1. Who we are

TripAndFly is a consumer service for searching live air fares, holding traveller details, paying, and receiving issued tickets. Sofia is the assistant through which those steps are taken. EmptyJet is another consumer service of the same company. TripAndFly is a branch of that same family of services. Both are operated by one legal person.

That person is EMPTYJET L.L.C-FZ, a limited liability company registered in the United Arab Emirates (Meydan Free Zone license no. 2653378.01, licensed 9 September 2026). The registered office is Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates. Further company information is published at emptyjet.com/about.

We are the data controller of personal data processed for TripAndFly. We are not a carrier, not an airline, and not a payment institution. An airline that issues a ticket, Telegram, Google, Apple, a card network, and a public blockchain each remain a controller of the data they process for their own services. This notice describes only what we do, and what we send to those parties so that a booking can be completed.

2. What this notice covers

This notice applies to personal data processed through the TripAndFly website and any web view of it; the TripAndFly Telegram bot and Telegram Mini App; conversations with Sofia; accounts, companion records, travel documents, orders, tickets and the wallet; card, cryptocurrency and balance payments; and the handling of a booking by our ticketing desk.

It does not govern EmptyJet’s other products, which have their own notice at emptyjet.com/policy. It does not govern an airline’s passenger record, Telegram’s messaging service, Google’s or Apple’s identity service, Stripe’s card processing, or a public blockchain, except to the extent we receive data from them or send data to them as described below.

To open an account we need a sign-in identity (Telegram, Google, Apple or an email address). To issue a ticket we need each passenger’s legal name, date of birth, sex, nationality and travel-document details, and a contact the airline can use. Those items are required to perform the contract. Without them we cannot complete the booking. A photograph, a voice note, Sofia’s memories, a companion list and a wallet are optional: the service still works, with more typing.

If you do not accept this notice, do not create an account and do not send us personal data. Some processing is necessary to provide the service. If you refuse it, we cannot search or issue tickets for you.

3. Controller and how to contact us

For TripAndFly, the controller is EMPTYJET L.L.C-FZ. Questions about this notice, and any request to exercise a data-protection right, should be sent to [email protected] or [email protected], or by post:

You may also use the secure request form at emptyjet.com/dsar. Concierge numbers published for EmptyJet (+44 790 777 0000 and +1 363 777 0000) reach an automated channel of the same company; they are not a substitute for a written request when you wish to exercise a statutory right.

We have not appointed a data protection officer. None is required for our present processing. Correspondence on privacy is handled by the company at the addresses above.

If you are in the European Economic Area, EMPTYJET L.L.C-FZ is the controller of your personal data. You can contact us about our processing at the email or postal address above.

4. Personal data we process

The categories below are those we actually process. We do not collect a category merely because it appears on a generic list. Fields that identify you are stored encrypted at rest, each field under its own key. A document number is also held as a blind index so we can find a record without storing the number in the clear.

Account and identity

The name you give us; primary and secondary telephone numbers; primary and secondary email addresses; Telegram user identifier and username; a Firebase subject identifier; the sign-in method (Google, Apple, email link, Telegram, or a legacy password hash if one still exists); language; the time and version of the legal terms you accepted; last sign-in time, channel and device description; and an approximate city and country derived from the sign-in IP address. The IP address itself is stored encrypted.

Travellers and travel documents

For you and for any companion you add: given names, surname, date of birth, sex, nationality, document type, document number, expiry, and a short label. The source of a page (typed, photographed, or copied from another record) is kept. A photograph of a passport or identity card is used only to extract those fields and is then discarded. We may keep a digest of the image and the extracted fields so a later upload can be recognised as the same page. We do not keep the pixels.

Conversations with Sofia

The text of messages you send and the replies written for you; a mark that a photograph or file was shown in that turn; and memories Sofia extracts so the next conversation does not start from nothing (preferences, people, places, routines, payment habits, dislikes, notes). Attachment bytes, voice recordings and chat photographs are not kept after the turn that used them.

Orders and tickets

The itinerary, cabin, party size, offer that was accepted, amounts, currency, payment path, order status, the ticketing-gateway identifiers, the passenger payload sent to issue the ticket, the passenger name record, ticket numbers, and fulfilment details. An unpaid quote is short-lived. An issued ticket is a lasting record.

