Privacy Policy

1. Who is responsible

NOTESMEDIA OÜ (registry code 17095909, Sepapaja tn 6, Lasnamäe linnaosa, Tallinn, Harju maakond, 15551, Estonia) is the controller of the personal data processed through Itavel. Please send privacy questions and requests to [email protected].

This policy describes the processing that actually takes place in Itavel today. Paddle, our reseller and Merchant of Record, processes payment data as an independent controller under its own privacy notice (https://www.paddle.com/legal/privacy).

2. Account data

What: your email address, display name, traveller ID, password (stored only as a secure hash), email-verification status, home and current airport, and account dates.

Why and legal basis: to create and run your account and provide the Service (performance of a contract, Art. 6(1)(b) GDPR).

How long: while your account exists, then deleted as described in “Deleting your account”.

3. Signing in with Google

If you choose to sign in with Google, we receive from Google your email address, whether it is verified, your name and profile picture, and the sign-in tokens Google issues for this link.

Why and legal basis: to sign you in (performance of a contract). How long: while the Google link exists on your account.

4. Focus and planning data

What: your focus sessions (start and end times, planned and active focus time, pauses, whether the flight page is on screen), and the task titles, notes, projects and plan items you enter.

Why and legal basis: these are the core of the Service — timing your focus, keeping your plan and recording your progress (performance of a contract).

How long: while your account exists.

5. Travel and progress

What: routes and flights you take, your current airport, flight tickets, passport stamps, Lifetime and Reward Miles and their history, status, and similar progress records. A ticket becomes visible to others only if you choose to share its link.

Why and legal basis: to provide the travel and progress features (performance of a contract). How long: while your account exists.

6. Preferences

What: language, timezone, daily reminder setting and time, and, stored on your device only, display, audio and flight-view preferences.

Why and legal basis: to show the Service the way you chose (performance of a contract). How long: account preferences while your account exists; device preferences until you clear them in your browser.

7. Fly Together

What: the crew flights you host or join, your membership and readiness, and the timing needed to fly together. Other members of the same crew see your display name, initials and whether you are flying — never your email address.

Why and legal basis: to coordinate shared flights you take part in (performance of a contract). How long: while your account exists.

8. Itavel Premium Pass and billing

What: your Paddle customer and subscription identifiers, plan, status, billing period and renewal or cancellation state, and identifiers of the billing events Paddle sends us. To set up your purchase we share your email address and your Itavel account identifier with Paddle.

We do not receive or store card numbers, security codes or other payment-card data. Paddle collects and processes them.

Why and legal basis: to provide Itavel Premium Pass (performance of a contract) and to meet accounting, tax and dispute obligations (legal obligation, Art. 6(1)(c), and legitimate interests, Art. 6(1)(f)).

How long: for as long as needed for these obligations, which can continue after your account is deleted.

9. Notifications

If you turn on reminders and allow notifications, we store your browser's push subscription (an endpoint address and encryption keys) and your browser's user-agent string, and send your daily reminder through your browser's push service.

Legal basis: your consent, which you can withdraw at any time by turning reminders off or blocking notifications. How long: until you withdraw, the subscription stops working, or your account is deleted.

10. Security and sign-in records

What: sign-in sessions; a record of security events on your account (such as sign-ins, failed sign-ins, password and email changes) with the event type and time; one-time links for email verification and password reset (stored only as hashes); and rate-limit counters derived from a one-way hash of your IP address, email address or account. We do not store your IP address in readable form.

Why and legal basis: to keep accounts and the Service secure and prevent abuse (legitimate interests).

How long: sessions up to 30 days; one-time links expire within 24 hours; rate-limit counters are removed after about two days; security events while your account exists.

11. Emails we send

We send service emails: email verification, password reset and change notices, email-change confirmations, and account-deletion confirmations. We do not send marketing emails.

Legal basis: performance of a contract and legitimate interests (account security).

12. Service logs

Our servers record short technical log lines about the use of features (for example that a flight was completed, with your account identifier, minutes and airport code), and billing errors without personal details. We do not use third-party analytics, advertising or tracking tools.

