Privacy

Abdulkader Sayed Ali, Worthstr. 2, 58511 Lüdenscheid, Germany. Contact: support@aloft24.com. Full details in the . imprint.

Your account: Email address, first and last name, and a phone number if you enter one. Basis: performance of the contract — without them there is no account. The phone number is entirely optional, we do not verify it, and we send nothing to it.

Your password: We do not store it and we do not know it. What is stored is an argon2id hash, from which the password cannot be recovered — which is why we cannot send it back to you if you forget it, and send a reset link instead.

Your travel log: What you enter yourself: the date, the two airports, and your note if you write one. We do not infer your trips from any other source and we add nothing you did not add.

Sign-ins: An IP address and browser type for each sign-in, so you can see where your account is open and recognise one you did not make. Basis: legitimate interest in account security.

Sign-in attempts: The email address and IP for each attempt, to count them and to stop password guessing. Deleted automatically once their window has passed.

Destination discoveries: The destination you drew and the date. Used to enforce the limit of three a day, and to understand which places people find interesting.

We run no advertising, we do not track you across other sites, we set no analytics cookies, and we neither sell nor rent your data. The only cookie we set is the session cookie, which is required to sign in and does nothing else.

By name, and this is all of them:

Brevo (Sendinblue GmbH): Sending email only: activation, welcome and password reset. It receives your address and the text of the message. It does not receive your travel log or your password.

Nominalia (hosting): The servers and the database run at Nominalia, whose data centre is in Reading, United Kingdom. Data is stored on servers in the United Kingdom, protected by standards equivalent to the GDPR (UK GDPR).

The controller is in Germany and the hosting is in the United Kingdom, so there is a transfer of data outside the EU. Its basis is the European Commission's adequacy decision for the United Kingdom, which finds the level of protection there equivalent to that required by the GDPR.

GoDaddy: Domain registration and DNS records only. None of your personal data passes through it.

Your profile is private unless you publish it yourself, and publishing needs two things together: a handle and the switch. What is published shows your first name, your surname initial and the aggregate numbers only — not your email, not your customer number, not the dates of your trips, and not your notes. Clearing the handle takes the page down immediately.

As long as your account exists. Sign-in attempts are deleted automatically once their window has passed, and the log of sent messages is pruned after thirty days.

You have the right to access, correct, port, erase and object to the processing of your data, under Articles 15 to 21 of the GDPR. Two of them are implemented directly on your account page, with no correspondence and no waiting:

• Download your data — one file with everything we hold.
• Delete your account — carried out after seven days, and cancelled by signing in during them.

You also have the right to complain to the data protection authority responsible for your state.

The destinations and times the planner shows are reference material about availability. They are not a booking and not a guarantee of a seat. Always check before you travel.