Payments and wallet

Amounts, currency, status, and the processor’s reference for a card charge. For cryptocurrency: the deposit address we derived, the network, expected and received amounts, and transaction identifiers. For the wallet: ledger lines, top-ups, and purchases. Card numbers, card security codes and wallet seed phrases are never collected by us.

Technical and security data

Session identifiers, a CSRF token, cookie flags, approximate geolocation from IP, device and channel marks, rate-limit counters, and an append-only audit of account actions. We do not run advertising analytics, pixels or session-replay tools.

Quality records

An internal quality layer may review a conversation in order to correct Sofia. Stored quality reviews are separated from your account and are redacted. They are not written unless a separate store flag is on, which it is not in the ordinary configuration.

5. How we obtain personal data

Most of what we hold comes from you: what you type or dictate to Sofia, what you enter in the account and contacts panels, photographs you choose to send, and the payment path you select.

We also receive data from the party that authenticates you. Telegram supplies the user identifier, name, username and language tag, and, in the Mini App, a signed init payload. Google and Apple, through Firebase Authentication, supply a verified subject identifier and, where they release them, an email address, a telephone number and a display name. We verify the token against the issuer’s published keys. The Firebase session on the device is signed out after that exchange. We do not receive your Google or Apple password. An email sign-in link is sent by Firebase Authentication (Google) to the address you typed. We do not operate our own mail server for that message.

A payment processor tells us whether a charge succeeded, failed, or was refunded, and under what reference. A blockchain explorer tells us whether a watched deposit address received a transfer. The ticketing gateway returns offers, a booking identifier, a passenger name record and ticket numbers. A public IP-to-city lookup returns an approximate location for the sign-in activity line. Exchange-rate and coin-price services (exchangerate-api and CoinGecko) return public figures and do not receive your identity.

If you add a companion, you are the source of that person’s data. You must have the authority to give it to us. See section 11.

You may link a website account to a Telegram identity. That merge combines profiles, travellers, tickets and wallet balances into one surviving account. The absorbed account is marked merged; identity fields on that row are cleared; its ledger lines are kept so the seals remain verifiable. Codes used for the handshake are short-lived and are not a lasting category of data.

6. Purposes and legal bases

Where United Kingdom or EEA law applies, a legal basis is required for each purpose. The bases we rely on are these. “Contract” means Article 6(1)(b) of the UK GDPR and, where it applies, of the EU GDPR: the processing is necessary to provide the service you asked for, or to take steps at your request before a contract. “Legitimate interests” means Article 6(1)(f). “Legal obligation” means Article 6(1)(c). “Consent” means Article 6(1)(a). Where we rely on legitimate interests, we have balanced those interests against your rights. You may object; see section 17.

Creating and keeping an account; binding a web or Mini App session; linking a Telegram identity to a web identity

Contract. Abuse, session integrity and account-takeover prevention: legitimate interests.

Recording that you accepted the terms and this notice, and under which version

Legal obligation, and our legitimate interest in proving what was agreed.

Searching fares, holding a quote, collecting passenger details, taking payment, issuing a ticket, and showing you the ticket afterwards

Contract. Keeping issued-ticket and payment records after travel: legal obligation and legitimate interests (claims, accounting, airline and tax rules).

Conversations with Sofia, including reading a document photograph, transcribing a voice note, and reading a file you attach

Contract. The photograph, the recording and the file bytes are discarded after the turn. Extracted fields needed for a booking are kept as traveller data under the same basis.

Memories Sofia keeps so the next conversation can continue

Legitimate interests in running a personal secretary that does not forget a preference you already stated. You may erase them at any time from the account or with /forget. They are not required to issue a ticket.

Wallet balance, ledger, top-ups and purchases from balance

Contract. Retention of the ledger after a purchase: legal obligation and legitimate interests (accounting, the integrity of a sealed ledger, claims).

Card charges through Stripe; cryptocurrency deposits; watching a derived address on a public chain

Contract. Fraud prevention and reconciliation: legitimate interests. Statutory payment and tax records: legal obligation.

