Privacy Policy — PrivJet

1. Controller

The controller responsible for the processing of personal data within the meaning of the EU General Data Protection Regulation (GDPR) is:

OnlineBuilders LLC
131 Continental Dr, Suite 305
Newark, DE 19713, USA
E-mail: [email protected]

Full corporate identification: /imprint.

2. Data-Protection Officer

A statutory obligation to appoint a Data-Protection Officer under Art. 37 GDPR / § 38 BDSG does not apply to PrivJet. Privacy inquiries should be addressed to [email protected].

3. Definitions

This Policy uses the GDPR definitions (Art. 4 GDPR). “Personal data” means any information relating to an identified or identifiable natural person.

4. Legal Bases for Processing

Art. 6(1)(a) GDPR — consent (e. g. newsletter, optional cookies, marketing emails)
Art. 6(1)(b) GDPR — performance of a contract or pre-contractual measures (booking, pre-contract, Operator confirmation, payment processing)
Art. 6(1)(c) GDPR — compliance with a legal obligation (commercial and tax retention requirements)
Art. 6(1)(f) GDPR — legitimate interest (fraud prevention, IT security, reach analysis, server logs)
§ 25(1) TTDSG — consent for storing/reading cookies and similar technologies that are not strictly necessary
§ 25(2) No. 2 TTDSG — strictly necessary cookies (auth session, hCaptcha protection, basket)

5. What Data We Process

5.1 Server Logs

Each request automatically processes IP address (anonymized after 7 days), date/time, user agent, referrer and HTTP status. Requests are first routed through Cloudflare’s edge network for DNS, TLS termination and DDoS mitigation; Cloudflare keeps its own edge-logs (IP, request metadata, fingerprint) for up to 30 days for security purposes. Legal basis: Art. 6(1)(f) GDPR (IT security). Retention on our application servers: 7 days raw, 90 days aggregated / anonymized.

Protection of our listings against copying. Our flight lists, map, search and APIs contain a small number of control entries. Each recipient sees a slightly different version of them. When such an entry is delivered, we record which version went to which IP address (IPv4, or the /64 network for IPv6), API key, user agent and country, and when. If a control entry appears on another website, this lets us tell where our database was copied from. Legal basis: Art. 6(1)(f) GDPR (protection of our database and IT security). Retention: 24 months after the control entry ends.

5.2 Account Registration and Login

E-mail address, optional name and phone, login provider (Apple / Google for OAuth), account metadata. Legal basis: Art. 6(1)(b) GDPR. Retention: until account deletion plus 6 years after the last booking event for commercial-tax retention (§ 257 HGB, § 147 AO).

5.3 Booking Inquiry and Pre-Contract

First and last name, address, phone, e-mail, date of birth, optionally passport number, passenger manifest, flight details, special requests, handwritten signature (canvas image), IP address at signing. Legal basis: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(c) GDPR (aviation passenger manifest obligations).

Pax-manifest security measures: passenger PII is encrypted with AES-256-GCM before storage and automatically purged 90 days after the flight is marked “completed”. Pre-contracts (master document) are retained for 6 years for commercial-tax purposes.

Passport / ID-card scan (optional): to fill in the passenger manifest faster, you can scan the machine-readable zone (MRZ) of a passport or ID card with the camera or upload a photo of it. In our mobile apps the text is first recognised on your device (Google ML Kit, on-device — the image does not leave your phone). Only if that fails, and on our website, the photo is sent once over an encrypted connection to our server and from there to the Google Gemini API (see § 6.8), which transcribes the MRZ lines. We validate the check digits and fill in first and last name, date of birth, nationality, document type and number. The photo itself is processed in memory only and is neither stored nor logged by us; the extracted fields are treated like the rest of the passenger manifest (encryption and 90-day purge, see above). Using the scan is voluntary — you can always type the details instead. Legal basis: Art. 6(1)(b) GDPR.

