Privacy Policy
What personal data Great British Take Off collects, why we collect it, who we share it with, and the rights you have over it.
1. Who we are
Great British Take Off is operated by Ed Fry, a sole trader established in England and Wales, trading as Great British Take Off ("we", "us", "our"). We are the data controller for the personal data described in this policy.
Our trading address is Cotman Close, 19 Westleigh Avenue, London, SW15 6RG, United Kingdom.
For anything to do with your data — including exercising the rights in section 10 — email support@greatbritishtakeoff.com.
2. The short version
We collect what you tell us about your trips, what you give us when you create an account, and — only if you agree — how you use the product. We use it to run and improve the Service. We do not sell your data and we do not use it for advertising. We share it with the suppliers listed in section 6, and nowhere else.
The detail is below, including the parts most policies leave out: the automatic session we create before you sign up (section 3.1), and the AI providers your trip descriptions and screenshots pass through (section 5).
3. What we collect and why
3.1 Using the Service without an account
You can start using Great British Take Off before creating an account. When you do, we create an anonymous session for you so that your checklist and results can be saved and returned to you. This session is held in secure, HTTP-only cookies (sb-access-token and sb-refresh-token) and is identified only by a random identifier — it holds no name, email or contact detail.
If you later create an account, that session becomes your account and the trips you already created carry across.
Legal basis: performance of a contract — we cannot deliver a checklist or hold your results without it. These cookies are strictly necessary and are not covered by the analytics consent in section 4.
3.2 Account information
| Data | Why we hold it |
|---|---|
| Email address | To identify your account and contact you about the Service |
| Display name and avatar, where you provide one | To personalise the product |
| How you signed in (email or Google) | To route you back to the right sign-in method |
| Account creation date | Account administration |
If you sign in with Google, Google tells us your email address, name and profile picture. We never receive your Google password.
Legal basis: performance of a contract.
3.3 Trip and search data
| Data | Why we hold it |
|---|---|
| Trip parameters — origin, destination, dates, travellers, cabin class | To build your checklist and fetch your results |
| Results returned for your trip | To show them to you and let you return to them |
| Prices and notes you save, and links you open | To track your research and calculate savings |
| Timestamps | To label how fresh a result is |
Legal basis: performance of a contract.
We also use this data in anonymised, aggregated form to work out how the product performs overall — for example, average savings against a traveller's original search. Aggregated figures cannot identify you.
Legal basis for the aggregated use: legitimate interests — understanding and improving the Service.
3.4 What you send us
If you paste a trip description in your own words, or upload a screenshot of a flight search, we process what you send in order to read the trip details out of it. Section 5 explains how, and which suppliers are involved.
Please do not upload screenshots containing passport details, payment card numbers, booking references or anyone else's personal information. We do not need them, and a screenshot of a booking confirmation usually contains far more than the flight details we are trying to read.
Legal basis: performance of a contract.
3.5 Payment data
Payments are processed by Stripe. Your card details go directly to Stripe — we never see or store them. We keep:
| Data | Why we hold it |
|---|---|
| Stripe transaction and customer identifiers | To confirm payment, manage your subscription and process refunds |
| Amount, currency and date | Billing and accounting records |
| What the payment was for | To confirm delivery and handle refunds |
Legal basis: performance of a contract, and legal obligation for the accounting records.
3.6 Usage and analytics
We use PostHog to understand how the product is used, so we can find what is broken and what is working.
Until you consent, PostHog runs in a cookieless mode: it keeps nothing on your device between page loads and does not follow you across sessions. If you accept analytics cookies, it begins storing an identifier on your device and we collect:
| Data | Why we collect it |
|---|---|
| Pages viewed and features used | Understanding how the product is used |
| Actions taken and how far you get through a task | Finding where the product fails people |
| Session length and frequency | Product improvement |
| Device type, browser and operating system | Technical compatibility |
| Approximate location from IP address | Understanding where our users are |
Legal basis: consent. You can accept or decline when the banner appears, and change your mind at any time — see section 4.
3.7 Support and feedback
If you contact us by email, through the chat widget, or through the feedback widget, we keep that correspondence so we can answer you and improve the Service. We do not use support conversations for marketing.
Legal basis: legitimate interests — answering your questions and improving the Service.
3.8 Error reports
When something breaks, Sentry records the error along with technical context — the page, browser, and the identifier of the session it happened in — so we can fix it.
Legal basis: legitimate interests — keeping the Service working.
3.9 What we do not collect
We do not collect or store:
- Card numbers or any full payment details
- Passport, visa or travel document details
- Frequent flyer numbers or airline account credentials
- Special category data — health, ethnicity, religion, political opinions and the like
4. Cookies and similar storage
4.1 Strictly necessary
These keep the Service working and cannot be switched off.
| Name | Purpose | Duration |
|---|---|---|
sb-access-token | Keeps you signed in — see section 3.1 | Session (short-lived, refreshed) |
sb-refresh-token | Renews your session so you are not signed out mid-trip | Up to 30 days |
analytics_consent | Remembers whether you accepted or declined analytics | Until you clear your browser storage |
4.2 Analytics — only with your consent
| Name | Purpose | Duration |
|---|---|---|
ph_[project key]_posthog | PostHog session and user identification | 1 year |
Until you accept, PostHog stores nothing on your device. Accepting or declining is done through the banner on your first visit. To change your mind later, email us at support@greatbritishtakeoff.com and we will action it, or clear your browser storage for this site to be asked again.