Security, rate limiting, audit, fraud review, and an approximate city from the sign-in IP

Legitimate interests in protecting accounts, the service, and other customers. We do not use the city for advertising.

Internal quality review of a conversation, where it occurs

Legitimate interests in correcting the assistant. Stored reviews are redacted and detached from your account.

Responding to a rights request, a regulator, a court, or a claim

Legal obligation, and legitimate interests in establishing, exercising or defending legal claims.

Language cookie and session cookie

Strictly necessary to deliver the service you asked for, in the language you chose. See section 12. No consent is required under PECR for these cookies.

We do not rely on consent for the core service. On the website, the sign-in panel states that continuing accepts the Terms and this notice; that record shows which version was shown. On Telegram, Sofia asks you to accept the Terms and this notice in the Mini App before she will continue; the Accept tap records which version was shown. Neither record is a substitute for the bases above, and neither is consent to marketing.

7. Travel documents and other sensitive information

A passport or national identity card is not, as a category, “special category data” under Article 9. It is nonetheless identity data of a kind that causes serious harm if it is mishandled. We treat it as such. Photographs are read in memory and discarded. Extracted fields are encrypted. Document numbers are shown to you only as a hint. Access on our side is limited to you and to the ticketing desk that has to issue the fare.

We do not use a photograph for biometric identification. We do not run facial recognition. Reading a page so that Sofia can fill a booking is not processing biometric data for the purpose of uniquely identifying a person within the meaning of Article 9.

Do not send health, religious, political, trade-union, sexual or genetic information unless a booking actually requires it (for example a remark an airline needs in order to accept the passenger). If you choose to send such information, we process it only to complete that request, on the basis of your explicit consent under Article 9(2)(a), and we do not use it for any other purpose. We do not seek this information and we do not build a profile from it.

Nationality is collected because a ticket and a border require it. We do not use nationality as a substitute for racial or ethnic origin, and we do not infer either.

8. Sofia, conversations and language-model processing

Sofia is an automated assistant. A message you send, and the context needed to answer it, is passed to language-model providers through a routing service (OpenRouter). Depending on the task, that context may include recent turns of the conversation, tool results, a photograph of a travel document, a chat photograph, an attached file, or a short voice recording for transcription. Providers used for those tasks include, as at the date of this notice, models operated by Anthropic, Google and OpenAI. The routing request identifies the product as TripAndFly. It does not send your account identifier as a header.

We instruct the routing provider not to use your content to train models. Residual technical logs those providers keep in order to operate the service and to prevent abuse are governed by their own terms, including OpenRouter’s privacy notice. We cannot give a stronger warranty than that instruction and those terms.

A document photograph is sent so the fields can be read. After the read, we discard the image on our systems. You may type the fields instead of sending a photograph. A voice note is transcribed and the audio is discarded. A file is read for the turn and the bytes are not stored.

Sofia may call a short web-research tool for public facts (border formalities, airport information). The query is a short extract of the question, not your account file. Results are cached for a few hours.

An internal quality layer (not shown as a second assistant) may read a conversation in order to correct Sofia. That review is not a decision about you. Stored training material, when it is stored at all, is redacted and is not tied to your account.

Conversation history is loaded up to a fixed number of recent turns so Sofia can continue. The full history remains until you erase it or the account is closed. Erasing memory from the account, or sending /forget on Telegram, deletes conversations, memories, quality notes attached to you, and cached search drafts. It does not delete the account, travellers, documents, orders, tickets, the wallet, audit entries, or issued-ticket records.

Sofia’s replies are generated by artificial intelligence. They are meant to help you search, compare and book. From time to time a reply may be incomplete, out of date, or incorrect — for example a fare that is no longer available, or a public fact that has changed. Treat what she says as assistance, not as a verified statement. Check anything that matters before you rely on it. How far you may rely on a reply, and our responsibility for it, is set out in the Terms of Service.

9. Payments, wallet and cryptocurrency

Card payments are taken by Stripe. Card numbers, expiry dates and security codes are entered in a Stripe frame or Stripe-hosted checkout. They do not touch our servers and we are not able to see them. Stripe processes that data under its own privacy notice. We receive a reference, an amount, a currency and a status. We store those, not the card.

