Privacy Policy

Controller

What “Flyx” means here

“Flyx by flyx.to” (we’ll say “Flyx”) covers our website, our TikTok app/integration, our ChatGPT companion (Control Tower), and our official social media profiles. This policy applies across those surfaces whenever we process your data.

What we process

• Technical logs (IP-derived metadata, user-agent, and timestamps) needed to secure and operate the service.
• Country-level location signals to suggest a relevant origin on first visit.
• A functional cookie to remember your chosen origin country.
• Alert signup details (email, preferences, confirmation timestamps) when you opt in for price alerts.
• Alert email engagement signals (opens and clicks) to measure delivery quality.
• Anonymous deal ratings to improve price-value ranking.
• Analytics data only after you opt in via the cookie banner.

Legal basis

• Legitimate interest to operate the website and prevent abuse.
• Legitimate interest to remember your origin preferences.
• Consent for analytics and marketing cookies.
• Consent for sending price alert emails.
• Consent for alert email engagement measurement.
• Compliance with legal obligations where applicable.

Partners & processors

• Kiwi.com (Tequila API) for live flight inventory and booking links.
• Render for hosting and infrastructure operations.
• Cloudflare for security, DNS, and performance.
• MailChannels for delivering opt-in alert emails.
• Google Analytics (optional) for aggregated usage insights after consent.
• Unsplash for destination imagery when available.
• OpenAI (ChatGPT) hosts our optional Control Tower companion. Their privacy policy applies when you use ChatGPT.
• Social media platforms (TikTok, Instagram, Threads, X, etc.) for community content and distribution. Their privacy policies apply when you use those platforms.

ChatGPT companion (optional)

If you choose to use flyX Control Tower on ChatGPT, your messages are processed by OpenAI under their own terms and privacy policy.

Our GPT can request deal data from flyx.to to answer you (for example, to run a “radar sweep” from your origin). Those requests include standard technical metadata that we use for security and rate limiting. We do not receive your full ChatGPT conversation unless you paste it into flyx.to.

International transfers

Some partners operate outside the EEA. Where required, transfers rely on standard contractual clauses or equivalent safeguards to protect your data.

Retention

• Operational logs are retained for up to 30 days unless needed for security investigations.
• Origin preference cookies last up to 90 days.
• Alert subscriptions are kept until you unsubscribe or request deletion.
• Alert email engagement logs are retained for up to 12 months.
• Anonymous rating identifiers last up to 12 months.
• Analytics data follows provider retention settings after consent.

Your rights

You can request access, correction, deletion, or restriction of your personal data. Contact us at privacy [at] flyx [dot] to for GDPR requests.

You can also lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria, cpdp.bg.