Comprehensive Privacy Policy
Last Updated & Effective: March 30, 2026
Welcome to the Avios Intelligence Project ("we," "us," or "our"). We are committed to protecting your personal data and respecting your privacy. This comprehensive policy explains how we collect, process, and safeguard your information when you use our website, the Yield Engine, the Tier Planner, our community features, and our newsletter.
1. Data Controller Information
Under the General Data Protection Regulation (GDPR) and applicable data protection laws, the data controller responsible for your personal information is:
- Organization: Avios Intelligence Project
- Address: 13 Stavrou Stylianidi, 3100 Limassol, Cyprus
- Data Protection Officer (DPO): dpo@aviosintelligence.com
2. Data Processing Overview Table
We believe in absolute transparency. The table below outlines exactly what data we collect, why we collect it, the legal basis under the GDPR, and how long we retain it.
| Data Category | Purpose of Processing | Legal Basis (GDPR) | Retention Period |
|---|---|---|---|
| User Account Data Username, Email, Password Hash |
To manage your blog comment profile, authenticate your identity, and secure the community platform. | Art. 6(1)(b) Contractual Necessity Art. 6(1)(f) Legitimate Interest |
5 years after last successful login. |
| Community Contributions Comments, Upvotes, Timestamps |
To display your contributions to the Avios Intelligence community and foster discussion. | Art. 6(1)(a) Consent Art. 6(1)(f) Legitimate Interest |
Until account deletion or manual comment removal by the user. |
| Newsletter Data Email Address, Opt-in IP, Engagement metrics |
To deliver arbitrage alerts, tier planning insights, and promotional partner offers (separate from accounts). | Art. 6(1)(a) Explicit Consent | Until you withdraw consent (unsubscribe). |
| Calculator & Tier Planner Data Flight Routes, Tier Status, Search Queries |
To calculate Cost Per Tier Point (CPTP) and generate status runs. Note: Math is primarily executed client-side. | Art. 6(1)(b) Contractual Necessity | Anonymized immediately. Server routing logs purged after 30 days. |
| Affiliate Tracking Data Click IDs, Partner Cookies, Booking attribution |
To attribute referrals to flight/hotel APIs and premium credit card partners for commission tracking. | Art. 6(1)(a) Consent (Cookie Banner) Art. 6(1)(f) Legitimate Interest |
Determined by partner (typically 30 to 90 days via cookie). |
| Technical Logs IP Address, User-Agent, Request URI |
To detect DDoS attacks, prevent fraud, and maintain the structural integrity of our Yield Engine. | Art. 6(1)(f) Legitimate Interest | 30 days, then automatically purged. |
3. The Yield Engine, Tier Planner & Your Privacy
Our core tools, the Yield Engine and the Tier Planner, are designed with a "privacy-first" architecture. We utilize advanced client-side Vanilla JS and the Haversine formula to perform complex distance-based earning calculations ("Partner Hacks") directly within your browser. This means that the majority of your route planning data requires zero server load and is never transmitted to or stored on our servers. When we do intercept live flight APIs to calculate real-time pricing, we transmit only anonymous routing parameters (e.g., LHR-JFK), never your personally identifiable information (PII).
4. Affiliate Monetization & Third-Party Cookies
Avios Intelligence is provided to users free of charge. To maintain our platform and continue developing arbitrage algorithms, we monetize our traffic through affiliate partnerships. When you click on outgoing links, specific tracking technologies are utilized:
- Flight API Partners: When booking through our integrated partners (such as Travelpayouts, Kiwi, or direct airline B2B links), a temporary tracking cookie is placed on your device to attribute the sale to Avios Intelligence.
- Accommodation Cross-Sells: Delayed floating hotel banners operate similarly, using third-party cookies to track high-intent referrals.
- Financial & Lifestyle Products: Links to premium credit card applications and lounge pass providers may also utilize referral tracking identifiers.
These partners act as independent data controllers once you land on their websites. We strongly advise you to review the privacy policies of our partners before completing any bookings or applications.
Book a Flight (Travelpayouts White Label): Our Book a Flight page embeds a live flight-search and booking widget technically operated by Travelpayouts Ltd, our travel-technology partner. Search details you enter there (origin, destination, dates, passenger count) are shared with Travelpayouts to return live fares. If you choose to proceed with a booking, you leave our systems and complete the purchase directly with the relevant airline, online travel agency, or other Travelpayouts partner brand shown in the results — that partner becomes the data controller for any personal and payment information you provide from that point on, and is solely responsible for the booking, payment processing, ticket issuance, changes, cancellations, and customer service. Avios Intelligence is not a party to that transaction and does not receive or store your payment details.
5. Data Sharing and Disclosure
We absolutely do not sell, rent, or trade your personal account or email data to third parties. We only share information under the following strictly defined circumstances:
- Service Providers: We use secure, EU-based hosting providers and email delivery services (for our newsletter) who process data strictly on our behalf under strict Data Processing Agreements (DPAs).
- Legal Obligation: If required by law, court order, or governmental authority in Cyprus or the EU.
- Business Transfers: In the event of a merger, acquisition, or asset sale of the Avios Intelligence Project.
6. Security Measures
We employ robust, industry-standard security measures to protect your data. This includes end-to-end SSL/TLS encryption, secure password hashing (Argon2/Bcrypt) for comment accounts, and strict firewall configurations to protect against unauthorized access or automated scraping of our hardcoded routing databases.
7. Your GDPR Rights
If you are a resident of the European Economic Area (EEA), you possess comprehensive rights over your personal data:
- The Right to Access: You can request a full export of all data associated with your account.
- The Right to Rectification: You can update your account details at any time via your profile settings.
- The Right to Erasure ("Right to be Forgotten"): You can request the permanent deletion of your account, comments, and newsletter subscription.
- The Right to Restrict Processing: You may ask us to suspend the processing of your data under certain circumstances.
- The Right to Data Portability: You can request your data in a structured, machine-readable format (JSON/CSV).
- The Right to Object: You can object to our processing of your data based on legitimate interests.
To exercise any of these rights, please contact dpo@aviosintelligence.com. We aim to fulfill all verified requests within 30 days. You also have the right to lodge a complaint with the Office of the Commissioner for Personal Data Protection in Cyprus.
8. Changes to this Policy
We may update this Privacy Policy periodically to reflect changes in our Yield Engine architecture, new affiliate partnerships, or evolving legal requirements. We will notify registered users of significant changes via email or a prominent notice on our website prior to the change becoming effective.