Privacy Policy
Last updated: 2 November 2026
This policy explains what personal data FlightAPI collects, why it is collected, who it is shared with and the choices you have. It covers the flightapi.ai website, the developer portal, the FlightAPI API and the emails sent about your account.
FlightAPI is operated by Dubio Pte. Ltd. (UEN 202531590E), 20 Collyer Quay, #09-01, Singapore 049319 ("FlightAPI", "we", "us").
What we collect
| Data | Details |
|---|---|
| Account details | Your email address and name |
| Google or Apple sign-in | If you choose to sign in with Google or Apple, we receive your name, your email address and whether the provider has verified that email address. We never receive your Google or Apple password |
| Email sign-in codes | When you ask for a sign-in code, we store a one-way hash of the code (never the code itself), when it expires, how many times it was tried and the IP address the request came from |
| Billing profile | Your organisation name, website, country and billing address, if you enter them in the portal |
| Infrastructure application | If you apply for the Infrastructure plan: company name, website, contact name and email, expected monthly calls and intended use |
| Payments | Card details are entered into a form provided by our payment processor and go directly to it. We do not receive or store card numbers. We store the payment reference, amount, currency, status and date, the credits you buy and use, and the invoices and receipts we issue |
| API keys | A key is shown once, when it is created. We store only a one-way hash of the key, its name, whether it is a sandbox or live key, its rate limits and a record of every key action |
| API usage | For each API call: the time, the key and account used, the product (flights or hotels), trip type, the origin and destination airport codes or the hotel city, the response status, the response time and whether the call was billed. A search contains traveller types and counts only, never traveller names or other details about travellers |
| Webhooks | The addresses you register, the signing secret, and a record of each delivery (the event sent, the response code and the time) |
| Portal sessions | While you are signed in to the portal: your IP address and browser details, to keep your session secure |
| Emails we send | A record of each email sent to you: the address, the subject, the type of email and when it was sent |
| Website visits | We count page views without cookies. We record the page, the website that linked to it, any campaign tags in the link, and a visitor token. The token is a one-way hash of the date, the IP address and the browser, and changes every day. The IP address itself is not stored |
| Technical logs | Our servers and our network provider keep standard technical logs, such as IP address, time and the address requested, for security and troubleshooting |
| Support | What you send us when you contact support |
| Marketplace accounts | If you use FlightAPI through RapidAPI, we receive the marketplace's user identifier and plan for your subscription. Payment for marketplace subscriptions is handled by the marketplace |
Why we use it
| Purpose | What it covers |
|---|---|
| Providing the service | Creating your account, issuing and checking API keys, answering API calls, delivering webhooks and showing your usage in the portal |
| Sign-in and security | Sending sign-in codes, keeping you signed in, limiting repeated attempts, preventing fraud and abuse, and keeping an audit history of account and key actions |
| Billing | Taking payments, keeping track of your credits, charging billable calls, issuing invoices and receipts, and handling refunds |
| Service emails | Sign-in codes, receipts, low-credit notices, payment results and changes to your account |
| Getting started emails | For new accounts: a welcome email and short reminders to make a first call or activate the account. Every one of these emails has an unsubscribe link |
| Improving the service | Counting page views, sign-ups and API usage to understand how the service is used. These counts are looked at in total, not to profile individuals |
| Legal obligations | Keeping accounting and tax records and responding to lawful requests |
We do not sell personal data. We do not use personal data for advertising.
Google and Apple sign-in
If you sign in with Google or Apple, we use your name, email address and verified-email status only to create your FlightAPI account and to sign you in. We do not use this information for any other purpose, we do not share it except with the service providers listed below that run FlightAPI, and we do not sell it or use it for advertising. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
Who we share it with
We share personal data only with the service providers that run FlightAPI for us, and only what each one needs.
| Provider | What it does |
|---|---|
| Payment processor (Airwallex) | Processes card payments and refunds, and keeps saved cards for automatic top-up |
| Email delivery provider | Delivers sign-in codes, receipts and account emails |
| Hosting provider | Runs our servers and databases, located in the United States |
| Network and security provider | Delivers the website and API and protects them against attacks |
| Sign-in providers (Google, Apple) | Confirm your identity when you choose to sign in with them |
| Font provider (Google Fonts) | Website and portal pages load fonts from Google Fonts, which receives your IP address and browser details when a page loads |
| Flight and hotel data sources | To answer a search we send the search details (airports or city, dates, cabin and traveller counts). No account or personal data is sent |
We may also share personal data when the law requires it, to protect our rights or the safety of others, or as part of a sale or reorganisation of the business.
Cookies
The public website sets no cookies of its own. The developer portal uses only essential cookies: a session cookie that keeps you signed in and a security token that protects forms. We do not use advertising or analytics cookies. Our network provider may set a strictly necessary security cookie to protect the website against automated attacks.
How long we keep it
| Data | How long |
|---|---|
| Account details | While your account is open. A cancelled account stays inactive until you request deletion |
| After a deletion request | An administrator removes your name, email address, organisation name, website, billing address and Infrastructure application details, and closes sign-in |
| Billing and usage records | Billing, payment, usage, security and audit records are kept after the account is closed or deleted, linked only to an account number, for up to 5 years, as required for accounting and legal purposes |
| Email sign-in codes | A code expires 10 minutes after it is sent and works once |
| Website visit counts | The visitor token changes every day. No IP address is stored |
Your choices and rights
You can see and update your account and billing details in the developer portal. You can cancel your account in the portal at any time and then request its deletion. You can unsubscribe from getting started emails using the link in any of them. Service emails such as sign-in codes and receipts are needed to run your account.
Depending on where you live, you may have the right to access, correct or delete your personal data, to object to or limit how it is used, to withdraw consent, and to complain to a data protection authority. To make a request, email our Data Protection Officer at contact@flightapi.ai, or support@flightapi.ai. We may need to confirm your identity first.
International transfers
FlightAPI is operated from Singapore. Our servers are in the United States, and some service providers process data in other countries. Where personal data is transferred, it is protected as described in this policy.
Security
Every page and API call is served over HTTPS, API keys and sign-in codes are stored only as one-way hashes, and administrators sign in separately from customers. More detail is on the security page.
Children
FlightAPI is a service for businesses and developers. It is not meant for anyone under 18, and we do not knowingly collect personal data from children.
Changes to this policy
When this policy changes, the new version is published on this page with a new "Last updated" date.
Contact
Questions or requests about privacy: Data Protection Officer, Dubio Pte. Ltd., contact@flightapi.ai
General support: support@flightapi.ai
Dubio Pte. Ltd., 20 Collyer Quay, #09-01, Singapore 049319