Privacy Policy

Steal That Fare ("STF", "we", "us") runs stealthatfare.com, a website that helps you search for and compare flight and hotel deals. STF is run by Henriett Fath, a sole trader in the United Kingdom, who is the data controller for the personal data described here. This page explains what information we collect, why, who helps us run the site, and what choices you have.

You can try it without an account

You can run a few searches without an account. After that we ask you to create a free account to keep searching. Price alerts and Premium also need an account.

What we collect

• Search inputs: the airports, destinations, dates and filters you choose, so we can show you relevant results. Without an account these are not linked to your identity.
• Approximate location: our hosting provider (Cloudflare) tells us your approximate city and country, worked out from your IP address. We use it once, to suggest the nearest departure airport. We do not store it.
• Account details (only if you sign up): your email address, a salted and hashed version of your password (we cannot read your password), the date you signed up, whether you confirmed your email, and your Premium status (plan, renewal date and Stripe customer ID).
• Price alerts (only if you create one): the search you saved (departure airports, destinations, dates), your maximum price, and your email address, so we can email you when a fare drops under your price.
• Glitch fare alerts (Premium, only if you turn them on): whether alerts are on, the departure cities you chose, and how many alert emails we sent you today.
• Emails we send you: account confirmation, password reset, alert emails, refund confirmations and, only if you asked for it, our weekly deals email. We send these through our email provider, Resend.
• Weekly deals email (only if you tick the box): your choice and the date you made it, so we can prove you asked for it.
• Payments and refunds: Premium is paid through Stripe. Stripe handles your card details; we never see or store your full card number. We keep a record of any refund we make.
• Basic technical data: standard server logs (IP address, browser type, pages requested) used for security and to keep the site running, plus anonymous usage statistics (for example which routes are searched and how quickly results load).
• On your device: your language and currency, destinations you saved with the heart, your last search, and whether you dismissed the "install the app" banner. If you are logged in, a login cookie keeps you signed in. See our Cookie Policy.

How we use information, and our legal basis

• To run your search, your account, your alerts and your Premium subscription, and to handle cancellations and refunds (to provide the service you asked for).
• To keep the site secure and working properly, and to understand overall usage so we can improve it (our legitimate interests).
• To track affiliate referrals to our booking partners, which is how we earn commission (our legitimate interests; see our Affiliate Disclosure).
• To keep payment and tax records (legal obligation).
• To send our weekly deals email, only if you ticked the box asking for it (your consent, which you can withdraw at any time).

We do not sell your personal data, and we only send marketing emails (our weekly deals email) if you asked for them. Every one of these emails has an unsubscribe link, and you can also turn it off in your account; unsubscribing does not affect your account or Premium. Alert emails only go out for alerts you turned on, and each one has a link to turn it off.

Who else handles data

• Cloudflare: hosting, security and delivery of the site, and storage of account data.
• Travelpayouts / Aviasales: flight prices and booking links. When you click through to book, you leave our site.
• Booking.com: hotel links open a Booking.com search with your destination and dates filled in.
• Xotelo: reference hotel prices, requested by our server using only the destination and dates (no personal data).
• Frankfurter (ECB rates): exchange rates, requested by our server (no personal data).
• Stripe: Premium payments, billing and refunds.
• Resend: sending our account, alert and refund emails.
• Unsplash, Pexels and Google Fonts: destination photos and fonts load directly from their servers, so they can see your IP address and browser details.

These providers have their own privacy policies. Some of them process data outside the UK; where they do, they use the safeguards UK law requires, such as standard contractual clauses.

How long we keep it

We keep your account and alerts while your account is active. A price alert stops when its travel dates have passed, and you can delete it or turn glitch alerts off at any time. If you ask us to delete your account we remove your account and alerts. We, and Stripe, keep payment and refund records for as long as the law requires (usually 6 years).

Your rights

If you are in the UK or EU, you can ask what personal data we hold about you, ask us to correct or delete it, ask for a copy, and object to certain uses. Email us using the details below and we will answer within one month. You can also complain to the Information Commissioner's Office (ico.org.uk), but we would appreciate the chance to sort things out first.

Children

This site is not directed at children, and we do not knowingly collect personal data from anyone under 18.

Changes to this policy

We may update this policy as the site grows. We will change the date at the top when we do.

Contact

Questions about this policy? Email contact@stealthatfare.com.