Privacy Policy

This policy covers the flyvalyzen Android and iOS apps and flyvalyzen.ai, operated by Valyzen, Inc. ("Valyzen," "we," "us," or "our"), together the "Service". The Service lets you search for and book flights and, where offered, hotel stays. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use it.

Valyzen, Inc. (United States) operates the Service and flyvalyzen.ai, hosts it on Amazon Web Services, and takes payments from US customers through Stripe. Bookings made in the India market (prices in INR) are handled by Valyzen Private Limited, Valyzen's affiliate in India: India customers pay Valyzen Private Limited through Razorpay, and Valyzen Private Limited issues those bookings with our India booking supplier.

By creating an account or using the Service, you agree to the practices described in this policy. If you do not agree, please do not use the Service. This policy should be read together with our Terms of Service and Cookie Policy.

1. Data We Collect

1.1 Information You Provide

• Account data — name, email address, and phone number when you register.
• Passkey / WebAuthn credentials — public-key credential identifiers if you choose to set up passkey sign-in.
• Traveller data — to make a booking we collect, for each traveller, full name, date of birth, gender, nationality, passport or identity document details, and contact details (email address and phone number). Where a fare or stay requires it, this can include a fare-eligibility document (for example a student ID) or, for hotel stays in India, a PAN. You can save travellers to your account for repeat bookings.
• Support correspondence — messages, attachments, and contact details you share when reaching out to us.

1.2 Data Generated Through Use

• Search history — routes, dates, cabin classes, and passenger counts you search for.
• Booking records — confirmed itineraries, PNR references, ticket numbers, fare rules, and change/cancellation history.
• Payment records — transaction amounts, currency, timestamps, and payment status. We never see or store full card numbers; payments are processed by Stripe or Razorpay (see Section 5).

1.3 Automatically Collected Data

• Device and browser information — IP address, browser type and version, operating system, device type, and screen resolution.
• Crash and diagnostic data — in the Android app, Firebase Crashlytics (Google) collects stack traces, device model/OS, app version and a per-install identifier when the app crashes or reports an error, with diagnostic context such as booking status and error codes. We do not put names, contact details, dates of birth, documents, tokens or card data in these reports.
• Usage data — pages visited, features used, clicks, session duration, and referring URLs.
• Cookies and similar technologies — see our Cookie Policy and Section 8 below for details.

2. How We Use Your Data

We process your personal data for the following purposes:

• Provide the Service — search for flights and hotel stays, create bookings, and manage changes or cancellations on your behalf.
• Authenticate your identity — verify your identity using a one-time code sent to your email (or a passkey, if enabled) and maintain session security.
• Process payments — take payment through Stripe or Razorpay, prevent fraud, and record transaction details for your reference.
• Communicate with you — send booking confirmations, itinerary updates, service announcements, and respond to support requests.
• Analyse and improve the Service — understand usage patterns, diagnose crashes and technical issues, and develop new features.
• Comply with legal obligations — retain records required by tax, accounting, or aviation regulations.

Legal Bases (GDPR)

Where the GDPR applies, we rely on the following legal bases:

• Contract performance — processing necessary to provide the Service you requested (searching, booking, payment, and passing traveller details to the airline or hotel).
• Legitimate interests — diagnosing crashes, preventing fraud, and ensuring platform security, where these interests are not overridden by your rights.
• Consent — analytics cookies and marketing communications, which you can withdraw at any time.
• Legal obligation — retaining booking and payment records as required by applicable law.

3. AI Processing and Automated Decisions

The prices you see are calculated by our pricing systems from the fares and rates our suppliers return. No booking is made without your explicit approval, or that of an AI agent you have authorised from your account.

Your right to explanation

You may ask for a meaningful explanation of how a price or recommendation shown to you was arrived at. Contact us at privacy@valyzen.com with the booking reference, and we will provide a clear summary of the factors involved.

4. Data Sharing

We do not sell your personal data. We share data only in the following circumstances:

Travel suppliers, airlines and hotels

• Our flight and hotel booking suppliers (and the airlines and hotels themselves) — receive each traveller's name, date of birth, gender, passport or identity document details, and contact details so the booking can be issued. These transfers are needed to fulfil the booking you asked us to make; the airline or hotel then handles that data under its own privacy policy.
• Valyzen Private Limited (Valyzen's affiliate in India) — India-market booking and payment data (including traveller and contact details and Razorpay payment records) is processed by and shared with Valyzen Private Limited so that it can take your payment and issue your India booking.

Payment processors

• Stripe (US card payments to Valyzen, Inc.) — you enter your card details and billing postal code in Stripe's payment sheet, so they go to Stripe, not to us. Stripe also collects device data for fraud prevention.
• Razorpay (India: UPI, cards and netbanking, paid to Valyzen Private Limited) — you enter your payment details in Razorpay's checkout. Razorpay also collects device and network information and your interactions within its checkout, for fraud prevention.

