OnwardProof

Privacy policy

Last updated

To hold a seat, an airline needs the traveller’s name, date of birth and contact details. This page explains what we collect, why, who sees it and how long we keep it.

Who is responsible

Neura Technology, LLC runs OnwardProof and decides how your personal data is used. For anything about your data, write to support@onwardproof.io.

What we collect

  • When you book

    The traveller
    Title, given names, family name, date of birth and sex, as in the passport
    Contact
    Email address and phone number
    The trip
    Route, dates, the flight you choose and the airline’s booking code

  • When you pay

    From Stripe
    Your email address, the amount and whether the payment went through. Stripe takes your card details on its own page, and we never see or store them.

  • With the Unlimited plan

    The plan’s traveller
    Title, names, date of birth and sex, taken from your first reservation on the plan

  • When you sign in

    Account
    Your email address
    Sign-in codes
    6-digit codes, which work once and expire after 10 minutes
    Sessions
    The IP address and browser of each signed-in device

  • When you use the site

    How you use it
    The pages you open, what you click and type, and how long each step takes. Visits are recorded so they can be played back, including what you type into forms, such as the traveller’s details. Sign-in codes are hidden from recordings. If you’re signed in or place an order, we link this to your account or order.
    Your device
    Browser, operating system, screen size and language
    IP address
    Used to prevent abuse and keep the service secure, and to estimate your country and city
    Server logs
    Our hosting provider records requests to our servers, as hosts do
    Airline logos
    Loaded from a third-party image server, which sees your IP address as any website would

  • When you write to us

    Messages
    What you send us, and our replies

We don’t ask for passport numbers, passport scans, photos or nationality. If you send us any, we delete them.

Why we use it

  • Holding your reservation and sending the itinerary

    What
    The traveller’s details, contact details and the trip
    Legal basis
    Performing our contract with you

  • Payments, refunds and the Unlimited plan

    What
    Payment records, your email address and the plan’s traveller, so we can check each booking on the plan is for them
    Legal basis
    Performing our contract with you

  • Signing you in

    What
    Your email address, sign-in codes and sessions
    Legal basis
    Performing our contract with you

  • Emails about your order

    What
    Your email address. We send sign-in codes, the itinerary, each new booking code, requests to pick another flight and refund notices. We don’t send marketing.
    Legal basis
    Performing our contract with you

  • Understanding how the site is used

    What
    How you use the site, recordings of visits, your device and your approximate location
    Legal basis
    Our legitimate interest in seeing where people get stuck and improving the service

  • Keeping the service safe

    What
    IP addresses, sessions and server logs
    Legal basis
    Our legitimate interest in preventing fraud and abuse

  • Accounting and tax

    What
    Order and payment records
    Legal basis
    Meeting our legal obligations

Who we share it with

  • The airline, through our authorised airline distributor: the traveller’s details, the email address and phone number, and the flight. Once the airline holds the seat, it keeps its own record under its own privacy policy. It releases the seat at its deadline, and we can’t delete the airline’s record.
  • Our airline distributor, which passes the booking to the airline and returns the booking code.
  • Stripe, which takes payments and refunds and checks them for fraud. Stripe is responsible for what it collects on its checkout page, under its own privacy policy.
  • Our email provider, which delivers our emails, including the itinerary.
  • Our analytics provider, which records how the site is used, including recordings of visits, and keeps the results for us.
  • Our hosting provider, which runs the service and stores its data.
  • Authorities, when the law requires it.

The distributor, email, analytics and hosting providers act on our instructions and may only use your data to provide their service to us. Ask us and we’ll tell you which companies they are. We don’t sell personal data or share it for advertising.

Data sent to other countries

We, our providers and airlines may handle your data in countries other than the one you live in, including the United States. Where data leaves the UK or the European Economic Area, it is protected by an adequacy decision or by the standard contractual clauses approved for such transfers.

How long we keep it

  • The traveller’s details and the itinerary: deleted 30 days after you place the order.
  • The traveller on an Unlimited plan: kept with the plan for as long as it’s active, and deleted 30 days after it ends.
  • Order and payment records: your email address, the order reference, route, dates, booking codes and amounts. We keep them for as long as tax and accounting law requires, usually 6 to 7 years.
  • Your account: while you have it. Order records stay as above after you close it.
  • Sign-in codes: 10 minutes. Sessions: 7 days.
  • IP addresses used to prevent abuse: deleted automatically within a day.
  • How you used the site, including recordings of visits: 30 days for recordings and a year for everything else. If you’re signed in, the profile that links them to your account is kept until the account is deleted.
  • Messages to us: up to 2 years after the last one.

Cookies

We set one cookie when you sign in. It keeps you signed in for up to 7 days, and the site can’t sign you in without it.

Our analytics provider keeps an identifier in a cookie and in your browser’s storage, so it can tell one visit from the next and connect the steps of a booking. It lasts up to a year. You can block or delete it in your browser’s settings, and the site still works.

We don’t use advertising cookies or tracking pixels, and we don’t share what we learn with advertisers. Stripe sets its own cookies on its checkout page, under its own policy.

Your rights

You can ask us to:

  • give you a copy of the personal data we hold about you;
  • correct it;
  • delete it;
  • limit how we use it, or object to how we use it;
  • give it to you, or to another company, in a format a computer can read.

Write to support@onwardproof.io. We reply within a month, and it’s free. We may need to keep some records because the law requires it, and we can’t delete the airline’s own record of a booking.

If you’re in the UK or the EU and unhappy with how we handle your data, you can complain to your data protection authority, such as the Information Commissioner’s Office in the UK. We’d be grateful for the chance to put it right first.

How we protect it

  • The traveller’s details are encrypted when stored.
  • Order links are long and random, so they can’t be guessed.
  • You sign in with a one-time code, so there’s no password to steal.
  • Everything travels over encrypted connections.

If a breach puts your data at risk, we’ll tell you and the authorities as the law requires.

Children

The service is for adults. Every traveller must be 18 or over, and we don’t knowingly collect data about anyone younger.

Changes to this policy

When we change how we handle data, we update this page and its date. If a change matters to you and you have an open reservation or an Unlimited plan, we’ll email you before it applies.