Cryptocurrency deposits use watch-only extended public keys. We derive a deposit address for the invoice. We do not hold the corresponding private keys on the service. We query public chain data (through services such as TronGrid and Etherscan) to see whether that address received a transfer. A public blockchain is a public ledger. Addresses, amounts and transaction identifiers written to it cannot be erased by us or by you. That is a limit on the right to erasure; see section 17.

The wallet is an internal USD ledger. Top-ups and ticket purchases are sealed lines. The ledger of an absorbed account is kept after a merge so the seals remain verifiable. It is not a bank account and it is not e-money issued as a regulated product. It exists so you can pay a fare without repeating a card or chain transfer for every booking.

10. Search, booking and airline fulfilment

A search sends origin, destination, dates, cabin and passenger counts to an authorised inventory and ticketing gateway. Names are not required for a search. When you ask us to issue, we send the passenger payload the carrier requires: legal name, date of birth, sex, nationality, document details, and a contact the airline can use. The gateway returns a booking identifier, a passenger name record and ticket numbers. Those values are stored encrypted and shown to you on the tickets page.

Once a ticket is issued, the airline and any interline or handling carrier hold their own passenger record. Their processing is under their notices, not ours. We cannot delete a passenger name record from an airline’s system by erasing your account with us. A change or refund is a request to the carrier, made through us or otherwise, and is subject to the fare rules.

A live quote is held for a short window, ordinarily twenty minutes. An unpaid order’s adjustable window is twelve hours; after that it is marked expired when the account is next opened. The row stays for diagnostics and abuse review until we no longer need it, then it is deleted or anonymised.

11. Other people you tell us about

If you add a companion — a family member, a colleague, a child — you give us that person’s travel data. You must be entitled to do so: you have their agreement, or you hold parental responsibility or another lawful authority, and you will tell them that their data is held here under this notice.

We process a companion’s data to issue the ticket you asked for, on the same bases as section 6. We do not use it to market to that person. We do not create a separate login for them unless they themselves open an account. You may delete a companion from the contacts panel. An issued ticket that already names them stays on file.

A person whose data you have given us may write to us directly. We will take the steps in section 18, including verifying who is writing and, where we must, telling you that a request was made.

12. Cookies and similar technologies

We set two cookies of our own, and the browser may keep a small note on your device. We do not set advertising cookies. We do not use anyone else’s analytics cookie. Where UK or EU cookie rules apply, a cookie that is needed for the service you asked for does not need a prior yes. Both of ours are that kind.

If you ask for a sign-in link by email, the browser briefly remembers that address so the link can finish. After you sign in, that note is deleted. The home page may remember that you have already seen the pictures, so they do not download again. Neither is used to follow you.

If you block the sign-in cookie, you cannot stay signed in. If you block the language cookie, each visit will ask the browser again which language to use. That is the service without a saved preference, not a ‘less tracking’ mode: we do not track.

The page may ask the browser for the camera, so you can photograph a travel document, and for the microphone, so you can dictate a line to Sofia. Those are device permissions, not cookies. Refusing the camera means you type the fields. Refusing the microphone means you type, or you send a voice note on Telegram. We do not keep a live camera or microphone stream.

13. Recipients

We disclose personal data only as follows. We do not sell it. We do not share it for cross-context advertising.

Ticketing desk

Operators of EMPTYJET L.L.C-FZ who issue, correct or refund a booking, or who investigate abuse. A small number of them can open a conversation when that work requires it. Access is limited to what the task needs.

Inventory and ticketing gateway

The contracted gateway (TBO) that searches live fares and, when you confirm, transmits the passenger payload to the validating carrier.

The airline and any handling carrier

Legal name, contact and travel-document fields required to issue and to accept the passenger. After issue they are independent controllers of their passenger record.

Stripe

Amount, currency, order or top-up reference, and the technical data Stripe needs to take a card. Card data stays with Stripe.

Chain-data services

A deposit address, queried so we can see a transfer. We do not send your name to those services.