Service providers

• Google — Firebase Crashlytics receives crash and diagnostic data from the Android app (see Section 1.3). The Google Maps SDK, used for hotel maps in the Android app, receives device metadata, your IP address, a pseudonymous identifier, and your map interactions (such as panning and zooming). Google Analytics is used on the website only (see below).
• Amazon Web Services (AWS) (infrastructure) — hosts our application and databases in the US West (Oregon) region. AWS processes data under its Data Processing Addendum.
• Google Analytics (website analytics, flyvalyzen.ai only) — receives usage data only if you consent to analytics cookies. Google processes this data as a data processor under its data processing terms. The apps contain no analytics or advertising SDK.

Legal requirements

We may disclose your data if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Valyzen, our users, or the public.

Business transfers

If Valyzen is involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.

5. Payments

US customers pay Valyzen, Inc. through Stripe (cards). India customers pay Valyzen Private Limited through Razorpay (UPI, cards and netbanking). You enter your payment details directly in the processor's payment sheet or checkout. We never see or store full card numbers; saved cards are processor tokens, and we keep only the card brand, last four digits and expiry date so you can recognise them. Payment records stored in our system include the transaction amount, currency, timestamp, status and the processor's payment reference.

6. Data Retention

We retain your data only for as long as necessary to fulfil the purposes described in this policy or as required by law:

When you delete your account, your profile, saved travellers, documents and saved cards are deleted straight away; booking and payment records are kept for 7 years for financial and legal reasons, no longer linked to an account (see what we delete and keep). When data reaches the end of its retention period, it is securely deleted or anonymised so that it can no longer be associated with you.

7. Your Rights

Depending on your location, you may have some or all of the following rights regarding your personal data:

Under the GDPR (EEA/UK residents)

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — request deletion of your data, subject to legal retention requirements.
• Restriction — ask us to limit processing in certain circumstances (e.g., while we verify data accuracy).
• Portability — receive your data in a structured, commonly used, machine-readable format (JSON or CSV).
• Object — object to processing based on legitimate interests, including any profiling.
• Withdraw consent — where processing is based on consent (e.g., analytics cookies), you may withdraw it at any time without affecting the lawfulness of prior processing.
• Explanation of automated decisions — request meaningful information about the logic involved in automated decisions that affect you (see Section 3).
• Lodge a complaint — file a complaint with your local data protection supervisory authority.

Under the CCPA (California residents)

• Right to know — request the categories and specific pieces of personal information we have collected about you.
• Right to delete — request deletion of personal information we have collected, subject to legal exceptions.
• Right to opt out of sale — we do not sell personal information. No opt-out action is required.
• Right to non-discrimination — we will not discriminate against you for exercising any of these rights.

How to exercise your rights

To submit a data rights request, email privacy@valyzen.com with your full name and the email address associated with your account. We will verify your identity and respond within 30 days (GDPR) or 45 days (CCPA). You may also delete your account yourself in the flyvalyzen app (Account › Delete account). Our account deletion page explains how, and what we delete and keep.

8. Cookies and Tracking

We use cookies and similar technologies on the website (flyvalyzen.ai); the apps do not use cookies for analytics or advertising. For full details, see our Cookie Policy. A summary of cookie categories is provided below.

Analytics cookies (Google Analytics) are loaded only after you provide consent via our cookie banner. You can withdraw consent at any time by clearing your browser cookies or contacting us.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256).
• Passwordless authentication using one-time codes sent to your email, with optional support for passkeys (WebAuthn).
• Access controls and least-privilege IAM policies for all backend services.
• DynamoDB tenant isolation ensuring your data is logically separated from other users.
• Regular security reviews and dependency updates.

No method of transmission or storage is 100% secure. If you become aware of a security vulnerability, please contact us immediately at security@valyzen.com.

10. International Data Transfers

Our primary infrastructure is hosted on AWS in the United States (us-west-2, Oregon). If you are located outside the United States, your data will be transferred to and processed in the US. We ensure appropriate safeguards for international transfers through:

• Standard Contractual Clauses (SCCs) with our service providers, as approved by the European Commission.
• Data processing agreements with our third-party processors (AWS, Google, Stripe, Razorpay and our booking suppliers) that include transfer mechanism provisions.
• Supplementary technical measures (encryption, access controls, pseudonymisation) to protect your data regardless of where it is processed.

11. Children's Privacy

The Service is for adults (18+); you must be 18 or older to create an account (see our Terms of Service). We do not knowingly collect personal data from children who use the Service themselves. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at privacy@valyzen.com and we will promptly delete such data.

Traveller profiles may include minors entered by the account holder (for example, a parent or guardian booking for a child). This data is provided by the account holder and is used solely to complete their bookings.

12. Third-Party Links

The Service may contain links to third-party websites (e.g., airline websites, travel resources). We are not responsible for the privacy practices of those sites. We encourage you to review their privacy policies before providing any personal data.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last updated" date at the top of this page.
• Notify you by email or through a prominent notice on the Service at least 14 days before the changes take effect.
• Where required by law, obtain your consent before applying material changes to how we process your data.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Privacy inquiries: privacy@valyzen.com
• General support: support@flyvalyzen.ai
• Website: flyvalyzen.ai

We aim to respond to all privacy-related inquiries within 30 days.