Privacy Policy

1. Introduction

BumpWin ("we," "us," or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services (collectively, the "Service").

Please read this Privacy Policy carefully. By using the Service, you consent to the practices described in this policy. If you do not agree with this policy, please do not use our Service.

2. Information We Collect

2.1 Information You Provide

We collect information that you voluntarily provide when using our Service, including:

• Account Information: Email address and password when you create an account.
• Flight Information: Airline codes, flight numbers, travel dates, and related flight details.
• Payment Information: Payment card details processed securely through our payment processor (Stripe). We do not store your full credit card number.
• Communication Data: Information you provide when contacting our support team.

2.2 Information Collected Automatically

When you use our Service, we automatically collect certain information, including:

• Device Information: Browser type, operating system, device type, and unique device identifiers.
• Usage Data: Pages visited, features used, time spent on pages, and navigation patterns.
• Log Data: IP address, access times, and referring URLs.
• Cookies and Similar Technologies: See Section 6 below.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Provide the Service: To operate, maintain, and improve our platform and generate compensation-related documents.
• Process Payments: To process transactions and send related information.
• Communicate: To respond to inquiries, send service-related notices, and provide customer support.
• Personalize Experience: To tailor content and features to your preferences.
• Analytics: To understand how users interact with our Service and improve it.
• Security: To detect, prevent, and address fraud, abuse, and security issues.
• Legal Compliance: To comply with applicable laws, regulations, and legal processes.

4. How We Share Your Information

We may share your information in the following circumstances:

• Service Providers: With third-party vendors who perform services on our behalf (e.g., payment processing, hosting, analytics). These providers are contractually obligated to protect your information.
• Legal Requirements: When required by law, regulation, legal process, or governmental request.
• Protection of Rights: To protect the rights, property, or safety of BumpWin, our users, or others.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.
• With Your Consent: When you have given us explicit consent to share your information.

We do not sell your personal information to third parties.

5. Third-Party Services

Our Service integrates with the following third-party services:

• Stripe: For payment processing. Stripe's privacy policy: stripe.com/privacy
• Supabase: For authentication and data storage. Supabase's privacy policy: supabase.com/privacy
• Vercel/Railway: For hosting services.

These third parties have their own privacy policies, and we encourage you to review them.

6. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect and store information. Types of cookies we use:

• Essential Cookies: Required for the Service to function (e.g., authentication, session management).
• Analytics Cookies: Help us understand how users interact with our Service.
• Preference Cookies: Remember your settings and preferences.

You can control cookies through your browser settings. However, disabling certain cookies may limit your ability to use some features of our Service.

7. Data Retention

We retain your personal information for as long as necessary to provide the Service and fulfill the purposes described in this policy, unless a longer retention period is required by law.

Account information is retained until you delete your account. After account deletion, we may retain certain information as required for legal, accounting, or business purposes.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit (HTTPS/TLS)
• Encryption of sensitive data at rest
• Access controls and authentication
• Regular security assessments

However, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

9. Your Rights and Choices

Depending on your location, you may have certain rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete information.
• Deletion: Request deletion of your personal information (subject to legal requirements).
• Portability: Request a copy of your data in a portable format.
• Opt-Out: Opt out of marketing communications at any time.
• Withdraw Consent: Where processing is based on consent, you may withdraw it at any time.

To exercise these rights, please contact us at [email protected]. We will respond to your request within 30 days.

10. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information is collected, used, shared, or sold.
• Right to delete personal information held by businesses.
• Right to opt-out of the sale of personal information. Note: We do not sell personal information.
• Right to non-discrimination for exercising your CCPA rights.

To exercise your CCPA rights, contact us at [email protected] or call us at the number provided below.

11. European Users (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have rights under the General Data Protection Regulation (GDPR):

• Right to access, rectify, or erase your personal data.
• Right to restrict or object to processing.
• Right to data portability.
• Right to lodge a complaint with a supervisory authority.

Legal Basis for Processing: We process your data based on: (a) your consent, (b) performance of a contract, (c) compliance with legal obligations, or (d) our legitimate interests.

International Transfers: Your data may be transferred to and processed in the United States. We use appropriate safeguards (such as Standard Contractual Clauses) to protect your data during international transfers.

12. Children's Privacy

Our Service is not intended for children under the age of 18. We do not knowingly collect personal information from children under 18. If you believe we have collected information from a child under 18, please contact us immediately at [email protected], and we will delete such information.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and updating the "Last Updated" date. Your continued use of the Service after any changes constitutes acceptance of the updated policy.

We encourage you to review this Privacy Policy periodically.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

For GDPR-related inquiries, you may also contact our Data Protection contact at the email above.