OpenRouter and language-model providers

Conversation context, and, when you send them, a document image, a chat image, a file or audio, solely to produce the reply or the extraction you asked for.

Telegram

Whatever you send in the bot or Mini App is processed by Telegram under Telegram’s privacy policy before it reaches us. We send replies and service notices back through Telegram.

Google and Apple

They remain controllers of your Google or Apple account. Their notices are at Google and Apple. We receive only what they release at sign-in.

Firebase Authentication

Used to verify a sign-in token. Google processes that verification as our provider.

IP geolocation lookup

The sign-in IP, sent to a public lookup (ip-api.com) so we can write an approximate city on the activity line. The lookup is cached for thirty days. It is not used for advertising.

Hosting, database and operations

Infrastructure we operate or contract, in which the encrypted records and session store are held. Processors act on our instructions under contract.

Professional advisers, insurers, authorities and courts

Where the law requires disclosure, or where we must establish, exercise or defend a claim.

A buyer of the company

If we transfer the business, personal data would move with it, on the same terms as this notice or a successor notice we will publish first.

14. International transfers

We are established in the United Arab Emirates. Providing the service means personal data is processed on our instructions in the United Arab Emirates and in other countries where our infrastructure or the recipients in section 13 sit. Our application, database and session store may run on contracted infrastructure in the United Arab Emirates, in the European Economic Area (including Finland), or elsewhere. The ticketing gateway we use is typically hosted outside the United Arab Emirates; at the date of this notice its systems (TBO) are in India. We do not represent that every copy of your data remains in the United Arab Emirates. Recipients in other countries include, among others, providers in the United States (Google, Apple, Stripe, OpenRouter and some model providers) and in the European Economic Area.

Where the EU or the UK does not treat the destination as adequate, we rely on the European Commission’s Standard Contractual Clauses or the UK International Data Transfer Agreement, together with the transfer risk assessment those instruments require, or on a specific exception in Article 49 (for example because the transfer is necessary to issue the ticket you asked for). A copy of the relevant clauses can be asked for at the addresses in section 3, with commercially sensitive passages redacted.

If you use the service from a jurisdiction that restricts export of personal data, understand that the service is provided from the United Arab Emirates and that your data will be processed there and in the countries of our recipients. If that is not acceptable, do not use the service.

15. How long we keep personal data

We keep personal data only as long as a purpose in section 6 requires, then we delete it or irreversibly anonymise it. The periods below are the ordinary ones. A legal hold, an unresolved claim, or a statutory duty may keep a specific record longer. We will not keep a category “just in case”.

Session

Fourteen days after last use, or immediately on sign-out.

Language cookie

Four hundred days, or until you change it.

Account profile

For the life of the account. After closure or a granted erasure request: deleted or anonymised, except the records listed below that the law or a claim still requires.

Conversations and Sofia’s memories

Until you erase them, or the account is closed. /forget and the account control erase them without closing the account.

Passport and identity-card photographs

Not retained. Discarded after the fields are read.

Extracted document fields and a digest of the image

While the document remains on the account, and thereafter only if an issued ticket still depends on that identity.

Companions you delete

Removed when you delete them, except where an issued ticket already names them.

Search cache, research cache, unpaid quotes

Search and research caches: hours. A live quote: ordinarily twenty minutes. An unpaid order’s window: twelve hours, then marked expired when next opened. The row is not deleted at that moment.

Issued tickets, passenger name records, fulfilment

For the journey and then for the period in which a contract claim, an airline dispute or a tax enquiry can still arise. That is ordinarily six years from the end of the relevant year, in line with ordinary commercial and tax practice.

Payments and wallet ledger

Six years from the transaction, in line with ordinary accounting and tax practice. A sealed ledger line on a merged account is kept so the seal can still be verified.

Audit and security logs

For the life of the account and, after closure, for as long as we still need them to investigate abuse or to defend a claim — ordinarily not more than six years.

IP geolocation cache

Thirty days.

On-chain data

Not under our control. A public chain keeps what was written to it.

Operational copies

The live database sits on a volume we operate. Redis persists sessions. We do not keep a separate long-term archive of deleted accounts. Host snapshots or replicas, if taken, may hold a deleted record for a short operational period after it leaves the live store.