5.4 Payment Processing

We use Stripe as our payment processor (Stripe, Inc., 354 Oyster Point Blvd, South San Francisco, CA 94080, USA, and for customers in the EEA Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland). Stripe processes card and wallet data for the PrivJet service fee and for API subscriptions directly; PrivJet does not store card or bank data, only payment IDs, status codes and receipts. Where an operator accepts card payment through Stripe Connect, Stripe processes the payment of the flight price on the operator’s behalf. Stripe also uses the data for fraud prevention under its own responsibility. Legal basis: Art. 6(1)(b) GDPR. Retention of invoice / payment records: 10 years after the end of the calendar year (§ 14b UStG, § 147 AO). Stripe’s privacy policy: stripe.com/privacy.

5.5 Newsletter

E-mail address, double-opt-in confirmation. Legal basis: Art. 6(1)(a) GDPR. Withdrawal at any time via the unsubscribe link in any e-mail or by writing to [email protected].

5.6 Customer Contact

For inquiries via contact form, e-mail, WhatsApp or Telegram, we process submitted data to handle the request. Legal basis: Art. 6(1)(b) or (f) GDPR. For WhatsApp see § 5.6b.

5.6a Customer Record and Enquiry History

So that every enquiry, quote and booking is handled consistently no matter how you contact us, we keep one customer record per person. It links the identifiers you use with us – e-mail address, phone or WhatsApp number, Telegram chat ID, web-chat session and, if you have one, your PrivJet account – and shows your enquiries, bookings, support tickets and chat history in one place. Identifiers are only joined to an existing account if the link is confirmed (for example by your account, the sender of a message, or a verification code); an e-mail address merely typed into a chat is never used to attach the chat to someone else’s account.

The record contains contact details, your travel preferences as you told them to us (e.g. usual number of passengers, pets, home airport, preferred aircraft class, budget, company), the status of your enquiries and internal notes our team makes while handling your case. Facts you state about yourself in chat messages can be extracted automatically by an AI model (see § 6.8); only statements you made yourself are used, and uncertain ones are reviewed by a person. Details you provided that your account does not yet contain (such as your name or company) may be added to your account to pre-fill booking forms; you can view and change them in your profile. The record also helps us detect spam and abuse.

Legal basis: Art. 6(1)(b) GDPR (handling enquiries and bookings) and Art. 6(1)(f) GDPR (legitimate interest in consistent customer service and protection against abuse). Retention: as long as your account exists; without an account, 24 months after your last contact. Deleting your account deletes the record. You can request a copy or correction at any time (§ 11).

5.6b WhatsApp

You can write to our concierge on WhatsApp. Until the switch-over, messages reach us through a self-hosted interface on our own servers in Germany. After the switch-over, they reach us through the official WhatsApp Business Cloud API of Meta, which processes them on our behalf (§ 6.7). This section applies to both ways.

When you write to us on WhatsApp, we process:

your phone number or, if you write to us with a WhatsApp username, the WhatsApp user ID (BSUID) that WhatsApp gives us instead of the number;
your WhatsApp profile name;
the content of your messages: text, voice messages, photos and documents;
time stamps and the delivery status of messages (sent, delivered, read, failed);
your answers given with buttons, lists and forms (WhatsApp Flows) in the chat.

Purpose and legal basis. We use this data to answer your enquiry and to prepare a booking or charter request (Art. 6(1)(b) GDPR) and, where no contract is in view, on the basis of our legitimate interest in answering messages addressed to us (Art. 6(1)(f) GDPR). Our WhatsApp messages only concern the enquiry you started: answers, updates on your request or booking and at most one follow-up question if a chat has gone quiet. Through the WhatsApp Business Cloud API we send them only within 24 hours of your last message to us; after that we use email or a push notification of our app. We do not send WhatsApp message templates, newsletters or bulk messages. You can write „Stop“ at any time, and we will no longer contact you on our own initiative in that chat.

Automated replies. Replies come from our AI assistant (§ 6.8). Before our first reply in a new chat we tell you that the answers are generated automatically, can contain mistakes, and that flights and prices are only binding once confirmed by the operator. If you ask for a person, a member of our team takes over the same chat. Voice messages, photos and PDF documents are passed to the Google Gemini API (§ 6.8) so that the assistant can read them; the file itself is processed in memory and not stored by us, only the resulting text is kept with the conversation.

Route alerts. If you ask us in the chat to let you know when a flight appears on a route, matches are sent to you by email or by push notification of our app, not by WhatsApp.

