Skip to content
XoloTrip

Privacy Policy

Last updated: [date of publication]

Draft — highlighted details must be completed by the operator and reviewed by a lawyer before launch.

Who is responsible

The controller under the GDPR is Ichii GmbH, [address] (see the Imprint). Contact for privacy matters: [privacy email].

What we collect and why

  • Account data — your email address, to sign you in with a one-time link or code and to send the alerts you asked for (Art. 6(1)(b) GDPR).
  • Your watches — routes, dates, trip length, cabin, stops, target price and the number and ages of travelers. Children's ages are needed because airlines price by age. We don't collect names, dates of birth or passport details (Art. 6(1)(b)).
  • Subscription data — if you subscribe to Pro, payment is processed by Stripe. We store your Stripe customer ID and subscription status, never card details (Art. 6(1)(b), and Art. 6(1)(c) for tax records).
  • Technical data — server logs with IP address and request metadata, kept briefly for security and abuse prevention, including rate limiting (Art. 6(1)(f); our legitimate interest is operating a secure service).

Cookies

We only use cookies that are strictly necessary to keep you signed in and to complete a watch you started before signing in. We don't use analytics, advertising or tracking cookies, so we don't ask for cookie consent (§ 25(2) TDDDG).

Service providers

We use processors bound by data processing agreements:

  • Supabase (database and authentication; hosted in the EU, Frankfurt)
  • Vercel (hosting)
  • Resend (sending email)
  • Stripe (payments)
  • Duffel (flight data). We send only trip parameters — airports, dates, cabin, and the number and ages of travelers — never your email or name.

Some providers are based in the United States. Transfers rely on the EU–US Data Privacy Framework and/or EU Standard Contractual Clauses. [verify each provider's transfer mechanism]

How long we keep data

  • Account and watches: until you delete them or your account.
  • Fare observations (not personal data): up to 90 days.
  • Email delivery records: 180 days.
  • Billing records: as long as tax law requires (up to 10 years).

Your rights

You can request access, rectification, erasure, restriction, data portability, and object to processing based on legitimate interests (Art. 15–21 GDPR). You can delete your account at any time in your account settings. You also have the right to lodge a complaint with a supervisory authority, e.g. [competent state authority].