Privacy Policy
Last updated: 9 September 2026
1. Who We Are
Cloudymonkey.com ("Cloudymonkey", "we", "us", "our") is a B2B SaaS platform providing flight search, quoting, and pricing intelligence tools for independent travel agents and boutique agencies. We are based in the United Kingdom.
For data protection enquiries, contact us at: privacy@cloudymonkey.com
2. What Personal Data We Collect
2.1 Account & Authentication Data
- Email address (used to send magic link login tokens)
- Session tokens (stored securely in your browser, managed by our authentication provider)
2.2 Usage Data
- Flight search queries (origin, destination, dates, passengers, cabin class)
- Quotes created within the platform (stored locally in your browser)
- Margin analysis inputs and outputs (used to improve our pricing intelligence model)
2.3 Booking Data (entered by you)
When you create a booking through the platform, you enter passenger details on behalf of your client, including: name, date of birth, gender, email, phone number, passport number, nationality, and passport expiry. This data is transmitted directly to our flight fulfilment provider to create the booking and is not stored on Cloudymonkey's servers.
2.4 Contact & Waitlist Data
- Name and email address submitted via contact or waitlist forms on the marketing site
2.5 Technical Data
- IP address, browser type, operating system (collected automatically for security and analytics)
- Page views and session duration
3. How We Use Your Data
| Purpose | Legal Basis (UK GDPR) |
|---|---|
| Providing and maintaining the platform | Contractual necessity (Art. 6(1)(b)) |
| Sending magic link authentication emails | Contractual necessity (Art. 6(1)(b)) |
| Improving our pricing intelligence model | Legitimate interests (Art. 6(1)(f)) |
| Responding to enquiries and support requests | Legitimate interests (Art. 6(1)(f)) |
| Sending product updates and newsletters | Consent (Art. 6(1)(a)) — you may opt out at any time |
| Complying with legal obligations | Legal obligation (Art. 6(1)(c)) |
| Security monitoring and fraud prevention | Legitimate interests (Art. 6(1)(f)) |
4. Data Sharing & Third Parties
We do not sell your personal data. We share data only with the following categories of processor, under data processing agreements, and only to the extent necessary:
| Processor | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, and backend infrastructure | EU (Ireland, AWS eu-west-1) |
| Resend | Transactional email delivery (magic links) | EU (eu-west-1) |
| Duffel | Flight search and booking fulfilment | United Kingdom |
| Willo AI | Site hosting and build infrastructure | United Kingdom / EU |
All third parties listed above hold ISO 27001 certification or equivalent (SOC 2 Type II) and are bound by contractual data protection obligations.
5. Data Retention
- Account data: Retained for the duration of your subscription plus 12 months after account closure
- Contact/waitlist submissions: Retained for up to 24 months
- Booking passenger data: Not stored on Cloudymonkey servers — passed directly to the flight fulfilment provider
- Usage and analytics data: Retained in aggregated form for up to 36 months
- Security logs: Retained for 90 days
6. Your Rights Under UK GDPR
As a UK data subject, you have the following rights:
- Right of access — request a copy of the personal data we hold about you
- Right to rectification — request correction of inaccurate data
- Right to erasure — request deletion of your data ("right to be forgotten")
- Right to restriction — request we limit how we process your data
- Right to data portability — receive your data in a structured, machine-readable format
- Right to object — object to processing based on legitimate interests
- Right to withdraw consent — for any processing based on consent
To exercise any of these rights, email privacy@cloudymonkey.com. We will respond within 30 days.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk | 0303 123 1113.
7. Cookies & Local Storage
Cloudymonkey uses:
- Authentication cookies / session tokens — strictly necessary, set by Supabase to maintain your logged-in session. Cannot be disabled without breaking the platform.
- Browser local storage — used to store your saved quotes on your own device. This data never leaves your browser.
We do not use advertising cookies, tracking pixels, or third-party analytics cookies.
8. Security
We implement appropriate technical and organisational measures to protect your personal data, including:
- TLS 1.2+ encryption in transit on all connections
- AES-256 encryption at rest (Supabase / AWS)
- Passwordless authentication (magic links only — no password database to breach)
- API keys stored in server-side environment variables, never in client-side code
- HTTP security headers (CSP, HSTS, X-Frame-Options) on all pages
- Row-level security on all database tables
- Infrastructure hosted on ISO 27001–certified cloud providers
9. International Transfers
All data is processed within the UK or EU (EEA). Where transfers occur, they are governed by UK GDPR–compliant transfer mechanisms (UK International Data Transfer Agreements or Standard Contractual Clauses).
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify active subscribers of material changes via email. The "Last updated" date at the top of this page reflects the most recent revision.
11. Contact
For any data protection questions or to exercise your rights:
Cloudymonkey.com
Email: privacy@cloudymonkey.com