Privacy

Data we collect

To open an account and use VolariDeals, we collect:

• Email (required) — for magic link login, fare alerts, and support
• Name (optional) — only to personalize greetings in the app and emails
• Phone number (optional) — gateway to connect a Telegram account for alerts
• Telegram chat_id — only if you connect Telegram for alerts
• Monitored destinations — your watchlist (1 destination on Free, 5 on future Premium)
• Technical access data (IP, browser) — in server logs, for security
• Language and theme — display preferences

If you go Premium in the future, we collect payment data via Stripe (PCI DSS Level 1). We never store CVV or card numbers — we only get the "ok" from Stripe when a payment goes through.

How we use it

We use your data strictly for:

• Send rare fare alerts (email + optional Telegram)
• Keep your login active (magic link with short expiration)
• Human support

What we do NOT do with your data

• We do NOT sell your data to third parties, period.
• We do NOT share your email or personal data with anyone. When you go to book, we just open the flight search in a new tab — without passing along anything of yours.
• We do NOT track you off-site — no Facebook Pixel, no traditional Google Analytics, no Hotjar/FullStory.
• We do NOT train AI models with your data.

Third parties that process your data

We use infrastructure providers for login, database, email delivery and CDN/security, under data processing agreements (DPA).

Your rights

You have all rights granted by LGPD (Brazil's Law 13.709/2018), Quebec's Law 25, European GDPR, and California's CCPA: access your data, export in JSON, delete account + data in 1 click inside the app, correct inaccurate info, opt-out of marketing.

To exercise any right, email

How long we keep your data

• Active account: data retained as long as the account exists
• Deleted account: data wiped within 30 days (safety delay to prevent accidental deletion + backup rotation)
• Technical logs: kept temporarily and discarded periodically
• No affiliation cookie — we do not track purchases.

Security measures

We take security seriously. Some of the technological and administrative measures in place:

Technological

SSH key for server access; active firewall on the VPS; TLS 1.3 encryption on all communications; unique Supabase authentication token for each session; application error and suspicious traffic monitoring; Stripe (PCI DSS Level 1) processes payments — we never touch card data.

Administrative

Data access limited to our team (small team); limited retention per Policy above; internal protection procedures reviewed regularly; backup with automatic rotation. We never keep your data in physical format (paper) — everything is digital.

International data transfer

VolariDeals is hosted on cloud infrastructure with a data center in the USA. Payments are processed by Stripe on global servers (PCI DSS Level 1), and email delivery runs on global infrastructure. In line with LGPD and Quebec's Law 25, we ensure third parties that receive your data apply equivalent protection standards.

Notice to European users (GDPR)

If you are in the EU, EEA, Switzerland or UK, GDPR applies. Legal basis for processing: to provide services (necessary), communicate with you + prevent fraud/security (legitimate interests balanced with your rights), comply with the law (legal obligation), with your consent (any use outside these categories). Extra GDPR rights: erasure, portability, restriction, objection to legitimate interest, refusal of profiling. EU -> Canada/USA transfers use mechanisms recognized by the European Commission. To exercise rights or complain: support@volarideals.com OR your local data protection authority.

Children

VolariDeals does not collect data from anyone under 13 (COPPA-aligned). If we discover a minor's account, we delete it immediately. If you are a parent/guardian and suspect your child created an account, email support@volarideals.com — we will delete it as soon as we can.

Legal compliance

• Brasil: Law 13.709/2018 (LGPD Brazil) — legal basis: contract execution + consent.
• Quebec: Quebec Law 25 — granular consent + Bill 96 (FR-CA interface available).
• EU: GDPR — basis: Art. 6(1)(b) + Art. 6(1)(a). Chapter 3 rights guaranteed.

Cookies

Cookies have their own policy — see /cookies for full details. Summary: we use only essential cookies (login, language); no affiliation cookie and no cross-site tracking./cookies.