16. Security

We encrypt identifying fields at rest, each under its own key, with a separate blind index where we must look a record up. Wallet lines are cryptographically sealed. Sessions are random identifiers bound with an HMAC, carried in an HttpOnly cookie; in production the cookie is Secure, SameSite=None and Partitioned. Mutations that use the cookie also need a synchroniser CSRF token. The document is served over HTTPS with a restrictive content-security policy. Card numbers never enter our systems.

Staff access to passenger and document fields is limited to the ticketing work. We do not claim that any system is immune to breach. If a personal-data breach is likely to result in a high risk to you, we will notify you as applicable law requires. Where the EU GDPR or the UK GDPR requires us to notify a supervisory authority, we do so without undue delay and, where that law requires it, not later than seventy-two hours after we become aware of it.

17. Your rights

Where the UK GDPR or the EU GDPR applies, you have the following rights. They are not absolute. We will say so, and why, if an exception applies.

Access

To be told whether we process your personal data and to receive a copy, together with the information this notice already gives.

Rectification

To have inaccurate data corrected and incomplete data completed. You can edit the account, travellers and documents yourself. An issued ticket is a record of what was sent to the airline; correcting the airline’s copy is a separate request.

Erasure

To ask us to delete personal data. We will delete conversations, memories, unused documents and the profile we no longer need. We will refuse, in whole or in part, where we must keep a record to issue or to evidence a ticket, to keep a sealed ledger verifiable, to meet a tax or accounting duty, to detect abuse, or to establish, exercise or defend a claim. We cannot erase what a public blockchain already holds. We cannot erase an airline’s own passenger record.

Restriction

To ask us to stop using data while a challenge to its accuracy or to our basis is resolved, except for storage and the uses the law still allows.

Portability

To receive the personal data you have given us, that we process by contract or consent, in a structured, commonly used and machine-readable form, and to have it sent to another controller where that is technically feasible.

Objection

To object to processing based on legitimate interests, including any profiling of that kind. We will stop unless we have compelling grounds that override your interests, or the processing is for a legal claim. There is no direct-marketing processing to object to; we do not do it.

Withdraw consent

Where we rely on consent (the rare case of special-category remarks you chose to send), you may withdraw it at any time. Withdrawal does not affect processing already completed, and it does not undo a ticket already issued.

Complaint

To complain to a supervisory authority. See section 24.

If you are in California or another United States state with a consumer privacy statute, we do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are defined in those statutes. We do not use or disclose sensitive personal information for purposes other than those the statute permits in order to provide the service. We do not treat a browser Do Not Track or Global Privacy Control signal as a separate switch: we do not sell or share for advertising, and we do not run advertising cookies. You may ask to know, to delete, and to correct, through the same channel as section 18. We will not discriminate against you for exercising a right.

If you are in Brazil, you have the rights in the Lei Geral de Proteção de Dados, including confirmation of processing, access, correction, anonymisation, portability, information about sharing, and revocation of consent. If you are in Russia, Switzerland, Japan, Korea, Indonesia or another jurisdiction with its own statute, we will honour the rights that statute gives you in respect of this service, through the same channel. That is not a claim that we are registered as a local operator in every such country.

18. How to exercise your rights

Write to [email protected] or [email protected], or use emptyjet.com/dsar, or write to the registered office in section 3. Say which right you wish to exercise and which account it concerns.

We will need to verify that the request comes from you, or from a person who is entitled to act for you. We may ask for information that only the account holder would have. We will not fulfil a request we cannot authenticate. A third party who writes with a mandate must send the mandate.

We will answer without undue delay and in any event within one month of receipt of an authenticated request. We may extend that by two further months where the request is complex or numerous; if we do, we will say so within the first month. We do not charge a fee unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse.

Some steps you can take without writing to us. You can edit the account and the contacts. You can delete a companion or a document you no longer need. You can erase Sofia’s memory from the account or by sending /forget on Telegram. You can sign out, which destroys the session cookie. Those controls do not replace a statutory request, and they do not delete issued tickets or the ledger.

