Back

Privacy Policy

SkyShopper is currently in beta. These documents are in draft form and subject to revision. By using this service you acknowledge that the terms and privacy policy have not been finalised. For questions, contact support@goskyshopper.com.

SkyShopper — Privacy Policy

Last updated: [DATE]

DRAFT — not legal advice. Starting template for review. Because SkyShopper serves users in India, a lawyer should confirm compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and any other applicable law before you publish this. Bracketed items [like this] need your input or a lawyer's decision.

1. Who we are

SkyShopper ("we", "us", "our") operates the price-comparison app at goskyshopper.com. This Privacy Policy explains what personal data we collect, why, and your rights.

Data controller / fiduciary: [legal entity / name], [address]. Contact: [privacy/support email].

2. What data we collect

Information you give us:

  • Account details: email address, name, password (stored securely / hashed by our authentication provider).
  • Profile details: passport country, home airport, and phone number (phone is optional).
  • Trip details you enter: routes (origin, transit, destination), travel dates, carrier.
  • Your wishlist and "mark as bought" items.
  • Anything you send us via support/contact forms.

Information collected automatically:

  • Usage and analytics events (for example: pages viewed, products viewed, searches, wishlist actions). Our own analytics ties these to a randomly-generated session and visitor identifier stored in your browser's local storage — not to your real-world identity. Separately, the third-party analytics and advertising tools described in section 6 do set cookies in your browser.
  • Approximate device/browser type (derived from your request), and basic performance and error diagnostics.
  • We do not store your raw IP address; where needed for abuse-prevention, it is processed only in a hashed form.

We do not collect payment or card information, because SkyShopper does not process transactions.

3. Why we use your data

We use your data to:

  • create and manage your account and keep you signed in;
  • provide core features (airport/route-based price comparison, wishlist, trip context);
  • show India-relevant price comparisons based on your profile (e.g. home airport / passport country);
  • improve SkyShopper — understand usage, fix errors, and monitor performance and abuse;
  • respond to your support requests;
  • send you service-related communications [and, only with your consent, any updates/marketing — confirm with lawyer].

4. Legal basis / consent

Where the DPDP Act or other law applies, we process your personal data on the basis of your consent (given at sign-up and where otherwise requested) and to provide the service you have asked for. You can withdraw consent at any time (see "Your rights").

5. How we share data

We do not sell your personal data. We share it only with:

  • Service providers who host and run SkyShopper on our behalf — for example our hosting and database providers [Vercel, Supabase] and error/monitoring tools [e.g. Sentry, if enabled] — who process data under agreements limiting their use of it;
  • Analytics and advertising providers — Google (Google Analytics) and Meta (Meta Pixel), as described in section 6;
  • Authorities, where required by law or to protect rights, safety, or security.

Some providers may process or store data outside India. [Lawyer to confirm cross-border transfer requirements under the DPDP Act and add any required safeguards/notice.]

6. Analytics, cookies and advertising

SkyShopper uses three kinds of measurement. Two of them set cookies in your browser.

Our own analytics — no cookies. We store a randomly-generated session and visitor identifier in your browser's local storage to measure usage in aggregate. These are not cookies and are not linked to your real-world identity.

Hosting analytics. We use Vercel Analytics and Vercel Speed Insights for traffic and performance metrics.

Third-party analytics and advertising.

  • Google Analytics 4 (Google) — to understand how the site is used. It sets _ga and _ga_* cookies in your browser, lasting up to two years.
  • Meta Pixel (Meta Platforms) — to measure the performance of our advertising and to show you SkyShopper ads on Meta products such as Facebook and Instagram after you have visited the site, commonly called retargeting. It sets a _fbp cookie on this site (about 90 days), and Meta also sets an fr advertising cookie on the facebook.com domain — that one is a genuine third-party cookie, set by Meta rather than by us.

Google and Meta act as independent controllers for the data they collect through these tools, and may combine it with data they already hold about you. Their own privacy policies govern that use: Google and Meta.

[Google Ads conversion tracking is NOT currently installed. Add it here if and when it is.]

[Consent: advertising cookies of this kind generally require prior consent under the DPDP Act, and under ePrivacy/GDPR for visitors in the EU/UK. There is currently no consent banner on the site. Lawyer to confirm what is required, and whether these tags must be gated behind it.]

[Opt-out: decide what to offer — a consent banner, a link to Google's opt-out browser add-on, and Meta ad preferences.]

7. Data retention

  • Account and profile data: kept while your account is active, and deleted or anonymised within [a reasonable period] after you delete your account.
  • Analytics events: retained for about [60 days] in raw form, after which they are aggregated and the raw events deleted.
  • Error/diagnostic logs: retained for about [90 days].

[Lawyer/you to confirm final retention periods.]

8. Security

We use reasonable technical and organisational measures to protect your data, including access controls and row-level security on our database, encrypted connections (HTTPS), and restricted administrative access. No system is perfectly secure, so we cannot guarantee absolute security.

9. Children

SkyShopper is not directed at children. You must be at least [18] to create an account, and we do not knowingly collect data from children. [The DPDP Act has specific rules on processing children's data — lawyer to confirm.]

10. Your rights

Subject to applicable law (including the DPDP Act), you may:

  • access the personal data we hold about you;
  • correct or update inaccurate data;
  • delete your account and associated personal data;
  • withdraw consent for processing;
  • raise a grievance about how we handle your data.

To exercise any of these, contact [privacy/support email]. We will respond within a reasonable time and as required by law.

Grievance Officer (as may be required under Indian law): [name / contact — lawyer to confirm whether required for your scale].

11. Changes to this Policy

We may update this Policy. If changes are material, we will take reasonable steps to notify you (in-app or by email). The "Last updated" date shows the latest revision.

12. Contact

Questions or requests about your privacy: [privacy/support email] or via goskyshopper.com.

By creating an account or using SkyShopper, you acknowledge that you have read this Privacy Policy.