Privacy Policy

1. Who is responsible

The controller of your personal data is Flaingo Konrad Zamirski, De Galerij 1 , 4261DG Wijk en Aalburg, Netherlands (“we”, “Flaingo”). Contact for privacy matters: [email protected].

2. What data we process and why

• Using the website and the AI assistant. The messages you type into the assistant are sent to our AI provider (Anthropic) so it can answer and search flights for you. We also store the text of your search (up to 500 characters), the departure and destination airport codes and the currency in our database, without your name, account or IP address. Please do not type personal or sensitive data into the assistant. With your consent to optional cookies, we also store a hash of a random visitor ID, public page paths without URL parameters and visit times to count unique visitors and page views. We keep this data for up to 13 months and do not link it to your account or store your IP address with it. Purpose: to carry out the search you asked for, and for statistics and improving the service.
• Email offers (newsletter and price notifications). If you subscribe, we process your email address, the language and currency of the site, your departure airport, the destinations and countries you viewed in that session (so we can send relevant offers), the place where you signed up (for example the window shown before you go to a partner) and the date of your consent. We store this in our database and with our email service provider (Sender). Purpose: sending you the offers you asked for. We first send you an email with a confirmation link (double opt-in); if you do not confirm within 14 days, we delete the address.
• Clicks on offers. When you click “Go to the offer”, we record anonymously where the click came from (for example the assistant or the deals section) and the route (airport codes), without any email address or IP address. Purpose: statistics about which offers are useful.
• Security and abuse prevention. To protect the assistant from abuse we limit the number of requests: we keep a shortened, salted hash of your IP address (not the address itself) for about 24 hours. Our web server also keeps technical logs (IP address, browser, time) for a limited period for security and error diagnosis.
• Correspondence. If you email us, we process your email address and the content of your message to reply. Our mailbox is provided by Google (Google Workspace).

3. Account and price alerts

If you log in with Google, we receive your email address and name from Google (nothing else) and create an account. In the account we store your price alerts (route or country, maximum price, options), the notifications we sent you and a session that keeps you logged in. Purpose: to provide the alerts you set up. Legal basis: performing the service you asked for (Art. 6(1)(b)). You can delete alerts and the whole account at any time in the Notifications panel. Deleting the account removes your alerts, notifications and sessions. If you turn on browser notifications, we also store your browser’s push subscription (a technical address and keys) so that we can send them; the messages pass through your browser vendor’s push service (for example Google, Apple or Mozilla). You can turn this off at any time in the panel or in your browser settings.

4. Legal bases (GDPR)

• Consent (Art. 6(1)(a)) — email offers. You can withdraw your consent at any time without affecting earlier processing: click the unsubscribe link in any email or write to [email protected].
• Legitimate interest (Art. 6(1)(f)) — running and securing the site, abuse prevention, statistics and improving the service, answering your messages.
• Performing a service you asked for (Art. 6(1)(b)) — answering your requests in the assistant.

5. Who receives your data

• Sender — email delivery and the subscriber list.
• Anthropic — the AI model behind the assistant.
• Google — our mailbox (Google Workspace), sign-in with Google if you choose it, Google Analytics statistics, and AdSense advertising (the latter two are loaded after you accept optional cookies; AdSense may process your IP address and use advertising identifiers).
• Cloudflare — domain name system (DNS).
• Our server hosting provider.
• Travelpayouts / Aviasales — when you open an offer or use the embedded search form, you go to a partner’s site or load their scripts. They act as independent controllers under their own privacy policies.
• Image sources (Unsplash, Wikimedia Commons) — photos load from their servers, so they receive your IP address and browser data.

We do not sell your personal data. Public authorities may receive data only where the law requires it.

6. Transfers outside the EEA

Some providers (for example Anthropic and Google) may process data in the United States. We rely on the safeguards required by the GDPR, such as the EU–US Data Privacy Framework or standard contractual clauses, where the provider offers them.

7. How long we keep data

• Email offers: until you unsubscribe or withdraw consent. Afterwards we keep only a minimal record (email address, consent and unsubscribe dates) so that we can honour your opt-out and prove compliance, for as long as claims may arise.
• Search history in the assistant: as long as needed for statistics and improving the service, then deleted or anonymised.
• IP hash for request limits: about 24 hours.
• Server logs: a limited period needed for security.
• Correspondence: as long as needed to handle your matter and any claims.

8. Your rights

You have the right to access your data, have it corrected or erased, restrict processing, receive it in a portable format, object to processing based on legitimate interest and withdraw consent. You can also lodge a complaint with the supervisory authority in your country (in Poland: the President of the Personal Data Protection Office, UODO; in the Netherlands: Autoriteit Persoonsgegevens; in Germany: the data protection authority of your federal state). To exercise your rights, write to [email protected].

9. Affiliate links and prices

Flaingo earns a commission when you book through links to our partners (for example Aviasales). Such links are marked as sponsored. The price you pay is the same. Prices shown on Flaingo are indicative and come from partner data that may be out of date; the partner shows the final price before you book.

10. AI assistant

The assistant is powered by an AI model. It can make mistakes, so always check the details with the partner before booking. The assistant does not make decisions about you that have legal effects or similarly significantly affect you.

11. Children

The site is not intended for people under 16. Please do not subscribe to offers if you are under 16 without a parent’s consent.

12. Changes

We may update this policy. The date of the latest update is shown at the top of the page.

13. Contact

Flaingo Konrad Zamirski, De Galerij 1 , 4261DG Wijk en Aalburg, Netherlands, [email protected].

14. Cookies and similar technologies

Flaingo uses only a few small files in your browser to remember your choices:

The embedded search form and the tracking script of our partner Aviasales (Travelpayouts) are loaded only after you accept optional cookies; they may set their own cookies and process your IP address, so please see their privacy policies. Google AdSense ads load only after you accept optional cookies and may process your IP address or use advertising identifiers under Google privacy policy. Links to offers go through a partner redirect that records the click for commission purposes. You can delete cookies in your browser settings or change your choice at any time with “Cookie settings” in the footer.