Privacy Policy

1. Who We Are

ElaraJet (trading name of BluFlo Solutions Ltd, company registration number 16412861) is the data controller responsible for your personal information. Our registered address is:

Henleaze House Business Centre
13 Harbury Road, Henleaze
Bristol BS9 4PN
United Kingdom

For data protection queries, contact us at: info@elarajet.com

2. Information We Collect

Information You Provide

• Contact details: Name, email address, phone number
• Flight preferences: Departure/arrival locations, dates, passenger count, special requests
• Account information: If you create an account, your login credentials and profile details
• Alert preferences: Saved search criteria for flight notifications

Information Collected Automatically

• Usage data: How you interact with our platform (via Google Analytics 4)
• Location searches: Geographic coordinates sent to Mapbox for location autocomplete
• Technical data: Browser type, device information, session data (via cookies)
• IP addresses: Temporarily collected for security purposes (rate limiting, fraud prevention). Stored in memory for 24 hours maximum, not persisted to permanent database storage.

We do not collect or store: Browsing history outside our platform or payment information.

3. Legal Basis for Processing (UK GDPR)

We process your personal data under the following lawful bases:

• Contract performance: To process flight availability requests you submit
• Legitimate interests: To improve our platform, prevent fraud, and ensure security
• Consent: For cookies (analytics and future marketing), email alerts, and marketing communications
• Legal obligation: To comply with UK laws and regulations

4. How We Use Your Information

• Process requests: Forward your details (name, email, phone, flight interest) to relevant aircraft operators
• Send confirmations: Email you when your request is submitted
• Flight alerts: Notify you when new flights match your saved search criteria (requires consent)
• Platform improvement: Analyze usage patterns via Google Analytics 4 (anonymized)
• Marketing: Send promotional emails about our services (requires separate consent, easy opt-out)
• Security: Detect and prevent fraud, abuse, and security incidents

5. Who We Share Your Information With

Aircraft Operators (Independent Data Controllers)

When you submit a flight availability request, we share your name, email, phone number, and flight interest details with the relevant operator. From that point, the operator becomes an independent data controller and handles your data under their own privacy policy. ElaraJet is not responsible for how operators process your information after receiving your inquiry.

Important: Operators may be located outside the UK/EU. By submitting a request, you consent to this international transfer.

Service Providers (Data Processors)

• Clerk: Authentication services for user accounts
• Supabase: Database hosting (EU servers, AWS London region) for inquiries and alerts
• Vercel: Website hosting (may use US servers with Standard Contractual Clauses)
• Postmark: Email delivery service
• Google Analytics 4: Anonymized usage analytics (no personally identifiable information shared)
• Mapbox: Location search functionality (coordinates sent for autocomplete)

Legal Disclosures

We may disclose your information if required by law, court order, or to protect our legal rights.

We do not sell your personal information to third parties.

6. International Data Transfers

Your data may be transferred to and processed in countries outside the UK/EU, including:

• United States: Vercel hosting, Google Analytics, Postmark (protected by Standard Contractual Clauses and UK GDPR adequacy provisions)
• Operator locations: Aircraft operators may be based anywhere globally

We ensure appropriate safeguards are in place where required by UK GDPR.

7. Cookies and Tracking Technologies

We use cookies to provide and improve our services. You can manage your cookie preferences via the cookie banner that appears on your first visit or by clicking “Cookie Settings” in the footer.

Cookie Categories:

• Strictly Necessary (no consent required): Session management, CSRF protection, cookie consent preferences
• Analytics (requires consent): Google Analytics 4 to understand how users interact with our platform (anonymized)
• Marketing (requires consent - future use): Google Ads remarketing and conversion tracking

Google Analytics 4: We use GA4 with anonymized tracking. No personally identifiable information (email, phone, name) is sent to Google. IP addresses are anonymized. Data retention: Event data 2 months, User data 14 months.

You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.

8. Data Retention

We retain your information for the following periods:

• Flight inquiries (with account): For as long as you have an active account
• Flight inquiries (without account): 1 year from submission, or 30 days if no account created
• Alert subscriptions: Until they expire or you cancel them
• Email records (Postmark): 45 days
• Analytics data (GA4): Event data 2 months, User data 14 months
• Account data: Until you delete your account, then immediately purged from all systems

After these periods, data is securely deleted unless required for legal compliance.

9. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right to access: Request a copy of your personal data
• Right to rectification: Correct inaccurate or incomplete data
• Right to erasure (“right to be forgotten”): Request deletion of your data
• Right to restrict processing: Limit how we use your data
• Right to data portability: Receive your data in a machine-readable format
• Right to object: Object to processing based on legitimate interests or for marketing
• Right to withdraw consent: Withdraw consent for cookies, alerts, or marketing at any time
• Right to lodge a complaint: Complain to the Information Commissioner’s Office (ICO) at ico.org.uk

To exercise these rights, email us at: info@elarajet.com

We will respond within 30 days (may extend to 60 days for complex requests).

10. Marketing Communications

Flight Alerts: When you create a flight alert, we will email you when new flights match your criteria. This requires your consent and is considered marketing under UK GDPR. You can unsubscribe or update preferences at any time via the link in alert emails or in your account settings.

Promotional Emails: We may send marketing emails about ElaraJet services and special offers. You can opt out at any time via the unsubscribe link in emails or by contacting us.

11. Data Security

We implement industry-standard security measures to protect your information:

• Encryption: Data encrypted in transit (HTTPS/TLS) and at rest
• Access controls: Two-factor authentication required for admin access to hosting and database management platforms
• Secure hosting: EU-based database servers and SOC 2 Type II compliant authentication service
• CSRF protection: Cross-site request forgery tokens on all forms

While we take security seriously, no system is completely secure. If we become aware of a data breach, we will notify affected users and the ICO within 72 hours as required by UK GDPR.

12. Children’s Privacy

Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe we have collected data from a child, contact us immediately at info@elarajet.com.

13. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal or similarly significant effects.

14. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. Material changes will be notified via email (if you have an account) or a prominent notice on our website. The “Last updated” date at the top indicates when changes were made.

15. Contact Us

For questions about this privacy policy or to exercise your data rights:

Email: info@elarajet.com
Postal Address: BluFlo Solutions Ltd (trading as ElaraJet), Henleaze House Business Centre, 13 Harbury Road, Henleaze, Bristol BS9 4PN, United Kingdom

Complaints: If you’re not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint