3. Why We Collect Your Data

• Booking fulfilment — to search inventory, process payments, communicate booking confirmations to you and to travel suppliers, and manage itinerary changes.
• Customer support — to respond to enquiries, resolve disputes, and assist with disruptions or cancellations.
• Fraud prevention and security — to detect and prevent fraudulent transactions, unauthorised account access, and abuse of our platform.
• Personalisation — to tailor search results, AI recommendations, and city guides using Trip DNA and Family Lens.
• Analytics and product improvement — to understand how our platform is used so we can improve features and fix issues. We use PostHog for product analytics, aggregated heatmaps, and session replay. Session replay is configured to mask all form inputs (including email, password and passenger fields) and any element marked sensitive (such as passport and booking references), and payment card entry is handled entirely within Stripe and is never recorded. We do not record your keystrokes in those fields.
• Transactional communications — to send booking confirmations, itinerary updates, disruption alerts, and receipts via email (powered by Resend).
• Legal and regulatory compliance — to meet our obligations under applicable tax, financial, and travel regulations, including retention of financial records.

We never sell your personal data to third parties. We do not run third-party advertising on Wayflo.

4. Legal Bases for Processing

Where privacy laws require us to identify a legal basis for processing, we rely on the following:

• Contract performance — processing your booking, managing your account, and delivering the services you have purchased.
• Legitimate interests — fraud prevention, platform security, improving our services, and direct communications about your existing bookings, where our interests are not overridden by your rights.
• Consent — optional analytics cookies (PostHog) and any marketing communications. You may withdraw consent at any time.
• Legal obligation — retention of financial records and compliance with law enforcement requests where legally required.

5. Third-Party Processors

We share personal data with the following service providers. A processor handles it only as we instruct; a provider marked as an independent controller (payment providers, travel suppliers, messaging platforms) handles it under its own privacy terms. This list is generated from the register our code is checked against, so it changes when the providers do.

We may also disclose personal data to travel suppliers (airlines, hotels, car rental providers) as necessary to fulfil your booking. These disclosures are made under the supplier's own privacy terms.

6. International Data Transfers

Your data is primarily stored in the United States via Supabase. If you are located in the European Economic Area (EEA), the United Kingdom, Brazil, or India, your personal data will be transferred outside your jurisdiction when processed by Wayflo or our processors.

For transfers from the EEA and UK, we rely on the European Commission's Standard Contractual Clauses (SCCs) as the lawful transfer mechanism. We ensure each processor has executed SCCs or equivalent safeguards before any personal data is transferred. Where required by the UK GDPR, we additionally rely on the UK International Data Transfer Addendum.

For transfers under India's Digital Personal Data Protection Act 2023 (DPDP) and Brazil's Lei Geral de Proteção de Dados (LGPD), we apply equivalent contractual and organisational safeguards as required by those frameworks.

7. Your Rights

Depending on where you are located, you have the following rights over your personal data. To exercise any right, email privacy@wayflo.ai. We will respond within 30 days.

• Access — request a copy of the personal data we hold about you.
• Correction — request that we correct inaccurate or incomplete data.
• Deletion — request erasure of your personal data, subject to legal retention obligations (see Section 9).
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests; we will cease unless we have compelling grounds to continue.
• Restrict processing — request that we limit how we use your data in certain circumstances.
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting past processing.

8. Cookies

We use cookies and similar technologies to maintain authentication sessions, prevent fraud, record your cookie consent, and (with your consent) analyse platform usage. For full details on which cookies we set and how to opt out, see our Cookie Policy.

9. Data Retention

We retain your personal data for as long as your account is active or as necessary to provide our services. Specific retention periods are:

• Booking data — retained for 7 years from the date of travel to satisfy tax and financial reporting obligations.
• Analytics data — retained for 2 years, then automatically deleted or anonymised.
• Account data — purged within 30 days of account deletion, except where legal retention applies.

Anonymised, aggregated data — such as aggregate search trends — may be retained indefinitely as it cannot be linked to any individual.

10. Children

Wayflo is not intended for users under the age of 18. We do not knowingly collect personal data directly from children. Family member profiles for minor children (such as dietary preferences or travel interests) are created and managed by the adult account holder, who is responsible for ensuring the accuracy and appropriateness of that information. If you believe a child has provided personal data without appropriate parental consent, please contact us so we can delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes — those that significantly affect how we process your data — we will notify registered users by email at least 14 days before the changes take effect. Continued use of Wayflo after the effective date constitutes acceptance of the updated policy.

The effective date at the top of this page indicates when this version was last updated. Previous versions are available on request.

12. Contact

All privacy requests, subject access requests, and complaints should be directed to privacy@wayflo.ai. We aim to respond within 30 calendar days.