Legal
Privacy Policy
What personal information Jetvala collects, why we collect it, who we share it with and the choices you have.
Last updated September 2, 2026
Draft for attorney review, not yet effective
This document is a working draft. It has not been reviewed by counsel and does not yet apply to any booking. It will be replaced by the final version before Jetvala starts selling tickets.
Draft for attorney review. Not yet in effect. Items marked ATTORNEY REVIEW need confirmation before launch.
1. Who is responsible for your data
This policy is issued by Jetvala Travel LLC, doing business as Jetvala, located at 963 Park Ave, Plainfield, NJ 07060, US. We decide how and why your personal information is processed when you use jetvala.com, our apps, our WhatsApp and SMS channels, and our phone support. For privacy questions or requests, email privacy@jetvala.com.
We wrote this policy to satisfy the California Online Privacy Protection Act (CalOPPA), the California Consumer Privacy Act as amended by the CPRA (to the extent its thresholds apply to us), the New Jersey Data Privacy Act, and other US state privacy laws. We do not currently market to people in the European Union or United Kingdom. If you reach us from there, the GDPR or UK GDPR may still give you rights, and we will honor requests from you in the same way we honor requests from US residents. ATTORNEY REVIEW: confirm CCPA applicability once revenue and record counts are known; confirm whether an EU representative is needed.
2. What we collect
Information you give us when you search or book:
- Traveler details: full name, date of birth, gender as shown on your ID, and, where the airline or destination requires it, passport or national ID number, issuing country, expiry date and nationality.
- Secure Flight data required by the US Transportation Security Administration for flights touching the United States: name, date of birth, gender, and any Known Traveler Number or Redress Number you choose to give us (49 CFR Part 1560).
- Contact details: email address, phone number, WhatsApp number, billing address.
- Payment details: your card is processed by our payment provider. Jetvala never sees or stores your full card number. We keep the last four digits, card brand, and a payment token so we can process refunds.
- Travel preferences and special requests: meal, seat, wheelchair or other assistance, frequent flyer numbers.
- Messages you send us on WhatsApp, SMS, email, chat or phone, and notes our team makes while helping you.
- Anything you add to your account, such as saved travelers.
Information we collect automatically: IP address, device and browser type, language, pages viewed, searches made, referring site, approximate location derived from IP, and interaction events. We collect this through server logs, cookies and our product analytics tool. See our Cookie Notice.
Information from others: airlines and our flight technology provider send us booking status, ticket numbers, schedule changes and refund decisions. Our payment provider sends us fraud signals. If you sign in through a third party in future, we will receive the identifiers you authorize.
We do not knowingly collect information from children under 13 except as traveler details entered by a parent or guardian for a booking.
3. Why we use it
| Purpose | Examples | Legal basis (where required) |
|---|---|---|
| Making and managing your booking | sending traveler data to the airline, issuing tickets, sending confirmations and schedule changes, processing refunds | Contract |
| Legal duties | Secure Flight, sanctions screening, tax and accounting records, responding to lawful requests | Legal obligation |
| Support | answering your messages, resolving problems with the airline | Contract, legitimate interest |
| Fraud prevention and security | checking payments, detecting abuse, protecting accounts | Legitimate interest, legal obligation |
| Improving Jetvala | understanding which routes people search, fixing bugs, testing features | Legitimate interest |
| Marketing, only if you opt in | fare alerts, route news, promotions by email, SMS or WhatsApp | Consent |
We do not use your data for automated decisions that have legal or similarly significant effects on you. We do not sell your personal information for money.
4. Who we share it with
We share personal information only with parties who need it to serve you or where the law requires it.
| Recipient | What and why |
|---|---|
| Airlines and their systems | Traveler, contact and Secure Flight data to issue and manage your ticket. Each airline handles your data under its own privacy policy. |
| Duffel (flight booking platform) | Passes booking data between Jetvala and airlines. |
| Stripe (payments) | Processes your card payment and refunds; performs fraud screening. |
| Resend (email delivery) | Sends transactional and, if you opted in, marketing email. |
| Twilio (SMS and WhatsApp) | Delivers transactional and, if you opted in, marketing messages. |
| Vercel or our hosting provider | Hosts the site and stores encrypted data in the United States. |
| PostHog (product analytics) | Measures how the site is used so we can improve it. |
| Travel insurance partner | Only if you choose to buy a plan; the partner receives traveler and trip details needed to issue it. |
| Government agencies | TSA (Secure Flight), Customs and Border Protection, and foreign authorities where a destination requires passenger data (APIS), and law enforcement under valid legal process. |
| Professional advisers and successors | Accountants, lawyers, insurers, and any buyer of the business under confidentiality. |
Every vendor signs a contract that limits its use of your data to the services it provides to us. We will update this list when a sub-processor changes.