Retention. The conversation is part of your customer record (§ 5.6a). Our log of individual concierge messages on all chat channels is deleted after 365 days. How long Meta and WhatsApp store data themselves is governed by their own terms and privacy policies (§ 6.7).

6. Recipients / Sub-Processors

We use carefully selected sub-processors and have entered into Art. 28 GDPR data-processing agreements with them. Third-country transfers (in particular to the USA) are based on EU Standard Contractual Clauses (SCCs) and, where applicable, the EU-US Data Privacy Framework (DPF) following the EU Commission’s adequacy decision of 10 July 2023.

6.1 Hosting, Backend Infrastructure and Edge / CDN

Google Cloud / Google Ireland Ltd. (Firebase Authentication, Cloud Firestore, Cloud Storage, App Hosting, Cloud Messaging / FCM, Cloud Functions, App Check) — Gordon House, Barrow Street, Dublin 4, Ireland. Primary EU data centers (europe-west). Purpose: authentication, real-time database, file storage, web hosting, push notifications, serverless functions, anti-abuse signals. Third-country fallback transfers to Google LLC (USA) on the basis of EU-US-DPF / SCCs. firebase.google.com/support/privacy · cloud.google.com/terms/data-processing-addendum
Cloudflare, Inc. — 101 Townsend Street, San Francisco, CA 94107, USA. Cloudflare provides our global edge network (DNS, CDN, TLS termination, DDoS mitigation, Web Application Firewall) as well as bot-management (Turnstile, see § 6.5) and the asset host cdn.privjet.net. Cloudflare processes IP address, request metadata, TLS fingerprint and (anonymized) abuse signals for the duration of the connection plus log retention up to 30 days. EU traffic is normally terminated at EU edge nodes; cross-border processing to U.S. systems on the basis of EU-US-DPF / SCCs. cloudflare.com/privacypolicy
Google Ireland Limited (Gemini API) — Gordon House, Barrow Street, Dublin 4, Ireland. Google hosts our LLM inference workloads (Gemini API, see § 6.8). Under the paid Gemini API terms, prompts and completions are not used to train Google's models. Transfers to the U.S. are covered by the EU-U.S. Data Privacy Framework and SCCs. ai.google.dev/gemini-api/terms

6.2 Payments

Stripe, Inc. / Stripe Payments Europe, Ltd.— card payments of the service fee and API subscriptions, card payments to operators via Stripe Connect. Third-country transfers to the USA on the basis of SCCs / EU-US-DPF. stripe.com/privacy

6.3 E-Mail

Mailgun Technologies Inc. (EU region: api.eu.mailgun.net). Third-country transfer to the USA on the basis of SCCs. mailgun.com/privacy-policy

6.4 Maps and Location

Mapbox Inc. — 50 Beale Street, San Francisco, CA 94105, USA. SCCs. mapbox.com/privacy
Google LLC (Google Maps Platform) — 1600 Amphitheatre Parkway, Mountain View, CA, USA. policies.google.com/privacy. On capable devices (desktop and TV, in daylight) the cockpit view of the private-jet tracker and its TV mode load Photorealistic 3D Tiles directly from Google's Map Tiles API (tile.googleapis.com, 3D decoder from www.gstatic.com). Google receives your IP address, browser information and the map area being displayed. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in showing the requested 3D view). Where Google is not reachable or not used, the view shows Mapbox imagery instead. EU-US-DPF / SCCs.

6.5 Anti-Spam & Bot Protection

Cloudflare, Inc. (Cloudflare Turnstile)— privacy-friendly captcha alternative. Processes IP address, browser fingerprint signals and a short-lived challenge token to distinguish humans from bots. No advertising tracking, no cross-site profiling. SCCs / EU-US-DPF. cloudflare.com/privacypolicy
Google reCAPTCHA Enterprise (Firebase App Check) — Google Ireland Ltd. Used by Firebase App Check to attest that API requests originate from genuine app installations.

