Legal
Privacy Policy
This page explains what the service stores about you, how to delete it, which cookies it sets and which other companies receive data.
We have tried to say only what the product actually does today. We do not claim compliance with any particular privacy law or certification. Questions or requests: support@bookwithai.in.
1. What we store
| Data | When |
|---|---|
| Chat conversations: every message you send and every answer, including the flight cards shown. | Everyone who uses the chat, with or without an account. |
| Copies of your message and the assistant's answer kept for debugging and quality review (the "run record"). | Everyone who uses the chat. The detailed text is scheduled to be cleared after about 30 days and the record deleted after about 180 days (automatic clean-up jobs, not a guarantee of timing); it is also deleted when you delete the chat. |
| Your IP address and browser user agent, with a count of messages and searches. | Guests (visitors without an account). Also recorded in our request logs for every visitor. |
| Request logs: the page or API called, result code, timing, your IP address, browser user agent and (if signed in) your user id. | Everyone. |
| Account details: email, password (stored only as a hash), and the optional name, phone number, date of birth, gender, country and address you add; your Google sign-in link; whether two-factor sign-in is on; your last sign-in time. | Only if you create an account. |
| Preferences the assistant learns from how you use the app (for example seat or timing habits) and notes you ask it to remember. | Signed-in users. You can see and delete these (section 2). |
| Ratings: a thumbs up or down on a recommendation, with an optional reason and comment. | Signed-in users who rate. A rating is removed when its chat is deleted. |
| Feedback you send us: name and email if you give them, your message, and the chat and flight context shown when you sent it. | Anyone who submits feedback. |
| Location: if you allow your browser's location prompt, your device coordinates are sent with your messages. We turn them into a nearby city, which is given to the AI, and (when a Google Maps key is configured) the coordinates are sent to Google Maps to work out distances to airports. Rounded coordinates may also be part of a search cache key. If you decline, the chat still works. | Everyone who allows location in the browser. |
| Travel preferences you enter yourself in your profile: preferred airlines, airports, timing, cabin, seat, travel style, layover limits, meal preference and special-assistance needs (free text, which may reveal health or religious information). | Signed-in users who fill the form. |
| Loyalty programs: airline program names, membership numbers and the miles activity you record. | Signed-in users who add them. |
| Sign-in sessions: when and from which IP address and browser user agent each sign-in happened. | Signed-in users. |
| One-time-code and verification records: the email address or phone number being verified, the code (and for some records its expiry), email-verification and password-reset tokens, and two-factor secrets and recovery codes if you turn two-factor on. | Anyone who signs up, verifies a phone or email, resets a password or enables two-factor. |
| Rate-limit counters keyed by IP address (to stop abuse). | Everyone. |
| Saved trips, itineraries, price alerts (route, dates, airline and the prices we recorded), travel statistics and settings. Trips can include passenger name, confirmation code and ticket number if you enter them. | Signed-in users who use them. |
| Document vault: images you upload (passport, visa, insurance or booking documents), stored in our database. | Only if you upload them. |
| Passenger details (name, email, phone, date of birth, country) you give the assistant for a trip, and your consent choices for sharing them. | Only if you provide them. |
| Usage events: when a search is run or a trip is saved, an event is recorded with an internal user or session reference, a search id, the flight reference and technical details of the search. | Everyone who searches. |
| Support records: if you send feedback or a chat is escalated to our support team, staff create a case linked to that feedback or chat. | Only when that happens. |
| Booking-link clicks: which provider, route, airline and price you clicked out to. | Everyone who clicks a booking link. |
| A copy of your recent chat and a guest message counter kept in your own browser's storage. | On your device only. |
BookWithAI never takes payment for flights and does not ask for card details. You complete any purchase on the airline or booking provider's own site.
2. How long we keep it, and how to delete it
- Chats: signed-in chat history is kept until you delete the chat. Deleting a chat also deletes its messages, ratings and run records. Chats from visitors without an account are scheduled for automatic deletion after roughly 30 days without activity; we do not promise an exact moment.
- Learned preferences and memory notes: in the app, open Settings, then "What we've learned about you" to see each item and delete it, or delete everything. Deletion is permanent and the assistant will only learn it again if you tell it again.
- Document vault, saved trips and price alerts: each can be deleted in the app.
- Your account: there is no self-serve "delete my account" button yet. To delete your account and the data tied to it, email support@bookwithai.in from the address on the account. Feedback you sent is kept for our records; we will also blank the name and email you typed into it when you ask us to.
- Request logs, usage events and other operational records: we have not fixed a retention period for these and do not state one.
- Be careful what you type: everything you write in the chat is stored and sent to OpenAI. Please do not type passport numbers, card numbers or other sensitive details into the chat.
3. Cookies and similar technologies
- Sign-in: two cookies keep you signed in (an access cookie of about 15 minutes and a refresh cookie of about 30 days). Both are HttpOnly, so scripts cannot read them.
- Guest session: an HttpOnly cookie of about 30 days identifies your anonymous chat so it can be resumed.
- Google sign-in: two short-lived cookies are used while you sign in with Google.
- Analytics: this website and the app use Google Analytics 4, and the app also loads a Google Tag Manager container. These set Google's own cookies and send usage data (pages viewed, device and approximate location) to Google.
- Display preferences: a first-party cookie,
bwai_display_prefs(about 1 year, readable by the page), remembers your text-size and contrast settings. - Local storage: a cache of your recent chats (
bookwithai_cached_chats), a guest message counter, a "guest limit dismissed" flag and a pending sign-in action (bookwithai_guest_*), and a snapshot of your tracked-fare prices (bookwithai_alert_price_snapshot_v1). - Session storage (cleared when the tab closes): the current chat session id and markers used when you return from a booking site (
bookwithai_session_id,bookwithai_pending_booked_flight,bookwithai_pending_booking_return).
There is currently no cookie-consent banner. You can block cookies in your browser settings, but the chat may not work without the cookies listed above for sign-in and guest sessions.
4. Who else receives data
Providers that receive personal data or your messages
- OpenAI - the language model that reads your messages and writes the answers. Besides your typed text it is given context from your account and device: your saved and learned travel preferences, your memory notes, the city derived from your location, and, when you create or edit trips or price alerts with the assistant, the trip details (which can include passenger name, confirmation code and ticket number) and price-alert data. It is also used to write chat titles and tracked-fare summaries.
- SendGrid or Resend - sends account emails (verification, sign-in codes, password reset). We use one of the two at any given time, whichever is configured. Your email address is sent to it.
- Twilio - sends one-time codes by text message when you use phone verification. Your phone number is sent to it.
- Google - sign-in with Google; Google Analytics and Tag Manager as described above; and Google Maps Platform, which may receive your device coordinates (see Location above) as well as airport and place queries.
- Supabase - hosts our databases.
- DigitalOcean - hosts our application servers and this website.
Providers that receive only trip queries (routes, dates, airports)
- SerpAPI (Google Flights results) and Duffel - flight search and fares.
- FlightAware - flight status. OpenWeather - weather.
- Travel Buddy (via RapidAPI) - visa requirements, when enabled. Nager.Date - public holidays. open.er-api.com - exchange rates.
We also use public on-time performance data from the US Department of Transportation's Bureau of Transportation Statistics; no personal data goes to it.
5. Optional features
Some features may collect additional data when they are enabled, for example satisfaction survey responses, votes on feature requests, and the text of help-article searches (which we try to scrub of personal details, but cannot guarantee). These features may be off or on at any given time. We will update this page before we rely on them.
6. Changes and contact
We will update this page, and its "last updated" date, when what we store changes. Contact: support@bookwithai.in.