Privacy Policy

Onflux (“we,” “us,” or “our”) provides itinerary software for travel agents. This Privacy Policy explains what data we collect, how we use it, and the rights you have over it. We are committed to handling your information responsibly and transparently.

What data we collect

• Account information: your name and email address when you register.
• Payment information: billing details processed securely by Stripe. We never store full card numbers on our servers.
• Content you create: the itineraries, client details, and related materials you add to your account.
• Usage data: basic technical and product-usage information such as pages visited and features used, to keep the service reliable and improve it.

How we use your data

• Account management: to create and maintain your account and authenticate you.
• Billing: to process subscription payments and send receipts.
• Product improvement: to understand how the service is used and make it better.
• Communication: to send service-related notices and, where permitted, product updates.

We do not sell your personal data

We do not sell your personal data to third parties, and we do not share it for cross-context behavioral advertising. We only share data with the service providers listed below as needed to operate Onflux.

Third-party services we use

We rely on a small number of trusted providers to deliver the service:

• Supabase — authentication, database, and storage. See the Supabase Privacy Policy.
• Stripe — payment processing. See the Stripe Privacy Policy.
• Vercel — application hosting. See the Vercel Privacy Policy.
• Resend — transactional email delivery. See the Resend Privacy Policy.
• PostHog — privacy-focused product analytics and session replay, used only to operate and improve Onflux (never for advertising). See the PostHog Privacy Policy.

Analytics & session replay

We use PostHog, a privacy-focused analytics platform, to understand how the service is used and to improve it — never for advertising, and we do not use Google Analytics. We measure product events (for example, creating an itinerary or exporting a PDF) and we record anonymized session replays of how the app is used.

We mask sensitive information in session replays by default.All form inputs are masked, and fields that may contain passport numbers, dates of birth, or similar personal details are not captured in recordings. We honor your browser’s “Do Not Track” setting: if it is enabled, we do not load analytics or session replay for you. Analytics is never loaded in our development environment.

Cookies

We use session cookies strictly for authentication — to keep you signed in and to secure your account. We also use first-party analytics cookies set by PostHog to recognize a returning session for product analytics; these are not used for advertising, and we do not use third-party advertising or cross-site tracking cookies. You can opt out by enabling “Do Not Track” in your browser or by clearing cookies.

Your rights

You may request access to, correction of, deletion of, or a portable export of your personal data at any time. To make a request, email privacy@onflux.co and we will respond within the timeframes required by applicable law.

California residents (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know what personal information we collect and how it is used.
• Request deletion of your personal information.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of personal information — note that we do not sell or share your data.
• Not be discriminated against for exercising these rights.

EU and UK residents (GDPR)

If you are located in the EU or UK, you have the right to:

• Access the personal data we hold about you.
• Erasure (the “right to be forgotten”).
• Data portability — receive your data in a machine-readable format.
• Object to or restrict certain processing.
• Lodge a complaint with your local supervisory authority.

Data retention

We retain your data for as long as your account is active. After you delete your account, we remove your personal data within 30 days, except where we are required to retain limited records to comply with legal or financial obligations.

Session replays and product-analytics events are retained by PostHog for 30 days and then deleted.

DMCA designated agent

For copyright matters, Onflux maintains a designated agent. Notices and counter-notices may be sent to dmca@onflux.co. See our DMCA Policy for the full procedure.

Contact us

Questions about this policy or your data can be sent to privacy@onflux.co.