6.6 Analytics

Google Ireland Ltd. (Google Analytics 4) — active only after explicit consent in the cookie banner („Accept all“). IP is anonymized; transfer to the USA on the basis of SCCs / EU-US-DPF.
Matomo — page views, time on page, how far a page is scrolled and which buttons and links are clicked (their label or target, never what you type), operated on our own servers without cookies. No data is passed to third parties.
Google Ireland Ltd. (Google Ads conversion tracking) — active only after explicit consent in the cookie banner („Accept all“). If you reached us through a Google ad, we report to Google when you send an enquiry or sign a pre-contract (contract number and amount, no name or contact details), so we can see which ads lead to enquiries. Google may link this to your Google account. Legal basis: Art. 6(1)(a) GDPR, § 25(1) TTDSG; transfer to the USA on the basis of SCCs / EU-US-DPF. Without consent the tag is not loaded.

6.6a How You Found Us (Source of Enquiries)

We want to know which channels lead to enquiries and bookings. When you open our website we note where you came from: the domain of the referring website (never the full address), campaign parameters in the link (such as utm_source), whether you arrived via an ad click (only the type of click ID, never its value), the first page you visited and your country as derived by Cloudflare from your IP address.

When you contact us from the website via WhatsApp, Telegram or email, the pre-filled message or subject contains a short reference code (for example „Ref K7QM“; on Telegram it is part of the start link). It lets us connect your enquiry to that information. You can delete the code before sending. Contact forms, website chat, registration, charter requests and contracts carry the same information directly.

Without consent this information is kept only in your browser’s memory for the current visit. If you choose „Accept all“, we also keep it in your browser’s localStorage (pj.attr.v1, 90 days) so that a later visit can be linked to your first one. Records of clicks on contact links are deleted after 90 days; the source stored with an enquiry, ticket, account or contract is kept as long as that record. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in understanding which channels bring enquiries); storage in your browser beyond the visit: consent, § 25(1) TTDSG.

Page context in the concierge chat. When you write to our concierge on the website or in the app, each message carries the page or app screen you are on (its path on our own website, a few search filters such as departure and destination, and the page title — never form contents or links containing access tokens). While a conversation from the last 24 hours exists, the website or app also tells us when you change page and, once a minute while it is open in the foreground, which page you are on. Our team sees this next to the conversation, together with the last ten pages, so that we understand references like „this flight“ and can answer precisely. For enquiries via WhatsApp or Telegram we see the page on which you pressed the contact button. This information is stored with the conversation and deleted with it. Legal basis: Art. 6(1)(b) GDPR (answering your enquiry) and Art. 6(1)(f) GDPR (our legitimate interest in helping you quickly); it is part of the chat you started yourself, no additional storage on your device is involved beyond the chat itself.

6.6b Partner Programme

If you arrive via a partner link (a link with ?ref=CODE or privjet.net/p/CODE), we note the partner code in the same way as described in § 6.6a and count the visit for that partner per day, without your IP address or any other identifier. If you then create an account, send a request or book, we record which partner referred you so that we can pay the partner’s commission: the link or code counts for 365 days, and after your first paid booking your further bookings count for the same partner for 12 months. The partner never sees your name, email address or phone number — only the route, the month, the amount of the commission and its status. If you entered the partner’s code, you may receive the discount on the service fee the partner offers. Legal basis: Art. 6(1)(b) GDPR where the code gives you a discount, otherwise Art. 6(1)(f) GDPR (our legitimate interest in paying our partners correctly); storage in your browser beyond the visit: consent, § 25(1) TTDSG.

If you are a partner, we process the data from your application (name, company, email address, phone number, website and channels, country), your partner code, statistics on clicks, sign-ups, requests and bookings, your commissions and payouts, and the bank and tax details you provide for payouts. Bank details and tax identification numbers are stored encrypted and are only decrypted to make a transfer. Legal basis: Art. 6(1)(b) GDPR (partner agreement) and Art. 6(1)(c) GDPR (retention obligations under tax and commercial law). We keep this data for as long as you take part in the programme and afterwards for as long as statutory retention periods require (generally up to 10 years for payout records).

6.6c PrivJet Ops (Operator Portal)

If you work for an aircraft operator and use the PrivJet Ops portal, we process your name, email address, role in your company’s team, the notification channels you connect (phone number for SMS or WhatsApp, Telegram chat ID), your notification settings and a log of the notifications we send you and the replies you give in the channel. Legal basis: Art. 6(1)(b) GDPR (use of the portal on behalf of your company). We delete this data when you are removed from the team or your company leaves the portal, except where statutory retention periods apply.

