Privacy Policy
Last updated: September 15, 2026
Takeoff ("we", "us", "our") is committed to protecting your privacy. This policy explains how we collect, use, and protect your personal data when you use our surf flight deals newsletter service.
Data Controller: Matthieu Baillargé (Auto-entrepreneur, SIRET: 83235434400018), Biarritz, France
Contact: [email protected]
1. Information We Collect
Information You Provide
| Data | When Collected | Purpose |
|---|---|---|
| Email address | Signup | Send newsletters, manage your account |
| Origin location (country, city, airports) | Onboarding | Match you with relevant flight deals |
| Payment information | Premium upgrade | Process subscription payments (via Stripe) |
Information Collected Automatically
| Data | How Collected | Purpose |
|---|---|---|
| IP address | Server logs | Security, spam prevention |
| Browser type, device | Analytics | Improve user experience |
| Pages visited | Analytics | Understand usage patterns |
| Email engagement (opens, clicks) | Tracking pixel, link redirects | Measure engagement, improve content |
What We Do Not Collect
- Passport or travel document information
- Precise GPS location
- Social media profiles (unless you sign in with Google)
2. Legal Basis for Processing (GDPR)
We process your personal data based on:
| Legal Basis | Examples |
|---|---|
| Contract | Sending you flight deal emails (the service you signed up for), processing payments |
| Consent | Marketing emails beyond the core service, optional features |
| Legitimate Interest | Improving our service, preventing fraud, basic analytics |
| Legal Obligation | Keeping payment records for tax purposes |
You can withdraw consent at any time (see Section 6).
3. How We Use Your Information
We use your data to:
- Deliver the service - Send flight deal alerts matching your origin airports
- Process payments - Handle Premium subscription billing via Stripe
- Improve the service - Analyze which deals perform well, fix bugs
- Communicate with you - Respond to support requests, send account notifications
- Prevent abuse - Detect spam signups, protect our systems
We do not:
- Sell your personal data to third parties
- Share your email with advertisers
- Use your data for unrelated purposes
4. Third-Party Services
We use the following services to operate Takeoff:
| Service | Purpose | Data Shared |
|---|---|---|
| Supabase | Database, authentication | Email, account data |
| Stripe | Payment processing | Payment details, email |
| Resend | Email delivery, engagement tracking | Email address, open/click events |
| Cloudflare | Spam protection (Turnstile) | IP address, browser data |
| Vercel | Website hosting | Server logs |
| OAuth sign-in (optional) | Email, name |
These services process data on our behalf as data processors. We do not share your data with any other third parties except as required by law.
5. Cookies
We use minimal cookies:
| Cookie | Purpose | Duration |
|---|---|---|
| Authentication | Keep you logged in | Session |
| Preferences | Remember your settings | 1 year |
We do not use:
- Third-party advertising cookies
- Cross-site tracking
- Retargeting pixels
You can manage cookies in your browser settings.
6. Your Rights (GDPR)
Under GDPR, you have the right to:
| Right | Description |
|---|---|
| Access | Request a copy of your personal data |
| Rectification | Correct inaccurate data |
| Erasure | Request deletion of your data ("right to be forgotten") |
| Restriction | Limit how we use your data |
| Portability | Receive your data in a machine-readable format |
| Objection | Object to processing based on legitimate interest |
| Withdraw Consent | Withdraw consent at any time (does not affect prior processing) |
How to Exercise Your Rights
Email us at [email protected] with your request. We will respond within 30 days.
Account Deletion
To delete your account:
- Log in and go to Account Settings
- Click "Delete Account"
Or email [email protected] with the subject "Delete My Account".
Complaints
If you are not satisfied with how we handle your data, you have the right to lodge a complaint with your local data protection authority. In France, this is the CNIL: cnil.fr
7. Email Communications
What We Send
| Email Type | Frequency | Can Unsubscribe? |
|---|---|---|
| Flight deal newsletters | Daily (when deals available) | Yes |
| Welcome email | Once, at signup | N/A |
| Account notifications | As needed (password reset, billing) | No (transactional) |
How to Unsubscribe
Every newsletter contains an unsubscribe link. Click it to stop receiving deal alerts immediately.
Unsubscribing from newsletters does not delete your account. See Section 6 for account deletion.
Email Tracking
To improve our newsletters, we track whether emails are opened and which links are clicked. This data is tied to your email address and helps us understand which deals interest you most.
If you prefer not to be tracked, most email clients allow you to disable image loading, which prevents open tracking.
8. Data Retention
| Data Type | Retention Period |
|---|---|
| Active account data | Until you delete your account |
| Inactive accounts | 2 years after last activity, then deleted |
| Payment records | 7 years (legal requirement in France) |
| Server logs | 90 days |
When we no longer need your data, we delete or anonymize it.
9. Data Security
We protect your data through:
- Encryption - All data transmitted over HTTPS (TLS 1.3)
- Secure authentication - Magic links and OAuth (no passwords stored)
- Access controls - Limited access to production data
- Secure infrastructure - Hosted on Vercel (SOC 2) and Supabase (SOC 2)
No system is 100% secure. If you discover a security vulnerability, please report it to [email protected].
10. International Data Transfers
Your data may be transferred to and stored in:
- United States (Vercel, Stripe, Resend)
- European Union (Supabase)
For transfers outside the EU, we rely on:
- Standard Contractual Clauses (SCCs)
- Adequacy decisions where applicable
11. Children's Privacy
Takeoff is not intended for children under 18. We do not knowingly collect personal data from minors. If you believe a child has provided us with personal data, please contact us at [email protected].
12. Changes to This Policy
We may update this policy from time to time. We will notify you of significant changes by:
- Posting a notice on our website
- Sending an email to active subscribers
The "Last updated" date at the top indicates when the policy was last revised.
13. Contact Us
For privacy-related questions or requests:
Email: [email protected]
Data Controller:
Matthieu Baillargé
Auto-entrepreneur, SIRET: 83235434400018
Biarritz, France
This policy is designed to be clear and readable. If anything is unclear, please reach out.
See also: Terms of Service | Contact Us