Privacy Policy
Last updated: 7 September 2026
Your privacy matters to us. This policy describes how TripMates — both the website and the mobile app — collects, uses and protects your personal data, and how you can exercise your rights.
Data controller
This policy applies to the whole TripMates service: the TripMates website and the TripMates mobile app, whatever device you use. It covers all of the data we collect, use and share.
TripMates (“we”) is an independent flight-deal search and alerts project. As of today, TripMates is not yet incorporated as a company: the service is published and run on a personal basis by Teixeira R., the data controller within the meaning of the GDPR. This policy explains what personal data we collect, why, and what your rights are.
For any question about your data, or to exercise your rights, you can write to the data controller at hellotripmates@gmail.com. We reply within one month at the latest.
What TripMates is — and what it isn't
TripMates is an information comparator / aggregator: we spot and highlight flight deals, then send you to the booking sites (airlines, comparators, agencies). In short, we save you time by gathering already-public information and presenting it to you simply.
What TripMates is not: we are not a travel agency, we do not sell tickets, we do not set prices, and your money for a flight never passes through us. Booking and payment for the trip are made directly with the third party, under its own terms. The only payments that go through us concern your TripMates subscription (via Stripe) — never your tickets.
Where prices come from — full transparency
The prices you see come from publicly accessible data: we query Google Flights results (through our technical provider SerpAPI). This is the same information you could look up yourself — we simply read it, compare it and present it to you in a form that is simpler and faster to scan.
We never inflate a price and never create a fake sale: a flight is flagged as a deal only if it drops clearly below its usual price (at least −15%). As these fares are set by third parties and change very fast, we cannot guarantee that an offer is still available at the same price when you book: always check the price and conditions on the booking site before buying — that is what counts. Our promise: no tricks.
To stay as close as possible to the real fare, we update as many deals as we can and remove those that have expired: if a flight climbs back above its average, it leaves the catalogue instead of showing a discount that no longer exists. A price may still change between the moment you see it and your booking — the third-party site is always the source of truth.
What data do we collect?
Depending on your use of the service, we may collect:
- Identification data: email address, name or nickname, and the sign-in method used (email or Google).
- Travel preferences: departure airports, favourite destinations, number of travellers, class, stay length, currency.
- Travel requests: the departures, destinations, months or dates and details you enter.
- Notification preferences: alert activation, discount threshold, channels (app / email) and any notification email.
- Subscription and payment data: chosen plan, billing period (monthly or yearly), subscription status, period end date and Stripe identifiers (customer, subscription). We never store your card number: it is handled directly by Stripe.
- Ambassador / referral programme: credit balance, referral link and linked referrals (where applicable).
- Messages sent to the team: reply email address, category, subject and content of your message when you use the contact form.
- IP address: recorded in truncated form when you submit the contact form, solely to limit abusive submissions (anti-spam). It is used for no other purpose and never to profile you.
- Published reviews: name or nickname, city (optional), rating and review text. Please note that these reviews are PUBLIC: they appear on the TripMates home page and are visible to all visitors.
- Personal search key (optional): if you choose to use your own SerpAPI key, it is stored on your account and never shared with a third party.
- Technical data: session identifier, search usage logs (number of calls), and information needed to run the service.
Note: your favourites and search history are stored locally in your browser or in the app (on your device) and are not transmitted to our servers.
TripMates requests no sensitive permission on your device: no location, no camera, no microphone, no access to your contacts and no access to your files.
Why do we use your data?
- Provide the service: show deals, enable flight search and process your travel requests.
- Manage your account and subscription (including billing and refunds via Stripe).
- Send you the notifications and alerts you have enabled (app and/or email).
- Ensure security, prevent fraud and improve the service.
- Respond to your requests and comply with our legal obligations.
Legal basis (GDPR)
We process your data on the following bases: performance of the contract (providing the service and managing your subscription), your consent (alerts and emails, which you can withdraw at any time), our legitimate interest (security and improvement of the service) and compliance with legal obligations (accounting, billing).
Who do we share your data with?