Cross-border transfers. Airlines and destination governments are often outside the United States. Your booking data travels to them because the trip requires it. Our own systems are hosted in the United States.
5. How long we keep it
| Data | Retention |
|---|---|
| Booking records, receipts, disclosures shown at checkout | 7 years after travel, for tax, accounting and dispute purposes |
| Passport numbers and Secure Flight data | Encrypted at rest. Deleted 90 days after the last flight on the booking, unless the airline or a refund dispute requires longer |
| Support conversations | 3 years after the last message |
| Account data | Until you delete your account, then 30 days |
| Analytics events | 12 months, then aggregated |
| Marketing consent records and opt-outs | As long as needed to honor your choice, plus 5 years as proof |
ATTORNEY REVIEW: confirm retention periods against IRS record-keeping, DOT complaint windows, and the TCPA four-year statute of limitations.
6. How we protect it
Data in transit is encrypted with TLS. Sensitive fields such as passport numbers and dates of birth are encrypted at rest with keys held separately from the database. Access inside Jetvala is limited to staff who need it to help you, and every access is logged. Payment card data never touches our servers. We sign in with one-time email codes rather than passwords so there is no password for anyone to steal. No system is perfectly secure; if a breach affects your data, we will notify you and regulators as the law requires.
7. Your choices and rights
Depending on where you live, you may have the right to:
- Know what personal information we hold about you and receive a copy.
- Correct inaccurate information.
- Delete your information, subject to records we must keep by law.
- Opt out of the sale or sharing of personal information and of targeted advertising. Jetvala does not sell personal information. We honor the Global Privacy Control browser signal as an opt-out of sharing for cross-context advertising.
- Limit the use of sensitive personal information to what is needed to provide the service.
- Withdraw consent to marketing at any time. Reply STOP to any SMS or WhatsApp message, click unsubscribe in any marketing email, or contact us.
- Appeal a decision we make on your request.
- Not be discriminated against for exercising your rights.
To make a request, email privacy@jetvala.com from the address on your booking, or write to us at 963 Park Ave, Plainfield, NJ 07060, US. We will verify your identity by sending a code to the email or phone on file and, for sensitive data, may ask for the booking reference. You can use an authorized agent; we will ask for proof of authorization. We respond within 45 days and will tell you if we need more time. New Jersey and California residents who disagree with our response can appeal by replying to our decision; we will answer the appeal within 45 days and tell you how to contact your state attorney general.
California residents. In the last 12 months we collected the categories listed in Section 2 for the purposes in Section 3 and disclosed them to the recipients in Section 4. We do not sell or share personal information as those terms are defined in the CCPA, and we have no actual knowledge of selling or sharing the data of anyone under 16. Under California's Shine the Light law you may ask once a year for a list of third parties to whom we disclosed personal information for their own direct marketing; we do not do this.
Nevada residents. We do not sell covered information as defined in NRS 603A. You may still submit an opt-out request to privacy@jetvala.com.
8. Do Not Track and Global Privacy Control
We honor the Global Privacy Control signal. Browsers' older "Do Not Track" setting has no agreed meaning, so we do not respond to it, but our analytics is first-party and we do not run third-party advertising trackers on the site.
9. Marketing messages
We send marketing email only if you opt in, and every message has an unsubscribe link. We send marketing SMS or WhatsApp messages only with your prior express written consent, which is never required to book. Message and data rates may apply. Reply STOP to stop, HELP for help. Details are on our SMS and WhatsApp Consent page.
10. Links to other sites
Airline, insurer and government sites have their own privacy policies. We are not responsible for them.
11. Changes to this policy
When we change this policy, we will update the date at the top and, for material changes, notify you by email or a notice on the site before the change applies. Past versions are available on request.
12. Contact
- Privacy requests: privacy@jetvala.com
- General support: support@jetvala.com
- Mail: Jetvala Travel LLC, 963 Park Ave, Plainfield, NJ 07060, US
ATTORNEY REVIEW: decide whether to appoint a named privacy officer; confirm NJ Data Privacy Act applicability thresholds (100,000 consumers, or 25,000 consumers plus revenue from data sales) and universal opt-out mechanism obligations.