Why and legal basis: to operate, debug and improve the Service (legitimate interests). How long: logs are kept briefly in size-limited, rotating files and are discarded when the app is updated.

13. Support

If you contact us, we process your message and contact details to answer you (legitimate interests, or performance of a contract when the request concerns your account). We keep correspondence as long as needed to handle the request and any follow-up.

14. Cookies and storage on your device

Itavel uses only cookies and device storage that are needed for the Service or that remember your own choices:

• a sign-in session cookie (up to 30 days) and short-lived cookies used during Google sign-in;
• a language cookie (one year);
• a short-lived cookie that returns you to a Fly Together invitation after you sign in (one day);
• device storage (local and session storage) for your display, audio and flight preferences, flight recovery, and to avoid duplicate events; and, during sign-up, the email address you entered, so the “check your inbox” screen can show it;
• an offline cache of the app's static files.

We do not use advertising, analytics or cross-site tracking cookies, so we do not ask for cookie consent. You can delete cookies and site data in your browser at any time; you will then need to sign in again.

15. Who receives data

We use service providers that process personal data on our behalf, under data-processing terms:

• hosting and infrastructure: netcup GmbH (servers in the EU), OVHcloud (deployment management, EU) and Cloudflare (network protection, content delivery and encrypted backup storage);
• email delivery: Emailit;
• sign-in: Google, if you choose Google sign-in;
• maps: map and satellite-imagery tiles are loaded by your browser from OpenFreeMap and Esri, which receive your IP address and the map area requested; where an optional photorealistic 3D view is enabled, its tiles come from Google;
• notifications: your browser's push service (for example Google, Mozilla or Apple), if you turn on reminders;
• Paddle, as our reseller and Merchant of Record, which acts as an independent controller.

We may disclose data where the law requires it. We do not sell personal data.

16. International transfers

Some providers may process data outside the European Economic Area. When that happens, we rely on an adequacy decision of the European Commission (including the EU–US Data Privacy Framework for certified providers) or on the European Commission's Standard Contractual Clauses, together with additional safeguards where needed. You can ask us for more information at [email protected].

17. Deleting your account

You can delete your account in the account settings (an active Itavel Premium Pass subscription must be cancelled first). When you request deletion, you are signed out everywhere immediately and the account is scheduled for permanent deletion by a daily job once 30 days have passed. Your profile, focus, planning, travel, progress, Fly Together and notification data are then deleted.

Backup copies can temporarily retain previously deleted data. Our normal retention window is 7 days on the server and 30 days off-site; older copies are removed as successful backups are rotated. If backups are interrupted, removal may be delayed until backup operations resume.

Records of Itavel Premium Pass purchases and subscriptions (identifiers, plan and dates) can be kept after deletion where we need them for accounting, tax or dispute purposes.

18. Your rights

Under the GDPR you have the right to:

• access your personal data and receive a copy;
• have inaccurate data corrected;
• have your data deleted;
• restrict processing;
• receive data you provided in a portable format;
• object to processing based on legitimate interests;
• withdraw consent at any time, without affecting earlier processing.

To exercise your rights, write to [email protected]. We will answer within one month, or tell you if we need more time as the law allows. We may need to confirm that the request comes from you.

19. Complaints

You can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia, https://www.aki.ee/en. If you live elsewhere in the EEA, you can also contact the supervisory authority in your country. We would appreciate the chance to resolve your concern first at [email protected].

20. Automated decisions

We do not make decisions based solely on automated processing that produce legal effects or similarly significant effects for you. Automatic features — such as pausing a flight when its page is off screen, or temporary limits on repeated sign-in attempts — do not have such effects.

21. Children

Itavel is not intended for children under 16, and we do not knowingly allow them to create an account. Where the law of your country requires a parent's or guardian's consent for a young person, the Service may be used only with that consent.

22. Security

We protect data with encrypted connections, hashed passwords and one-time links, access controls on our systems, and encrypted off-site backups.

23. Changes to this policy

We will update this policy when our processing changes. The version and effective date are shown at the top; we will tell you about material changes in the app or by email.