Privacy Policy

1. Information you provide

For a Watch request, Seyrio currently asks for:

• your email address;
• the outbound origin airport;
• the destination airport; and
• exact departure and return dates (a return date is not required for a one-way Watch);
• trip type and the search parameters attached to the request, including passenger count, cabin, stop policy, market and currency. The current public form uses one adult in Economy.

2. Technical and security information

We retain request identifiers, verification and authorization timestamps, token hashes, Watch status and notification/delivery records. We also collect observed fares and build a price history for the exact search. These records can be personal information when linked to a request or owner. Price observations do not contain your email address, but links between an observation and your Watch are private personal information.

A verified Watch may receive a short Watch Code that identifies it when you add it to another device. The code alone does not provide read access: adding a Watch requires its code together with the verified owner email. Keep these details private. Device access is limited to that Watch and is subject to expiry and revocation. The server stores a derived hash of the device authorization credential rather than the plaintext credential.

When you add a Watch, the mobile app creates device authorization material and uses the device’s secure storage for Watch access credentials, saved trip information and temporary import or recovery state, which can include the email you submit during import.

Hosting, network and security infrastructure may process standard technical details such as IP address, request path, browser or user-agent information, timestamps and diagnostic or security logs. The current Watch form does not use IP address as the identity of a Watch owner.

3. How information is used

We need your email and exact trip details to provide the Watch you request. You are not legally required to provide them, but we cannot provide a Watch without them. We use this information to take steps at your request and perform the Watch service contract.

We use limited security and diagnostic records for our legitimate interests in preventing abuse, protecting exact-request authorization and keeping the service reliable. These controls protect users against unauthorized Watches and misuse of email delivery. We also process information where necessary to meet applicable legal duties, such as handling data-protection requests.

• receive, validate and manage an exact Watch request;
• confirm authority for the exact request through its email link;
• send transactional messages about that request;
• operate, secure and diagnose the service; and
• prevent abuse and protect record integrity.

4. Verification and communications

Verification links are single-purpose, time-limited and designed to prevent trivial replay. Seyrio stores a derived hash of a verification token rather than the plaintext token. A verification link currently expires after 24 hours.

After successful email verification and route qualification, a new eligible Mobile Watch can activate for 24 hours of free monitoring. Watch email is used for verification, the first observed price and Watch-started message, meaningful price-change notifications and relevant Watch lifecycle or outcome messages, not for marketing newsletters.

5. Optional Watch notifications

In the mobile app, Push notifications are optional and enabled separately for each Watch. If you enable them, we process the device or Push endpoint information needed to deliver notifications for that Watch. Push delivery depends on device settings and notification services, so we cannot promise immediate delivery.

Disabling Push for a Watch stops future Push delivery for that Watch. Email updates are independent of Push. Delivery and security records may remain where reasonably necessary after Push is disabled.

Paid monitoring and payment location

When you choose paid Web monitoring, Stripe processes the payment and collects billing-address information in its hosted Checkout. Seyrio processes payment references, the declared billing country, the card issuing country supplied by Stripe and a bounded eligibility decision to administer the UK-only paid service and support payment reconciliation, security, disputes and applicable legal obligations.

Seyrio does not copy the full billing address or card details into Watch records. Detailed payment and billing-address evidence remains with Stripe. Country evidence is used for paid eligibility, not inferred from your flight route, fare currency, browser locale or IP address. The existing retention criteria and privacy-rights contact below also apply to these payment records.

6. Service providers and sharing

Seyrio uses service providers that support the current Watch architecture:

• Vercel for application hosting, runtime infrastructure and website usage analytics;
• Supabase for private Watch and operational database records; older installed app versions may also use Supabase for legacy account features and optional product analytics;
• Resend for verification and transactional Watch email delivery;
• Stripe for hosted Checkout and payment processing when paid monitoring is offered;
• FlightAPI for the route, date and search dimensions needed to obtain flight observations; and
• Expo and device-platform notification services for optional mobile Push delivery.

7. Sale and disclosure

Seyrio does not sell Watch personal information. Information may be disclosed to the providers above as needed to operate the service, or where disclosure is required to comply with law, protect the service or address security and abuse.

Under the current design, the Watch email address is not part of a flight-data provider request.

8. Retention

Verification links are valid for 24 hours. A qualifying new free Mobile Watch monitors for 24 hours after activation. These periods describe verification and monitoring, not when related information is deleted.

Different information is kept for different periods, only as long as reasonably necessary to provide and support Flight Watch, maintain delivery integrity, protect security, prevent abuse, troubleshoot problems, handle disputes and meet applicable legal obligations. We consider the purpose, sensitivity and legal requirements when deciding how long to keep it. Monitoring expiry, removal of device access or disabling Push does not automatically delete Watch, observation, authorization, delivery or security records.

9. Your choices and rights

Under UK data protection law, you may ask for access, correction, erasure or restriction of your personal information. You may also have a right to portability for information you provide that is processed automatically on the basis of consent or contract. Rights depend on the processing and applicable exceptions. There is no in-app Delete Watch feature. Where account deletion is available in an older installed version, deleting that legacy Seyrio account does not automatically erase an independently created Flight Watch or remove its device access.

You can object to processing based on legitimate interests, on grounds relating to your situation. To request access, correction, deletion or another applicable right, or to raise a privacy question, contact communication@seyrio.com. Specify when your request concerns an independent Flight Watch. We may ask for sufficient information to verify your authority over that Watch before acting. Do not send device authorization credentials by email.

Complaints

You can complain to the Information Commissioner’s Office (ICO), the UK data-protection regulator, including if you are dissatisfied with our response. See how to complain to the ICO.

Website analytics and browser information

The main website includes Vercel Web Analytics to measure website usage. Vercel describes this as cookieless analytics using a short-lived request-derived visitor hash, with visitor sessions discarded after 24 hours. Analytics may include page URLs, referrers, filtered query parameters, approximate location and browser/device information. That session lifetime is not a deletion deadline for all analytics records.

The dedicated email-confirmation document does not load website analytics. Its exact-request token is read from the URL fragment and removed from the address bar before confirmation. The Watch interface does not use browser local storage or cookies to create a reusable owner login.

For questions about website analytics or to raise an objection, contact communication@seyrio.com.

Older app versions and optional analytics

The current Flight Watch mobile app does not include legacy account-based travel-guide features, signed-in product analytics or a Profile analytics preference. Some older installed versions still include these features and may communicate with the historical account backend. That backend has not been retired. In those older versions, optional signed-in product analytics is collected only after you allow it and can include your account identifier, app version and device platform, screens viewed and interactions with app features. Where available in an older version, its Profile analytics preference lets you change or withdraw your choice. Withdrawal stops future optional collection and clears queued events; it cannot retract an event already received. Essential account, Watch, delivery and security processing is separate from optional analytics.

10. International transfers

Some service providers may process personal information outside the United Kingdom. Where required, we use appropriate safeguards for international transfers in accordance with applicable data-protection law. Contact us if you would like more information about a transfer that affects your information.

11. Children

The Watch form does not ask for age, and Seyrio has not adopted a separate minimum-age rule for this service. Do not submit another person’s email address or travel request unless you are authorised to do so. Contact us if personal information was submitted without appropriate authority.

12. Changes and contact

We may update this policy as the Watch service or its data practices change. The effective date at the top identifies the current version. Questions about this policy may be sent to communication@seyrio.com.