We never sell your data and we never share it for advertising purposes. We use processors that handle certain data on our behalf, solely within the scope of the service:
- Base44 — host and technical provider: hosting of the application and database, authentication and email sending.
- Stripe — payment provider: secure processing of payments and subscriptions.
- SerpAPI — data provider: flight search results. It receives no personal data about you (see the next section).
- Google — authentication provider: optional sign-in via a Google account.
Apart from these processors, your data is not passed on to any third party. We may however disclose data if required by law or to protect our rights.
Reminder: the reviews you choose to publish are, for their part, publicly visible to all visitors.
Transfers outside the European Union
Three of our processors are established in the United States or may host part of the processing there: Base44 (hosting, authentication, email sending), Stripe (payments and subscriptions) and Google (optional sign-in). Your data may therefore be transferred outside the European Economic Area.
These transfers are governed by the safeguards set out in Chapter V of the GDPR. Base44 applies the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914). Stripe and Google rely on those same clauses and on their certification under the EU-U.S. Data Privacy Framework. You can ask us for details of the safeguards applying to each provider at hellotripmates@gmail.com.
Please note: our flight-results provider, SerpAPI, receives no personal data. Requests are sent from our servers and contain only the route, dates and travel class searched — never your identity, your email address or your IP address.
Cookies and local storage
The service mainly relies on your browser’s local storage (login token, favourites, search history, preferences) and, for the duration of a session, on temporary storage (current tab, plan chosen before signing in). We do not use advertising cookies. For details, see our Cookie Policy.
Security
We implement technical and organisational measures to protect your data: encrypted connections (HTTPS), encrypted payments via Stripe (your card never passes through TripMates), and server-side access control to data. As no system is infallible, we cannot guarantee absolute security.
Retention period
We keep your data for as long as your account is active, then according to the following periods:
- Account, preferences and credit balance: until you request deletion. The account is then closed within 30 days.
- Travel requests and notifications: deleted immediately as soon as you request the deletion of your account.
- Billing and subscription data: retained by Stripe in accordance with its own legal and accounting obligations.
- Contact-form anti-spam log (truncated IP address and email): kept solely for abuse-prevention purposes, and never used for anything else. You can ask for its deletion at any time.
- Search analysis log: anonymous (no account identifier, no email address) and purged periodically.
- Published reviews: kept until you delete them; you can remove yours at any time.
Your favourites (which expire automatically after 14 days) and your search history, stored locally on your device, can be cleared at any time from My account → Settings or via your browser settings.
Your rights
Under the GDPR, you have the following rights:
- Access and rectification: view and edit your information from My account → Preferences.
- Erasure: delete your account from My account → Account (danger zone), or use our public Delete my account page, which works without signing in.
- Objection and restriction of processing.
- Portability of your data.
- Withdrawal of consent: turn off alerts and emails at any time in Settings.
To exercise these rights, write to us at hellotripmates@gmail.com: we reply within one month at the latest.
If you believe your rights are not being respected, you may lodge a complaint with the data protection authority of your country of residence.
Minors
The service is not intended for people under 18. We do not knowingly collect data concerning minors.
Changes to this policy
We may update this policy. The “last updated” date at the top of the page indicates the version in force (currently: 7 September 2026, reference v3-2026-09). In the event of a significant change, we will inform you.
Contact
For any question about this policy or your personal data, write to Teixeira R., the data controller, at hellotripmates@gmail.com.
Privacy Policy
Your privacy matters to us. This policy describes how TripMates — both the website and the mobile app — collects, uses and protects your personal data, and how you can exercise your rights.
Data controller
This policy applies to the whole TripMates service: the TripMates website and the TripMates mobile app, whatever device you use. It covers all of the data we collect, use and share.
TripMates (“we”) is an independent flight-deal search and alerts project. As of today, TripMates is not yet incorporated as a company: the service is published and run on a personal basis by Teixeira R., the data controller within the meaning of the GDPR. This policy explains what personal data we collect, why, and what your rights are.
For any question about your data, or to exercise your rights, you can write to the data controller at hellotripmates@gmail.com. We reply within one month at the latest.
