Legal · Fliovoy, LLC
This policy explains what personal information Fliovoy, LLC ("Fliovoy," "we," "us") collects when you use fliovoy.com, the Fliovoy app and our emails (the "Service"), what we do with it, who we share it with, and the choices you have.
The short version
| Category | Examples | Why we need it |
|---|---|---|
| Account | Name, email address, password (stored hashed by our authentication provider) | To create and secure your account |
| Contact | Phone number | Airlines require a contact number for each booking; we may also use it to reach you about a booking problem |
| Trip criteria | Origin and destination airports, dates or date windows, cabin, preferences such as nonstop or seat type, your price cap | To watch fares and decide when to book |
| Traveler details | Full legal name, date of birth, gender as it appears on ID, for you and anyone you book for | U.S. law (TSA Secure Flight) requires airlines to collect name, date of birth and gender |
| Travel preferences | Answers you give in our "Traveler DNA" questionnaire, such as how you like to travel | To tailor suggestions and trip defaults |
| Billing | Card billing address, including state | To process payments and confirm the Service is available where you live |
| Payment card | Card number, expiry, security code | Collected directly by Stripe. We never see or store your full card number or security code. We receive a token, the card brand, last four digits, expiry and billing address |
| Messages | Emails and support requests you send us | To answer you and keep a record |
| Referral | The referral code in a member's link you followed, and who you later referred | To credit referrals |
| Category | Examples |
|---|---|
| Transactions | Bookings, fares found, holds placed and released, amounts charged and refunded, membership status, receipts |
| Authorization records | When you agreed to the Autopilot Booking Authorization and the membership terms, the exact wording you saw, your Cap, and the Stripe setup record. We keep these as evidence of what you authorized |
| Service logs | Records of actions taken on your account, such as trips created or cancelled, and technical logs from our servers, including IP address, browser type and time of request |
We measure site traffic with Plausible Analytics, which does not use cookies and does not collect personal information or track you across websites. It records page views, referrer, browser, device type and country, and it counts visitors using a daily-rotating hash that cannot identify you.
We do not collect precise location, contacts, photos, biometric data or bank account information. We do not use advertising pixels or social-media trackers.
We use your information to:
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects, other than carrying out the booking instructions you gave us. Autopilot books only what your own criteria and Cap allow.
We share personal information only as described here.
| Recipient | What they receive | Why |
|---|---|---|
| Duffel Technology Ltd. (our booking partner) | Traveler names, dates of birth, genders, phone, email, flight selection | To create the airline booking |
| The airline operating your flight | The same traveler details | To issue your ticket and carry you. The airline passes Secure Flight data to the TSA as U.S. law requires. The airline's own privacy policy governs what it does with your data |
These companies process data on our behalf under contracts that limit their use of it:
| Provider | What they do |
|---|---|
| Stripe | Card payments, card storage, subscriptions and fraud screening |
| Supabase | Database and account sign-in |
| Netlify | Hosting of our website and app |
| Railway | Hosting of our fare-watching software |
| Resend | Sending our emails |
| ClickUp | Our internal task tracker, used to follow up on bookings that need a human (receives name, email, phone and trip details) |
| Plausible Analytics | Cookieless site statistics (receives no personal information) |
| Anthropic | Generates destination suggestions from a city name. We send it no personal information |
We do not sell your personal information. We do not share it with anyone for cross-context behavioral (targeted) advertising, and we have not done so in the past 12 months. We do not knowingly sell or share the information of anyone under 16.
| Information | How long |
|---|---|
| Account and profile | While your account is open. We delete or de-identify it within 30 days after you close your account, except as below |
| Bookings, payments, refunds and authorization records | At least 3 years after the transaction, and up to 7 years, to meet seller-of-travel, tax and accounting rules and to answer card disputes |
| Trip criteria that never booked | Deleted with your account |
| Server and security logs | Up to 12 months |
| Emails with support | Up to 3 years |
Stripe, Duffel and the airline keep their own records under their own policies.
We encrypt data in transit with TLS and store it with providers that encrypt data at rest. We limit access to the people who need it, use unique credentials and keep payment card data out of our systems by using Stripe. No system is perfectly secure. If a breach affects your personal information, we will notify you and the authorities as the law requires.
Wherever you live in the U.S., you can ask us to:
Email jay@fliovoy.com from your account email with the subject "Privacy request." We may ask you to confirm your identity before we act, for example by replying from your account email. We respond within 45 days and will tell you if we need up to 45 more. You may use an authorized agent; we will ask for proof that you authorized them. We will not charge you or treat you differently for making a request.
If we deny your request, you can appeal by emailing jay@fliovoy.com with the subject "Privacy appeal." We will answer within 60 days and explain our decision. If you are not satisfied, you can contact your state attorney general.
We do not sell or share personal information and we run no cross-site tracking, so browser signals such as Global Privacy Control (GPC) and Do Not Track change nothing about how we treat you. We honor GPC signals as a request to opt out of sale and sharing in any case.
California. The California Consumer Privacy Act gives California residents the rights in Section 6.1, the right to know the categories and specific pieces of information we collect, and the right to limit use of sensitive personal information. In the past 12 months we collected these CCPA categories, for the purposes in Section 2, and disclosed them for business purposes to the recipients in Section 3:
| CCPA category | Collected? | Examples | Disclosed to |
|---|---|---|---|
| A. Identifiers | Yes | Name, email, phone, IP address, account ID | Service providers; Duffel and airlines |
| B. Customer records (Cal. Civ. Code §1798.80(e)) | Yes | Name, phone, card last four and billing address | Service providers; Duffel and airlines |
| C. Protected classification characteristics | Yes | Age (date of birth), gender | Duffel and airlines |
| D. Commercial information | Yes | Bookings, memberships, transaction history | Service providers |
| E. Biometric information | No | ||
| F. Internet or network activity | Yes | Server logs; cookieless page-view statistics | Service providers |
| G. Geolocation data | No (we see a coarse location from IP address only) | ||
| H. Sensory data | No | ||
| I. Professional or employment information | No | ||
| J. Education information | No | ||
| K. Inferences | Yes | Travel preferences from your trip criteria and Traveler DNA answers | None |
| L. Sensitive personal information | Yes | Account login (email and password) | Our authentication provider |
We use sensitive personal information only to provide the Service, so the right to limit does not change anything. We do not sell or share personal information. The Service is not currently offered to California residents (see our Terms), but this notice applies to any California resident's information we hold. Under California's "Shine the Light" law, you may ask whether we disclosed personal information to third parties for their own direct marketing; we do not.
Nevada. We do not sell covered information as Nevada law defines it. You may still send an opt-out request to jay@fliovoy.com.
Other states (including Colorado, Connecticut, Delaware, Oregon, Texas, Virginia and others with comprehensive privacy laws). You have the rights in Sections 6.1 and 6.2. We do not process personal information for targeted advertising, sale or profiling with legal or similarly significant effects.
The Service is for adults. We do not knowingly collect personal information directly from anyone under 18. An adult may give us a child's traveler details to book that child's flight, and we use those details only for that booking. If you think a child gave us information directly, email us and we will delete it.
We are based in the United States and process data in the United States. The Service is intended for U.S. residents only.
We will post any change here with a new effective date. If a change is material, we will email you before it takes effect.
Fliovoy, LLC
131 12th Ave N #233
Nashville, TN 37203
jay@fliovoy.com