Privacy Policy

CheapStay ("we", "our", "us") is a travel booking platform for flights and hotel price comparison. This policy explains what data we collect, how we use it, and your rights.

Account data: name, email address, and optionally a profile photo when you sign up.

Travel profile: travel preferences, frequent flyer numbers, and budget range that you set in your account.

Passport and identity data: if you enter passport details for flight bookings (passport number, nationality, date of birth), these are encrypted using AES-256-GCM before being stored. We cannot read the raw values — only your device can decrypt them for autofill.

Flight booking data: passenger names, contact details, selected flights, seat selections, and booking references for flights booked through CheapStay.

Search history: hotel and flight searches you perform, used to personalise results and improve the service.

Technical data: IP address, browser type, and pages visited, collected automatically for security and analytics.

Session recordings: we use Microsoft Clarity to record anonymised user sessions (mouse movements, clicks, scrolls) to understand how people use the site. No payment card or passport data is captured in recordings.

• To process and manage flight bookings on your behalf
• To provide and improve the hotel search service
• To autofill passenger details at checkout (passport data stays on your device)
• To send transactional emails (booking confirmations, cancellations, account alerts)
• To personalise deal recommendations based on your preferences
• To detect and prevent fraud or abuse
• To comply with legal obligations

We do not sell your personal data to third parties.

We use strictly necessary cookies for authentication sessions. We also use analytics cookies via Google Analytics 4 to understand which features and routes are most popular. Microsoft Clarity uses cookies for session recording. You can disable cookies in your browser settings, though this will affect login functionality.

CheapStay uses the following third-party services which may process your data under their own privacy policies:

• Supabase — authentication and database hosting
• Vercel — website hosting and CDN
• Duffel — flight search and booking (passenger data is shared with Duffel and the airline to complete your booking)
• Resend — transactional email delivery
• Google Analytics 4 — usage analytics
• Microsoft Clarity — anonymised session recordings and heatmaps
• Agoda / Booking.com — hotel pricing data via affiliate links
• Travelpayouts / NordVPN — affiliate tracking for recommended products
• Google OAuth — optional sign-in via your Google account

Some links on CheapStay are affiliate links — we may earn a commission if you purchase after clicking. This does not affect the price you pay and does not influence which products we recommend. See our Terms of Service for more detail.

We retain your account data for as long as your account is active. Flight booking records are retained for 7 years for legal and accounting purposes. Search history is retained for 12 months. You may request deletion of your account and associated data at any time by emailing support@cheapstay.co — note that booking records required for legal compliance cannot be deleted early.

Depending on your location you may have rights to access, correct, export, or delete your personal data. To exercise any of these rights please contact us at support@cheapstay.co.

We may update this policy from time to time. The "last updated" date at the top of this page will reflect any changes. Continued use of CheapStay after changes are posted constitutes acceptance of the revised policy.

For any privacy-related questions email support@cheapstay.co.