Crew data. Operators can store their crew in the portal: name, role, base, contact details, type ratings, licence type and expiry, medical class and expiry (no medical findings), passport number, country and expiry, uploaded documents and duty times. We process this data as a processor on behalf of the operator (Art. 28 GDPR); the operator is the controller. Contact details and passport numbers are stored encrypted, documents in private storage that is only accessible through short-lived links, and only the operator’s administrators and operations staff can see crew data. We use it solely to show the operator expiry reminders and duty time warnings. Data subjects should address requests to the operator; we support the operator in answering them.

Fleet positions. The portal shows operators where their own aircraft are, based on publicly broadcast ADS-B data (see the private jet tracker). Aircraft with an opt-out request are not shown anywhere, including the portal.

Desktop app and offline work. The PrivJet Ops desktop app (Mac, Windows, Linux) shows the same portal. It registers the device with a random identifier, platform and app version so that notifications can be delivered to it, and checks for updates at cdn.privjet.net. For work without a connection, the app (and, if you switch it on, your browser) stores the schedule, checklists, crew per flight, flight watch, journey log, passenger lists and flight documents for the coming 14 days on your device, encrypted with a key held in your operating system’s keychain (in the browser: a non-exportable browser key). Changes made offline are transmitted once you are back online. Signing out deletes this local copy. Device entries are removed with your team membership. Legal basis as above; for crew and passenger data we act as the operator’s processor.

6.6d Travel Extras at Your Destination (Partner Links)

On booking confirmations, in some emails, in the app, in the chat and on some destination pages we show links to hotels, airport transfers, car rental and activities at your destination. These are advertisements (marked as such): bookings are made directly with the respective provider, and we receive a commission from our partners Stay22 (Stay22 Technologies Inc., Canada) and Travelpayouts (Travelpayouts, Cyprus/USA). The links are plain links; our pages load no scripts or cookies from these partners.

When you click such a link, it first passes through our own address (privjet.net/go/d/…). We record the click without your IP address or account: page type, kind of offer, destination airport, country (from Cloudflare), a pseudonymous booking reference and whether the click was counted, so we can detect automated or fraudulent clicks. The link passes on only the destination, the dates and the number of travellers, never your name, email address or booking number. After the click, the partner and the booking site set their own cookies under their own privacy policies. Legal basis: Art. 6(1)(f) GDPR (financing our free service through commissions, fraud prevention). Click records are deleted after 24 months.

6.6e Free eSIM Promotion

If you claim a free eSIM, we process your account data, your mobile number (to send a confirmation code by WhatsApp or SMS), a keyed hash of your mobile number, of your normalised email address, of your IP address and, in the app, of the device identifier your phone provides to apps (identifierForVendor on iOS, Android ID), so that each person can use the promotion only once. We also store the country you choose, the eSIM profile (ICCID, activation code, stored encrypted) and its data usage. Legal basis: Art. 6(1)(b) GDPR (providing the eSIM) and Art. 6(1)(f) GDPR (preventing repeated use of the promotion). Once confirmed, we also save the mobile number to your PrivJet account profile, where you can change or remove it.

Codes by SMS are sent by Prelude (prelude.so), which receives your mobile number and, to detect abuse of verification codes, the IP address, browser or app information and a device identifier of the request. Codes by WhatsApp are sent through our self-hosted WhatsApp interface until the switch-over; after the switch-over to the WhatsApp Business Cloud API of Meta, you send the code to us yourself in a WhatsApp message that we prepare for you (§§ 5.6b, 6.7).

Offers by SMS and WhatsApp. The free eSIM is offered in exchange for your consent that we may send you empty leg offers and promotions by SMS and WhatsApp to the confirmed number; you give it by ticking the box when requesting the code or claiming the eSIM. The consent only takes effect once the number is confirmed with the code. We store the time, the number, the wording you agreed to and its version. Legal basis: Art. 6(1)(a) GDPR. You can withdraw it at any time in the eSIM section of your profile or in the app, with effect for the future; an eSIM already issued remains yours. On WhatsApp we do not send message templates or bulk messages (§ 5.6b).