4.3 Support and feedback widgets
Our chat and feedback widgets (Crisp and UserJot) set their own storage so a conversation you start survives a page reload. They load only inside the product — not on our marketing pages — and are there to support you while you are using it.
4.4 No advertising
We use no advertising, retargeting or cross-site tracking cookies, and we share nothing with advertising networks.
5. Automated processing and AI
Parts of the Service use AI models, always to interpret or organise information rather than to make decisions about you:
| What it does | What is sent |
|---|---|
| Reading a trip out of a description you typed | Your trip description |
| Reading flight details out of a screenshot you uploaded | The image you uploaded |
These requests are routed through OpenRouter, which passes them to the model best suited to the task. The models currently in use are provided by Mistral, OpenAI and Google. Requests are not sent with your name or email attached.
6. Who we share your data with
We share data only with the suppliers below, each acting as our processor under a contract that requires them to process it only on our instructions and to keep it secure.
| Supplier | What it does | Where it processes data |
|---|---|---|
| Railway | Application hosting | Netherlands (EU) |
| Supabase | Database and authentication | United Kingdom |
| Stripe | Payment processing | UK, EU and USA |
| PostHog Cloud EU | Product analytics | European Union |
| Sentry | Error monitoring | European Union |
| Brevo | Transactional email | European Union |
| Crisp | Support chat | European Union |
| UserJot | Feedback widget | USA |
| OpenRouter | Routing requests to AI models — see section 5 | USA |
| Sign in with Google - see Section 3.2 | USA |
Beyond these, we share your data only:
- Where the law requires it — a court order, or a request from a regulator or law enforcement we are obliged to meet
- If the business is sold or transferred — we will tell you before it happens, so you can delete your account first
We never sell your personal data, share it with advertisers, or pass it to airlines, travel agents or booking sites. When you follow a link out to a booking site, that site sees only what your browser tells it — the same as if you had typed its address yourself.
7. How long we keep it
| Data | How long |
|---|---|
| Account details | Until you delete your account |
| Trip and search data | Until you delete your account — see below for what survives |
| Payment and accounting records | 7 years, as tax law requires |
| Analytics events | Our analytics provider's default retention period |
| Error reports | 90 days |
| Support conversations | 2 years from your last contact |
What happens when you delete your account
Deletion is immediate and cannot be undone. When you delete your account:
- Your account, profile and sign-in details are deleted
- Trips where you saved nothing are deleted
- Usage records and AI request logs are deleted
- Trips where you saved prices are transferred to an internal archive — your account is removed from them, so what remains is route, date and price data no longer connected to you or your email. We keep this so the pricing history stays useful for our aggregate statistics
Payment records are kept for the 7 years tax law requires, regardless of deletion.
8. International transfers
We are based in the UK, and your account, trip data and analytics stay in the UK or EU. Some suppliers in section 6 process data in the USA. Where they do, we rely on the safeguards UK law requires for international transfers — typically the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK extension to the EU–US Data Privacy Framework where the supplier participates in it.
9. Security
We protect your data with:
- HTTPS across the entire Service, with a strict Content Security Policy
- Session tokens held in HTTP-only cookies, unreadable by scripts in your browser
- Row-level security in our database, so a request can only ever read rows belonging to the user making it
- No personal data stored in your browser's local storage
- Access to production data limited to those who need it
No system is perfectly secure. If you think your account has been compromised, email us straight away at support@greatbritishtakeoff.com.
10. Your rights
Under UK GDPR and the Data Protection Act 2018 you have the right to:
| Right | What it means |
|---|---|
| Access | Get a copy of the personal data we hold about you |
| Rectification | Have inaccurate data corrected |
| Erasure | Have your data deleted |
| Restriction | Limit how we use your data in certain circumstances |
| Portability | Receive your data in a machine-readable format |
| Object | Object to processing we base on legitimate interests |
| Withdraw consent | Turn off analytics at any time, without affecting anything we did while consent was active |
You can delete your account yourself, at any time, from your profile settings — you do not need to ask us.
For anything else, email support@greatbritishtakeoff.com. We will respond within one calendar month. We may ask you to confirm your identity first, so that we are not handing your data to someone else.
11. Complaints
If you are unhappy with how we have handled your data, please tell us first — email support@greatbritishtakeoff.com and we will try to put it right.
You also have the right to complain to the Information Commissioner's Office at any point:
Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF 0303 123 1113 ico.org.uk
12. Children
Great British Take Off is not intended for anyone under 18 and we do not knowingly collect data from under-18s. If you believe a child has created an account, tell us and we will delete it.
13. Changes to this policy
We may update this policy. Where a change materially affects how we use your data, we will tell you by email before it takes effect. The version and date at the top of this page tell you which version is in force.
14. Contact
Ed Fry, trading as Great British Take Off Cotman Close, 19 Westleigh Avenue, London, SW15 6RG, United Kingdom support@greatbritishtakeoff.com
This Privacy Policy should be read alongside our Terms of Service.