Privacy Policy

Controller

What “Flyx” means here

“Flyx by flyx.to” (we’ll say “Flyx”) covers our website, our TikTok app/integration, our ChatGPT companion (Control Tower), and our official social media profiles. This policy applies across those surfaces whenever we process your data.

What we process

• Technical logs (IP-derived metadata, user-agent, and timestamps) needed to secure and operate the service.
• Country-level location signals to suggest a relevant origin on first visit.
• A functional cookie to remember your chosen origin country.
• Alert signup details (email, preferences, confirmation timestamps) when you opt in for price alerts.
• Alert email engagement signals (opens and clicks) to measure delivery quality.
• Anonymous deal/game interaction data (for example ratings, deck starts, votes, shares, booking-link clicks) only after you opt in via the cookie banner.
• Optional guided-tour memory and short-lived origin-redirect attribution markers only after you opt in via the cookie banner.
• Optional chat-session identifiers for Control Tower chat continuity only after you opt in via the cookie banner.
• Analytics data only after you opt in via the cookie banner.

Legal basis

• Legitimate interest to operate the website and prevent abuse.
• Legitimate interest to remember your origin preferences.
• Consent for optional feature cookies (games, voting, chat continuity, and guided-tour memory).
• Consent for analytics cookies.
• Consent for sending price alert emails.
• Consent for alert email engagement measurement.
• Compliance with legal obligations where applicable.

Partners & processors

• Kiwi.com (Tequila API) for live flight inventory and booking links.
• Render for hosting and infrastructure operations.
• Cloudflare for security, DNS, and performance.
• MailChannels for delivering opt-in alert emails.
• Google Analytics (optional) for aggregated usage insights after consent.
• Unsplash for destination imagery when available.
• OpenAI (ChatGPT) hosts our optional Control Tower companion. Their privacy policy applies when you use ChatGPT.
• Social media platforms (TikTok, Instagram, Facebook, X, etc.) for community content and distribution. Their privacy policies apply when you use those platforms.

ChatGPT companion (optional)

If you choose to use flyX Control Tower on ChatGPT, your messages are processed by OpenAI under their own terms and privacy policy.

Our GPT can request deal data from flyx.to to answer you (for example, to run a “radar sweep” from your origin). Those requests include standard technical metadata that we use for security and rate limiting. We do not receive your full ChatGPT conversation unless you paste it into flyx.to.

International transfers

Some partners operate outside the EEA. Where required, transfers rely on standard contractual clauses or equivalent safeguards to protect your data.

Retention

• Operational logs are retained for up to 30 days unless needed for security investigations.
• Origin preference cookies last up to 90 days.
• Alert subscriptions are kept until you unsubscribe or request deletion.
• Alert email engagement logs are retained for up to 12 months.
• Short-lived origin-redirect attribution markers last up to 2 minutes after consent.
• Optional gameplay/rating identifiers last up to 12 months after consent.
• Optional guided-tour memory identifiers last up to 12 months after consent.
• Optional chat-session identifiers last up to 180 days after consent.
• Gameplay analytics and web analytics follow provider retention settings after consent.

Your rights

You can request access, correction, deletion, or restriction of your personal data. Contact us at privacy [at] flyx [dot] to for GDPR requests.

You can change or withdraw optional-feature and analytics consent at any time via cookie settings. Flyx then disables optional features and clears related optional cookie/local storage identifiers on this device.

You can also lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria, cpdp.bg.