Privacy policy
Updated [date]. Seatdrop Ltd (company number [number], registered office [address]) is the controller of the personal data described here. Questions and requests: privacy@seatdrop.co.uk. We're registered with the Information Commissioner's Office, registration [number].
1. What we collect, and why. We collect only what the service needs.
1.1. Account: your email address, a first name if you give one, a password hash if you set one, and the date you joined. Needed to run your membership (contract).
1.2. Preferences: the airports you choose, who usually travels (just you, two, family) and which nation's school term dates to use, any term dates you enter, and the trips you tell us you'd love. Needed to choose and fit the drops we send you (contract).
1.3. WhatsApp: your phone number, only if you opt in to WhatsApp alerts (consent, which you can withdraw in settings).
1.4. Billing: your Stripe customer and subscription IDs, plan, trial and renewal dates. Stripe holds your card details; we never see the card number (contract, and our legal duty to keep accounting records).
1.5. Usage: which emails we sent you, whether they were opened or clicked, which drops you viewed, trips you tell us you booked and what you paid if you choose to say, and referral activity. Needed to run the free and Premium rules, the guarantee and the referral scheme, and to improve the drops (contract and our legitimate interest in running the service well).
1.6. Technical: IP address, browser and device type, and the pages you visit, collected by our hosting and analytics. See the cookie policy (legitimate interest in security and in understanding how the site is used).
1.7. Messages: anything you send through the contact form or by email (legitimate interest in answering you).
2. What we don't do. We don't sell your data. We don't share it with airlines or booking sites. We don't profile you for anyone else's advertising. We don't send marketing from other companies.
3. Who we share it with. Processors who act on our instructions under contract: Supabase (database and authentication), Stripe (payments), Resend (email), Meta (WhatsApp messages, only if you opt in), Lovable and our hosting provider (the website), Sentry (error logs), and our analytics provider. Some of these process data outside the UK; where they do, transfers rely on the UK International Data Transfer Agreement or an adequacy decision. We'll disclose data where the law requires it.
4. Affiliate links. When you follow a booking link from a drop, the airline or booking site may set its own cookies and may tell us that a booking was made and its value so that commission can be paid. They don't tell us who you are. Their privacy policies apply to what they collect.
5. How long we keep it. Your account data for as long as you're a member, then 12 months in case you come back, then deleted. Billing records for six years after the transaction, as HMRC requires. Email send logs for 12 months. Contact messages for 12 months after we last replied. Technical logs for 90 days. If you delete your account in settings, we delete everything except the billing records the law makes us keep.
6. Your rights. You can ask us to see the data we hold about you, to correct it, to delete it, to restrict or object to how we use it, and to give it to you in a portable file. You can withdraw consent for WhatsApp alerts at any time in settings or by replying STOP. Unsubscribe from marketing email with the link in any email. Email privacy@seatdrop.co.uk and we'll reply within one month. If you're unhappy with how we handle your data you can complain to the Information Commissioner's Office at ico.org.uk.
7. Security. Data is encrypted in transit and at rest with our processors, access is limited to the founder and the systems that need it, and passwords are stored as hashes. If a breach were to put you at risk we'd tell you and the ICO as the law requires.
8. Children. Seatdrop is for people aged 18 and over. We don't knowingly hold data about children; family settings record a party size and term dates, not children's details.
9. Changes. We'll post changes here and, for anything significant, email members.