Privacy policy
Flights 4 Casuals is the controller of the personal data described here. This policy says what Whereabouts collects, why, who it is shared with and what you can ask us to do about it.
Last updated 26 September 2026
What we collect
- Your email address, so you can sign in and so we can contact you about your trips. If you sign in with Google we receive your email address and name from Google.
- Your trips: where you want to go, your dates, party size, budget, the things you wrote in your own words, the activities and journal entries you add, and the plans you save.
- Your purchases: which tier you bought for which trip, what you paid and when. Stripe holds the card details; we never see them.
- How the site is used, at the level of server logs: pages requested, times, and how many provider searches have been made that day.
Why we are allowed to hold it
We hold your account and your trips to give you the service you asked for — that is a contract between us. We keep payment records because tax and accounting law requires it. We use what you wrote in your brief to suggest activities because that is the service you asked for, and nothing you write is used to train anybody’s model.
Who else sees it
Only the companies that make the site work, and only what each one needs:
| Who | What they do | What they receive |
|---|---|---|
| Stripe | Takes payments and stores card details. We never see your card. | Email address, the trip a purchase belongs to, payment records |
| Railway | Runs the site and its database in the United Kingdom or European Union region we chose. | Everything stored: your account, trips and purchase records |
| SerpApi | Searches Google Flights and Google Hotels when you press Plan holiday. | Airports, destinations, dates and party size — never your name or email |
| Travelpayouts | Supplies recently seen flight prices when trip options are built. | Airport codes and dates only |
| Google Places | Finds food and transport near a place you name in your journal. | The place you typed and the destination it is in |
| Open-Meteo | Supplies the weather forecast for your destinations. | Destination names and dates |
| Anthropic | Reads your non-negotiables and preferences into suggested activities, and writes an optional explanation. | The words you wrote in your trip brief |
| Google and email sign-in | Signs you in, and sends sign-in links. | Your email address |
| Sentry | Tells us when the site throws an error, so it can be fixed. | What went wrong, which page it happened on, and your browser and operating system — never your trip, your words, your email or your IP address |
When you follow a link to an airline, hotel or comparison site, you leave us and their own privacy policy takes over. Some of those links tell the partner that the visit came from us, so that a booking can be credited to us — that identifies this site, not you.
Some of these companies are outside the United Kingdom. Where that is so, the transfer is covered by the UK addendum to the standard contractual clauses or an adequacy decision. We do not sell your data to anybody, and we do not use it for advertising.
How long we keep it
Your account and trips stay until you delete them or close your account. Payment records are kept for six years because tax law requires it, even after an account is closed. Weather and nearby-places results are never stored. Flight and accommodation prices saved with a trip are a snapshot for your reference and are replaced whenever you plan again.
What you can ask for
You can see, correct, export or delete your data, object to how we use it, or ask us to restrict it. Export and account deletion are buttons in your account — you do not need to ask us. Deleting your account removes your trips and your sign-in details; payment records stay for the six years above.
Write to support@whereaboutss.com for anything else. If you think we have got this wrong you can complain to the Information Commissioner’s Office at ico.org.uk.
Keeping it safe
Sign-in is by Google or a one-time email link, so there is no password to steal. Data is encrypted in transit and at rest by our hosting provider, and provider keys are held on the server and never sent to your browser. No system is perfectly safe, and we will tell you and the regulator if a breach puts you at risk.
Children
Whereabouts is not for children under 13, and we do not knowingly hold their data.
Changes
If this policy changes in a way that matters, we will tell you by email before it applies.