What TripMates is — and what it isn't
TripMates is an information comparator / aggregator: we spot and highlight flight deals, then send you to the booking sites (airlines, comparators, agencies). In short, we save you time by gathering already-public information and presenting it to you simply.
What TripMates is not: we are not a travel agency, we do not sell tickets, we do not set prices, and your money for a flight never passes through us. Booking and payment for the trip are made directly with the third party, under its own terms. The only payments that go through us concern your TripMates subscription (via Stripe) — never your tickets.
Where prices come from — full transparency
The prices you see come from publicly accessible data: we query Google Flights results (through our technical provider SerpAPI). This is the same information you could look up yourself — we simply read it, compare it and present it to you in a form that is simpler and faster to scan.
We never inflate a price and never create a fake sale: a flight is flagged as a deal only if it drops clearly below its usual price (at least −15%). As these fares are set by third parties and change very fast, we cannot guarantee that an offer is still available at the same price when you book: always check the price and conditions on the booking site before buying — that is what counts. Our promise: no tricks.
To stay as close as possible to the real fare, we update as many deals as we can and remove those that have expired: if a flight climbs back above its average, it leaves the catalogue instead of showing a discount that no longer exists. A price may still change between the moment you see it and your booking — the third-party site is always the source of truth.
What data do we collect?
Depending on your use of the service, we may collect:
Note: your favourites and search history are stored locally in your browser or in the app (on your device) and are not transmitted to our servers.
TripMates requests no sensitive permission on your device: no location, no camera, no microphone, no access to your contacts and no access to your files.
Why do we use your data?
Legal basis (GDPR)
We process your data on the following bases: performance of the contract (providing the service and managing your subscription), your consent (alerts and emails, which you can withdraw at any time), our legitimate interest (security and improvement of the service) and compliance with legal obligations (accounting, billing).
Who do we share your data with?
We never sell your data and we never share it for advertising purposes. We use processors that handle certain data on our behalf, solely within the scope of the service:
Apart from these processors, your data is not passed on to any third party. We may however disclose data if required by law or to protect our rights.
Reminder: the reviews you choose to publish are, for their part, publicly visible to all visitors.
Transfers outside the European Union
Three of our processors are established in the United States or may host part of the processing there: Base44 (hosting, authentication, email sending), Stripe (payments and subscriptions) and Google (optional sign-in). Your data may therefore be transferred outside the European Economic Area.
These transfers are governed by the safeguards set out in Chapter V of the GDPR. Base44 applies the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914). Stripe and Google rely on those same clauses and on their certification under the EU-U.S. Data Privacy Framework. You can ask us for details of the safeguards applying to each provider at hellotripmates@gmail.com.
Please note: our flight-results provider, SerpAPI, receives no personal data. Requests are sent from our servers and contain only the route, dates and travel class searched — never your identity, your email address or your IP address.
Cookies and local storage
The service mainly relies on your browser’s local storage (login token, favourites, search history, preferences) and, for the duration of a session, on temporary storage (current tab, plan chosen before signing in). We do not use advertising cookies. For details, see our Cookie Policy.
Security
We implement technical and organisational measures to protect your data: encrypted connections (HTTPS), encrypted payments via Stripe (your card never passes through TripMates), and server-side access control to data. As no system is infallible, we cannot guarantee absolute security.
Retention period
We keep your data for as long as your account is active, then according to the following periods:
Your favourites (which expire automatically after 14 days) and your search history, stored locally on your device, can be cleared at any time from My account → Settings or via your browser settings.
Your rights
Under the GDPR, you have the following rights:
To exercise these rights, write to us at hellotripmates@gmail.com: we reply within one month at the latest.
If you believe your rights are not being respected, you may lodge a complaint with the data protection authority of your country of residence.
Minors
The service is not intended for people under 18. We do not knowingly collect data concerning minors.
Changes to this policy
We may update this policy. The “last updated” date at the top of the page indicates the version in force (currently: 7 September 2026, reference v3-2026-09). In the event of a significant change, we will inform you.
Contact
For any question about this policy or your personal data, write to Teixeira R., the data controller, at hellotripmates@gmail.com.