The eSIM profiles are provided by Redtea Mobile (eSIM Access), Hong Kong, which receives only an order number of our choosing and the chosen data package, not your name, email address or mobile number. Transfers on the basis of SCCs.

Review bonus. If you upload a screenshot of your app store review for the bonus, we store the image in private storage, have its text read by the Google Gemini API (see § 6.8) and compare it with the public reviews of our app. A member of our team decides on the bonus. Screenshots are deleted after 90 days, eSIM records 24 months after the end of their validity.

6.7 Messaging and Voice

Telegram FZ-LLC (UAE) — admin notifications and concierge bot upon explicit contact by you.
WhatsApp: concierge chat upon explicit contact by you (§ 5.6b). WhatsApp itself is operated by WhatsApp Ireland Limited under its own terms and privacy policy. Until the switch-over, we connect to WhatsApp through a self-hosted interface on our own servers in Germany; no further messaging provider processes the content of your chats. After the switch-over, we use the WhatsApp Business Cloud API of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, which processes the messages as our processor under the WhatsApp Business Solution Terms and the Meta Data Processing Terms. Data may be transferred to Meta Platforms, Inc. (USA) on the basis of the EU-US Data Privacy Framework and SCCs. whatsapp.com/legal/business-solution-terms
Twilio Ireland Ltd. — voice confirmation calls to Operators on last-minute bookings and, as a fallback, text messages. SCCs.
Prelude (prelude.so) — verification codes by SMS for the free eSIM promotion (§ 6.6e), including fraud checks on the request.
MessageBird B.V. (Bird, Netherlands) — text messages (SMS) to operators who have chosen SMS notifications in PrivJet Ops, and verification codes for their phone numbers.

6.8 AI Concierge (LLM Inference)

The AI concierge runs on managed model providers. By default we route prompts to the Google Gemini API and use Anthropic only as a fall-back. For the concierge, only conversation content (prompts and tool-calling JSON) is transmitted — no plain-text passenger data or payment data. The optional passport / ID-card scan (§ 5.3) is the only feature that sends an image of a government-issued ID to the Gemini API, and only when you actively use it. Voice messages, photos and PDF documents you send to the concierge on WhatsApp are transcribed or read by the Gemini API; the file is processed in memory and not stored, only the resulting text is kept with the conversation (§ 5.6b). All providers operate under zero-retention or short-retention APIs for non-training use.

Google Ireland Limited (Gemini API) — default provider, model family Gemini Flash. Under the paid Gemini API terms, Google does not use prompts or completions to train its models. Transfers to the U.S. are covered by the EU-U.S. Data Privacy Framework and SCCs. ai.google.dev/gemini-api/terms
Anthropic, PBC (USA) — optional fallback provider for Claude LLM via Anthropic’s direct API. Anthropic does not use API data for model training (zero-retention API). SCCs. anthropic.com/legal/privacy
Google Cloud / Vertex AI (Google Ireland Ltd.) — reserved for future model A/B-tests; not active in production at the date of this Policy unless noted otherwise on the cookie / consent banner.

6.9 Image Services and Backgrounds

Immich (self-hosted) — own EU servers for background imagery.
serper.dev / Serper LLC — Google-image API for aircraft-image enrichment. Only public aircraft model labels are queried; no PII of platform users.

6.10 Social-Media Auto-Posts

Crosspostify — distributes platform-owned marketing posts to Instagram, TikTok and Threads. No customer PII is transmitted.

6.11 Embedded Videos (YouTube)

Google Ireland Limited / Google LLC (YouTube) — Gordon House, Barrow Street, Dublin 4, Ireland. policies.google.com/privacy. The PrivJet Ops page for aircraft operators shows explainer videos. Until you click play, only a still image hosted by us is shown and no connection to YouTube is made. When you click play, the video loads in privacy-enhanced mode from www.youtube-nocookie.com; YouTube then receives your IP address, browser information and the page you came from and may store data in your browser. Legal basis: your consent by clicking play (Art. 6(1)(a) GDPR, § 25(1) TTDSG). EU-US-DPF / SCCs.

7. Cookies and Similar Technologies

We use cookies, localStorage and sessionStorage (data kept in your browser; sessionStorage is deleted when you close the tab). On your first visit we ask for your consent through a cookie banner. Below is every item our website stores in your browser, with its purpose and how long it is kept. Names may change with updates; the purpose stays the same.

