Privacy Policy

This policy explains which personal data we process when you use the Valuaire app and the website valuaire.com, for which purposes, and what rights you have.

Controller

The controller is the provider named in the imprint. You can reach us using the contact details given there and through the support area in the app.

Data we process

Account data: name, email address, phone number, profile picture, language and currency, and for business users the company name and details of their approvals.

Usage data: requests, bookings, messages, reviews, saved items and the time of your last activity.

Record of consent: the time, document version and IP address recorded when you accept a contractual document. Without this record it would later be impossible to show which version you agreed to.

Device and error data: the token used to deliver push notifications, the app version and crash reports.

Location data: only if you grant permission, and only to show flights and providers near you.

Data of operators without an account: when a broker on Valuaire creates a listing for a flight of an operator who has no account, the broker gives us the company name, AOC number, country and a business contact address. We use them only to ask the operator whether they confirm the listing. When the confirmation link is opened, we store a hash of the IP address and the browser type to detect misuse.

Purposes and legal bases

We process data to perform our contract with you, as far as this is necessary for registration, brokerage, communication and fulfilment (Art. 6(1)(b) GDPR).

We process data on the basis of legitimate interests to keep the platform secure, detect abuse, fix errors and improve the service (Art. 6(1)(f) GDPR).

We process location data and send push notifications on the basis of your consent. You can withdraw either at any time in your device settings or in the app (Art. 6(1)(a) GDPR).

We process data to comply with legal obligations where retention or record-keeping duties apply (Art. 6(1)(c) GDPR).

We base the request to the operator on our legitimate interest, and that of the operator, in never offering flights without the operator's consent (Art. 6(1)(f) GDPR). You can object to further requests at any time using the link in each request.

Services we use

We use the following providers, acting either as processors or as controllers in their own right:

• Supabase: database, authentication, file storage and server functions
• Google: push notifications, usage and crash analytics, remote configuration, Sign in with Google, place search, wallet passes and subscription billing through Google Play
• Apple: Sign in with Apple, wallet passes and subscription billing through the App Store
• Resend: sending email
• Sentry: technical error reporting
• Mapbox: map rendering on Android devices
• Vercel: hosting of the website, including cookieless audience measurement

Transfers outside the EU

Our database is operated in Singapore. Several of the providers listed above process data in the United States. We rely on the European Commission standard contractual clauses for these transfers and, where applicable, on an adequacy decision. A level of protection equivalent to European standards cannot be guaranteed in every third country.

Retention

We keep account data for as long as your account exists. After you request deletion, the account is retained in a locked state for 30 days so that you can reverse the request. After that the data is deleted or anonymised. Records of consent and billing-relevant data are kept for as long as legal obligations or the defence of legal claims require.

We anonymise link and delivery data of confirmation requests 90 days after the request is closed. We delete or anonymise the contact address of an operator without an account 12 months after their last listing.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interests. You may withdraw any consent at any time with effect for the future.

In the app you can export your data yourself under Settings and request deletion of your account. You also have the right to lodge a complaint with a data protection supervisory authority.

Changes

We update this policy when our processing changes. The version in force is available with its date and version number in the app and on the website.