Legal

Privacy Policy

Last updated: August 9, 2026

Onflux (“we,” “us,” or “our”) provides itinerary software for travel agents. This Privacy Policy explains what data we collect, how we use it, and the rights you have over it. We are committed to handling your information responsibly and transparently.

What data we collect

  • Account information: your name and email address when you register.
  • Payment information: billing details processed securely by Stripe. We never store full card numbers on our servers.
  • Content you create: the itineraries, client details, and related materials you add to your account.
  • Usage data: basic technical and product-usage information such as pages visited and features used, to keep the service reliable and improve it.

How we use your data

  • Account management: to create and maintain your account and authenticate you.
  • Billing: to process subscription payments and send receipts.
  • Product improvement: to understand how the service is used and make it better.
  • Communication: to send service-related notices and, where permitted, product updates.

We do not sell your personal data

We do not sell your personal data to third parties, and we do not share it for cross-context behavioral advertising. We only share data with the service providers listed below as needed to operate Onflux.

Third-party services we use

We rely on a small number of trusted providers to deliver the service:

  • Supabase — authentication, database, and storage. See the Supabase Privacy Policy.
  • Stripe — payment processing. See the Stripe Privacy Policy.
  • Vercel — application hosting. See the Vercel Privacy Policy.
  • Resend — transactional email delivery. See the Resend Privacy Policy.
  • Anthropic — the AI models behind the assistant, AI import and Onflux Automations. Content you send to these features is processed by Anthropic to generate a response. Anthropic does not use business-tier API content to train its models. See the Anthropic Privacy Policy.
  • Google (Places & Maps) — venue lookup and maps. Destinations, venue names and addresses you enter are sent to Google to return place details. See the Google Privacy Policy.
  • AviationStack — flight status lookups. Flight numbers and dates you enter are sent to AviationStack. See the AviationStack Privacy Policy.
  • Open-Meteo — the weather forecast shown on itineraries and shared trip pages. The destination and travel dates are looked up by your browser, so Open-Meteo also receives your IP address. See the Open-Meteo terms.
  • CARTO — the map tiles behind the trip map, loaded directly by your browser, so CARTO also receives your IP address and the map area being viewed. Map data © OpenStreetMap contributors. See the CARTO Privacy Policy.
  • Upstash — rate limiting. Stores short-lived keys derived from your IP address or account id to prevent abuse. See the Upstash Privacy Policy.

A canonical, always-current list lives on our sub-processors page. We will update that page before adding a new sub-processor that handles personal data.

Analytics & session replay

We do not run product analytics or session replay. Onflux loads no analytics SDK, records no session replays, and sets no analytics cookies. We do not use Google Analytics, and we never track you across other websites or for advertising.

If we introduce product analytics in future we will update this policy before it is switched on, and any session replay we run will mask form inputs by default so that passport numbers, dates of birth and similar details are never captured.

Cookies

We use session cookies strictly for authentication — to keep you signed in and to secure your account. We set no analytics cookies, and we do not use third-party advertising or cross-site tracking cookies. You can clear cookies at any time; doing so signs you out.

Your rights

You may request access to, correction of, deletion of, or a portable export of your personal data at any time. To make a request, email privacy@onflux.co and we will respond within the timeframes required by applicable law.

California residents (CCPA/CPRA)

If you are a California resident, you have the right to:

  • Know what personal information we collect and how it is used.
  • Request deletion of your personal information.
  • Correct inaccurate personal information.
  • Opt out of the sale or sharing of personal information — note that we do not sell or share your data.
  • Not be discriminated against for exercising these rights.

EU and UK residents (GDPR)

If you are located in the EU or UK, you have the right to:

  • Access the personal data we hold about you.
  • Erasure (the “right to be forgotten”).
  • Data portability — receive your data in a machine-readable format.
  • Object to or restrict certain processing.
  • Lodge a complaint with your local supervisory authority.

Data retention

We retain your data for as long as your account is active. After you delete your account, we remove your personal data within 30 days, except where we are required to retain limited records to comply with legal or financial obligations.

Emails you forward to us

If you use Onflux Automations and set up a forwarding address, the emails you forward reach us so that we can prepare a draft for you to review. Those messages usually contain other people's personal information — your client's name, their contact details and their travel plans — so we keep them for the shortest time that still lets the feature work.

We delete the contents of a forwarded email, including any attachments, 30 days after we receive it. After that we keep only a short record that the email arrived — the date, the sender's address and the subject line — so that any draft it produced still shows where it came from. You can stop new emails reaching us at any time by removing your forwarding address in Onflux or the forwarding rule in your own mailbox; mail sent to a removed address is discarded rather than stored.

Inquiries sent through an advisor's link

Travel advisors who use Onflux Automations can publish an inquiry link. If you fill one in, the name, email address and message you send reach us so that we can prepare a draft reply for the advisor to review. The advisor is the person you are contacting; we handle your message on their behalf, and an AI assistant prepares the first draft of their reply. They read and approve every reply before it reaches you — nothing is sent automatically.

We delete the contents of an inquiry 30 days after we receive it.After that we keep only a short record that it arrived — the date and the sender's address — so that any draft it produced still shows where it came from. If you would like your message removed sooner, email privacy@onflux.co or ask the advisor.

DMCA designated agent

For copyright matters, Onflux maintains a designated agent. Notices and counter-notices may be sent to dmca@onflux.co. See our DMCA Policy for the full procedure.

Contact us

Questions about this policy or your data can be sent to privacy@onflux.co.