PRIVACY

Privacy Policy

Last updated: 24 September 2026

We collect what we need to send you fares. Nothing more. We do not sell your data. We do not share it with anyone who does not need it to run this service. This page tells you exactly what, why, and what you can do about it.

Who we are

Luxury Flight Club is operated by Skip van Schaik, registered in Amsterdam, the Netherlands. KvK 42020749. We are the data controller for everything we collect about you on this site and in our emails.

You can reach us at skip@luxuryflightclub.com.

What we collect

When you join the free list:

• Your email address.
• The countries you fly from and want to fly to (from the quiz).
• Your IP address (for fraud prevention and rough region detection).

When you become a Gold member:

• Everything above.
• Your payment details, handled by Stripe. We never see your card number.
• Your billing country.

When you use our website:

• Browser type, device, and screen size (standard web logs).
• Whether you opened our emails (via Kit, our email tool).
• If you allow analytics cookies: pages you visit and time spent (via PostHog).
• If you allow marketing cookies: whether one of our Facebook or Instagram adverts brought you here (via the Meta Pixel).
• If you allow error monitoring: faults and session replays when something breaks, so we can fix it (via Sentry).

In the EU, the EEA and the UK, the last three load only after you opt in. Elsewhere they are on until you turn them off. See Cookies below.

When you contact us:

• The contents of your email.
• Your name if you give it.

We do not collect anything you have not given us, and we do not buy data from third parties.

Why we collect it

• To send you fare alerts that match where you fly.
• To bill you for membership.
• To improve which deals we send (by seeing which fares get clicked).
• To answer your questions when you write to us.
• To keep our service secure (rate limiting, fraud detection).

That is all.

Who we share it with

We use a small set of third-party tools. Each one only sees what it needs.

• Stripe handles payments. They see your name, email, country, and card details. We never see card details ourselves.
• Kit (formerly ConvertKit) sends our emails. They see your email and your fare preferences.
• Supabase stores our database. They see everything we store, on EU servers.
• Vercel hosts our website. They see standard web traffic logs.
• PostHog measures how the site performs. They see anonymised usage events on EU servers. Loads only if you allow analytics cookies.
• Meta (Facebook) measures our advertising on Facebook and Instagram. Its Pixel sees the pages you view and events such as sign-up or purchase. When you sign up or start a membership, our server can also tell Meta, with a scrambled (hashed) copy of your email address, your IP address, your browser, Meta’s cookie identifiers and, for a membership, the amount paid, so Meta can match it to the ad you saw. This follows your marketing cookie setting, and for a new membership our server waits until you have clicked to allow marketing cookies.
• Sentry records faults and session replays so we can fix them. We mask email addresses before they reach it. Loads only if you allow error monitoring.
• Senja shows our member reviews on the reviews page. Its widget loads from Senja and can set cookies, so it runs only if you allow analytics or marketing cookies.

Each of these has its own privacy policy. We have signed Data Processing Agreements with all of them where required by law.

We never sell your data or your mailing list. We do share limited event data with Meta to measure our advertising, but only if you allow marketing cookies. In the EU, the EEA and the UK, every non-essential tracker (PostHog, the Meta Pixel, Sentry) stays off until you opt in.

Cookies

We sort cookies into four categories. Essential cookies keep the site working. The other three need your consent in the EU, the EEA and the UK.

In the EU, the EEA, and the UK, nothing non-essential runs until you choose, and we ask again six months after you said yes. Outside those regions we default to allowing them, and that default does not travel: when you are back in the EU, the EEA or the UK, we ask you. A no stays a no. Either way, you can change your mind at any time.

• Essential: sign-in, currency preference, and security. Always on. The law does not require consent for these.
• Analytics (PostHog): measures page views and conversion funnels so we can improve the site.
• Marketing (Meta Pixel): measures our advertising on Facebook and Instagram.
• Error monitoring (Sentry): records faults and session replays so we can fix them.
• Reviews widget (Senja): shows member reviews on the reviews page. Loads only if you allow analytics or marketing cookies.
• Stripe cookies: set by Stripe during checkout for fraud prevention. These are essential to taking a payment.

To review or change your choices, open Cookie settings here, or use the Cookie settings link in the footer of any page.

How long we keep your data

• Account email and preferences: as long as your account exists, plus 12 months after cancellation in case you come back.
• Payment records: seven years, because Dutch tax law requires it.
• Email engagement data: 24 months.
• Web analytics: 12 months, then anonymised.
• The details we keep to tell Meta about a new membership (your browser, IP address and Meta’s cookie identifiers): deleted as soon as they are sent, and within a day if the payment is not completed.
• Support emails: 24 months after the last reply.

You can ask us to delete your data sooner. See your rights below.

Your rights

Under the GDPR you can:

• See what we hold on you. Email us and we will send you a copy within 30 days.
• Correct anything wrong. Email us with the change.
• Have your data deleted. Email us and we will erase everything within 30 days, except records we are legally required to keep (like payment receipts).
• Take your data with you. We will export it in a machine-readable format.
• Object to certain uses. For example, you can object to analytics tracking.
• Withdraw consent at any time. Cancel emails by clicking unsubscribe; cancel cookies in the cookie settings.
• Complain to a regulator. In the Netherlands, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). In other EU countries, your local data protection authority.

You do not need to give a reason for any of these requests. We will not charge you and we will not call you back to ask why.

International transfers

Stripe is a US company. When you pay, your card details cross the Atlantic. Stripe is certified under the EU-US Data Privacy Framework, which gives you the same legal protections as you have in the EU.

Meta can process the advertising data described above in the United States. Meta is also certified under the EU-US Data Privacy Framework.

Our other vendors (Kit, Supabase, Vercel, PostHog) keep your data on EU servers wherever possible.

Children

Our service is for adults who pay for flights. We do not knowingly collect data from anyone under sixteen. If you believe a minor has given us their data, email us and we will delete it.

Changes to this policy

We will update this page when our practices change. The date at the top tells you when. If a change is significant we will email you before it takes effect, so you can decide whether to stay.

Contact

Questions about this policy, or about the data we hold on you, go to:

skip@luxuryflightclub.com

We answer within five working days. We do not have a dedicated Data Protection Officer because our scale does not legally require one.

This policy is written in plain English on purpose. If anything is unclear, ask us. We would rather rewrite a sentence than have you guessing what it means.