7.1 Strictly Necessary or Requested by You (no consent required, § 25(2) No. 2 TTDSG)

Cookies

pj_rt (httpOnly): keeps you signed in when our server signs you in on your behalf, for example on networks that block Google (30 days, deleted when you sign out)
pj_idp (httpOnly): protects the Google sign-in against tampering while you are redirected (10 minutes)
pj_cview (httpOnly): lets you open your own booking confirmation page (30 minutes)
language: the language you chose for the website (1 year)
cf_clearance, __cf_bm, cf_chl_*: set by Cloudflare for bot and DDoS protection and the Turnstile check on forms (30 minutes to 24 hours)

localStorage (kept until you clear your browser data, unless stated otherwise)

cookie-consent: your choice in the cookie banner (until you change it)
language, selectedCurrency: your preferred language and display currency
pj.exchangeRates.v1: cached exchange rates for showing prices in your currency (6 hours)
pj.authCacheVersion, pj.sdkSession, pj.fallbackSession: technical markers for sign-in, so that the sign-in code only loads when you are signed in (until you sign out)
After you sign in: Firebase Authentication stores your session in IndexedDB (firebaseLocalStorageDb) until you sign out
pj_concierge_session, pj_concierge_last: only after you write in the website chat, so that the conversation continues after a reload (the conversation itself is stored on our servers, see § 6.6a)
pj_recently_viewed: the last eight empty legs you opened (route, date, price), shown as „recently viewed“ on the home page. Stays on your device only and is never sent to us
pj.feeNotice.dismissed, pj.enHint.dismissed, app-banner-closed: that you closed a notice or banner
pj-cockpit-tier-v2, pj-kiosk-no-3d, pj-kiosk-no-cockpit: display quality your device can handle in the 3D cockpit view and TV mode

sessionStorage (deleted when you close the tab)

pj.emptyLegsCount.v1, pj.liveActivity.v1: cached counters on the home page and map (30 minutes to 6 hours)
pj.geoNearest.v1, pj.nearMe.v1: the nearest airport, which our server derives from your approximate location (city level, from your IP address via Cloudflare), to suggest a departure airport; pj.geoPrefillDismissed.v1: that you removed this suggestion
pj.airportMeta.<code>: city and country of the airports in your search filter
pj_alive, pj_boot_reload, pj_rep_*, pj.chunkReload, pj.chunkErrorReloadAt: detect a page that fails to load after an update, reload it once and report the error once (contains only the current page path)
pj-cockpit-google-failed, pj-kiosk-layout: settings of the 3D cockpit view and TV mode

Third-party services we load for functions you use:the form and API protection (Firebase App Check with Google reCAPTCHA v3, Cloudflare Turnstile) may store its own data in your browser (for example the IndexedDB firebase-app-check-database); maps from Mapbox store mapbox.eventData* in localStorage on pages with a map. See § 6 for these providers.

7.2 Optional (consent required, § 25(1) TTDSG)

Only after you choose „Accept all“ in the cookie banner:

Analytics: _ga, _ga_* (Google Analytics 4, up to 14 months); Firebase Analytics may also create its own IndexedDB databases
Advertising measurement: _gcl_au, _gcl_aw (Google Ads conversion tracking, up to 90 days), plus the localStorage entry _gcl_ls that Google Ads may create
Source of enquiries: pj.attr.v1 (localStorage): how you first found us and, if you came via a partner link, the partner code, see §§ 6.6a and 6.6b (90 days; a partner code up to 365 days)

7.3 Without Consent, Withdrawal and Browser Signals

If you choose „Essential only“ or make no choice, none of the items in § 7.2 are stored. The source of your visit and a partner code are then kept only in the memory of the open tab and are lost when you reload or close it. A visit through a partner link is still counted once per day for that partner, without your IP address or any identifier (§ 6.6b).
If you create an account after arriving through a partner link, the referral is stored with your account on our servers (not in your browser) and applies for 365 days, also on other devices and in our apps (§ 6.6b).
You can withdraw or change your consent at any time with the button below; this shows the cookie banner again. Withdrawing deletes the Google Analytics and Google Ads cookies, their browser storage entries (such as _gcl_ls) and pj.attr.v1. Firebase Analytics databases and the items in § 7.1 can be deleted in your browser settings („clear site data“) at any time.
If your browser sends a Global Privacy Control (GPC) signal, we treat it like „Essential only“: none of the items in § 7.2 are stored, existing Google Analytics and Google Ads cookies, their browser storage entries and pj.attr.v1 are deleted, and the cookie banner is not shown. This also counts as your request to opt out of the sale or sharing of personal information under the California Consumer Privacy Act. We do not evaluate Do Not Track.

8. Push Notifications

With your consent (system permission on your device) we send push notifications to our iOS and Android app, e. g. about your booking, matching empty legs or route alerts. Legal basis: Art. 6(1)(a) GDPR; for messages about a booking Art. 6(1)(b) GDPR. You can disable push at any time in your device settings or per topic in your profile.

For delivery we store a device push token, platform, app version, language and, if you are signed in, your user ID. Notifications are delivered via the Expo Push Service of 650 Industries, Inc. (Palo Alto, USA; transfer on the basis of EU Standard Contractual Clauses), which forwards them to Apple Push Notification service (Apple Inc.) or Firebase Cloud Messaging (Google). The lock-screen flight display on iOS (Live Activity) is sent directly via Apple Push Notification service. Older app versions (before 1.9) still receive notifications via OneSignal, Inc. (San Mateo, USA; EU-US Data Privacy Framework / SCCs) until that service is switched off. We keep the notifications you received in your in-app inbox for 180 days; device tokens are deleted when they become invalid or after 12 months without use, and immediately when you delete your account.

9. International Data Transfers

EU-US Data Privacy Framework (Commission adequacy decision of 10 July 2023) for certified U.S. recipients;
EU Standard Contractual Clauses (SCCs) under Implementing Decision (EU) 2021/914 for other third countries;
additional safeguards (transfer impact assessment, encryption-at-rest and in-transit, pseudonymized transmission, access controls).

10. Retention Periods

Booking / contract data: 6 years (§ 257 HGB)
Invoices and payment records: 10 years (§ 14b UStG, § 147 AO)
Server logs: 7 days raw, 90 days aggregated
Pax-PII: 90 days after flight completion
Concierge message log (website, app, WhatsApp, Telegram): 365 days
Newsletter data: until withdrawal

11. Your Rights

11.1 GDPR (Art. 15–22)

Access (Art. 15)
Rectification (Art. 16)
Erasure / right to be forgotten (Art. 17)
Restriction (Art. 18)
Data portability (Art. 20) — JSON export on request
Objection (Art. 21), in particular against direct marketing
Withdrawal of consent with effect for the future (Art. 7(3))
Lodging a complaint with a supervisory authority (Art. 77).

11.2 California Residents — CCPA / CPRA

California residents have specific rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), including:

Right to know what personal information we collect and how we use it;
Right to delete personal information we hold about you;
Right to correct inaccurate personal information;
Right to opt-out of sale or sharing of personal information — we do not sell or share personal information for cross-context behavioral advertising; Google Ads measurement runs only with your consent, and a Global Privacy Control signal from your browser is honored as an opt-out (§ 7.3);
Right to non-discrimination for exercising these rights.

California requests can be sent to [email protected] with the subject line “California Privacy Request”.

Inquiries are processed within 30 days where required by GDPR and within 45 days for CCPA requests.

12. Automated Decision-Making / Profiling

We do not engage in solely automated decision-making with legal effects (Art. 22 GDPR). Our score-based Operator-matching is a decision-support tool only; final booking decisions are made manually by you and the selected Operator.

13. Security

We implement technical and organizational measures pursuant to Art. 32 GDPR, including:

TLS 1.2+ for all data transmissions
AES-256-GCM encryption for sensitive Pax-PII at rest in the database
Firebase App Check and Bearer-token authentication for APIs
Rate limiting, IP throttling, Cloudflare Turnstile bot-challenge and Firebase App Check on public endpoints
HMAC-signed webhooks and magic-link tokens
Strict role-based access control (Admin / Operator / Customer)
Regular security audits and penetration tests

14. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements or in our services. Subsequent visits will be governed by the new version.