There is no button in the product that closes the account or downloads a machine-readable copy of your data. Access, portability and erasure of the account are exercised by writing to us as set out above. /forget and the account control only erase Sofia’s memory. They do not close the account.

19. Children

TripAndFly is a contracting service for persons aged 18 or over. We do not knowingly open an account for a child. We do not verify age when an account is opened: the eighteen-year rule is a condition of use, not an identity check. If you are under 18, do not open an account. If we learn that an account belongs to a person under 18, we will close it and delete what we can, subject to section 15.

A person aged 18 or over may add a child as a travelling companion where they have parental responsibility or another lawful authority to do so. That child’s travel-document data is processed only to issue the ticket. We do not use it to market to the child or to build a profile of the child beyond the booking. That data comes from the adult who added the child, not from the child.

20. Automated processing and profiling

Sofia searches fares, reads documents, drafts replies and remembers preferences. That is automated processing. It is not a solely automated decision that produces legal or similarly significant effects within the meaning of Article 22. A ticket is issued only after you confirm the passengers and the payment. A fare that cannot be taken is a fact about inventory, not a decision we take about you.

Memories are a limited profile of travel preferences, so the next conversation can continue. They are not a credit score, not a risk score, and not a means of barring you from the service. You may erase them at any time. Blocking an account for abuse is a human decision of the operator, recorded on the account.

21. Marketing and sale of data

We do not send promotional email, promotional SMS, or promotional push notifications. We do not operate a newsletter. Service messages about an order, a payment, a wallet credit, or a security event are not marketing. They are sent because the contract requires them, usually through Telegram if that is how you reached us.

We do not sell personal data. We do not share it with third parties for their own marketing. We do not use advertising pixels, lookalike audiences, or a data broker. If that ever changes, this notice will change first, and where the law requires consent we will ask for it before any such use.

22. Independent platforms

Telegram, Google, Apple, Stripe, language-model providers, airlines, and public blockchains are not our subprocessors when they act for their own purposes. Each has its own notice. What you store in a Telegram chat, a Google account, an Apple ID, a card issuer’s records, or a chain is outside this notice except for the slice we receive or send as described above.

If you open TripAndFly inside Telegram, Telegram can see that you opened it. Production cookies are Partitioned so the session belongs to that frame. Signing out of TripAndFly does not sign you out of Telegram.

23. Changes to this notice

We will change this notice when the processing changes, or when the law requires a clearer statement. The date at the head of the page is the date of the current text. A material change is given a new version stamp. At sign-in we record the version that was current then. There is no in-product prompt that asks you to accept a later version. The current text is always the one on this page.

Continuing to use the service after a published change is how that updated notice applies to processing that continues. If a change requires a new consent, we will not start that processing until we have it. We have not built a re-acceptance screen for a later version of this notice.

24. Complaints

Please write to us first at the addresses in section 3. We will take the complaint seriously and answer it.

If you are in the United Kingdom, you have the right to complain to the Information Commissioner’s Office, whether or not you have written to us. The ICO is at ico.org.uk. A complaint can be made at ico.org.uk/make-a-complaint.

If you are in the European Economic Area, you may complain to your local supervisory authority, in particular in the member state of your habitual residence, your place of work, or the place of the alleged infringement.

Nothing in this notice limits a right you have to bring proceedings in a competent court.

25. Status of this notice

This notice is a statement of our processing, given to meet Articles 13 and 14 of the EU GDPR and of the UK GDPR where they apply. It is not itself a contract. The Terms of Service are the contract for using the service. On the website, continuing from the sign-in panel accepts those terms and this notice. On Telegram, accepting in the Mini App does the same, and we record the version then. If the terms and this notice conflict on a privacy question, this notice prevails for that question; on every other question the terms prevail.

The notice is published in several languages so that you can read it. The English text is the original. The other languages are translations. If a translation differs from the English text, the English text prevails, except where a mandatory law of your country requires that the translation shown to you is binding.

TripAndFly is provided by EMPTYJET L.L.C-FZ. It is a service of the same company as EmptyJet. Using TripAndFly is not using a different controller. EmptyJet’s other properties remain under their own notices.