Your data, handled the way everything else here is: plainly

JetStash is operated by Faiz Ahmed, trading as JetStash. For anything to do with your personal data, JetStash is the controller: the one who decides what's collected and why.

For any privacy question, to see what we hold about you, or to ask us to delete it, email privacy@jetstash.co.uk directly.

What we collect depends entirely on how you use the site:

• Contact form: your name, email address and the message you send.
• Quote request: your name, email address, trip type and region, and any optional details you choose to add, such as phone number, traveller count, approximate travel dates or a budget note.
• Travel Club or Route Watch sign-up: your email address, and any optional preferences you give us, such as your nearest UK airport, travel interest, or the specific route you'd like us to watch.
• Technical information generated automatically by visiting the site: your IP address, browser and device information, and standard web server logs.
• Only if you explicitly accept Site statistics: usage and page-speed information sent to Vercel Web Analytics and Vercel Speed Insights, described under Cookies and analytics below. Nothing is collected for this purpose before you accept, and nothing more after you decline or withdraw.
• Only if you explicitly accept optional Google Ads measurement: JetStash loads the Google Ads tag and sends configured conversion signals for certain flight, hotel or baggage-partner clicks. JetStash's current code does not put your name, email address, phone number, address, form contents or the partner URL into those conversion-event payloads. Google may also process ordinary browser, page, device or referrer information according to Google's own service behaviour and policies.

Travel Ready Check is different from everything above. Whether you're travelling on a British passport, which document exemption applies to you, and the dates you enter, are used only to work out an answer inside your own browser. None of it is sent to us, stored by us, or seen by us. See How we collect information below for more on this.

We do not ask for, and do not knowingly collect, passport or other document numbers, payment card details, copies of passports or other identity documents, or any other sensitive document files. Travel Ready Check asks which type of document or exemption applies to you, never the document itself.

We collect information when you fill in a form on this site, subscribe to Travel Club or Route Watch, email us directly, or simply browse the site, which generates the standard technical information described above. Travel Ready Check works entirely differently: it runs in your browser and never sends what you enter anywhere, including to us.

When you run an Arrive By check, the start location, destination, airports, flight times and buffers you enter (and an optional deadline, if you add one) are sent to JetStash's server to work out when to leave. To do that, the server sends parts of them to Google: the start and destination text go to Google's Geocoding service to resolve the places; the resolved places and a departure time worked out from your flight times go to Google's Routes service to calculate traffic-aware driving (and, for some airports, public-transport) estimates; and when you are asked to confirm or choose between possible matches for a venue, a Google place identifier may be sent to Google's Places service to fetch the venue's name for display. Google processes what it receives under its own terms and privacy policy.

JetStash does not retain the journey details you enter after the check is completed: not your start or destination, place identifiers, flight times or the results, and none of it is sent to our analytics provider. A place identifier you are asked to confirm may be held briefly in your browser between steps, then sent back to JetStash for re-verification. Three small things are kept, none of them a journey: a one-way hashed identifier derived from your IP address for about a minute, in a short-lived database entry, to limit journey checks and protect aggregate interaction counts from spam; a running monthly count of the Google lookups the service has made; and anonymous daily counts of checks started, completed or failed, the broad verdict shown, whether a driving rescue estimate was returned, and whether the missed-service explanation was opened. Those counts hold no journey details or identifiers and are kept for about three months. If your start or destination is a private home, we recommend entering the nearest venue or locality instead of an exact address.

JetStash doesn't use cookies for anything by default. When you first visit, a notice asks about two optional settings. Both are off until you choose, they are two separate choices, and accepting one never switches on the other. You can reject or accept both at once, or open the individual settings and choose each one separately, and you can change either at any time using ‘Cookie settings’ in the footer of every page.

Site statistics (optional). If you accept, JetStash loads Vercel Web Analytics and Vercel Speed Insights, which count visits and measure page speed so we can improve the site. They are built to work without cookies. Nothing about them loads until you accept: no script is requested before that point, or if you decline, or if you leave the notice unanswered. Once running they send the address of the page you are on (before sending, JetStash keeps only its own simple parameters such as an airport code, so advertising click identifiers, other query parameters and the address fragment are removed; campaign tags such as utm_source are kept only if you also accepted Google Ads measurement), your browser and device type and country, and the page that sent you to JetStash if you arrived from another website, which your browser provides, which Vercel's script adds to page views and to JetStash's own events, and which JetStash cannot edit. Vercel's analytics script also looks in your browser storage for an entry named __va_attribution each time it sends a page view or an event, so that it can attach an identifier if one is stored there. It writes or removes that entry only when a website asks it to identify a visitor, which JetStash does not do, so JetStash does not expect the entry to exist. If it does exist, declining or withdrawing removes it. JetStash's own analytics event payloads contain named events with limited contextual fields such as route, destination, state, source, trip type, region, intent, verdict or interest — not names, email addresses, phone numbers or form contents. Vercel and its services may process ordinary technical information needed to provide those services. If you decline, or withdraw later, JetStash removes that stored value and stops sending; the page reloads once so a script already running is cleared.

Google Ads measurement (optional). Nothing about the Google Ads tag loads until you actively accept: no Google script is requested before that point, or if you decline, or if you leave the notice unanswered. If you accept, JetStash loads the Google Ads tag and sends configured conversion signals for certain flight, hotel or baggage-partner clicks. The current JetStash code does not put your name, email address, phone number, address, form contents or the partner URL into those conversion-event payloads. Google's tag may also process ordinary browser, page, device or referrer information according to Google's own service behaviour and policies.

If you accept Google Ads measurement and Site statistics, JetStash also records, once per visit, which kind of source brought you here (for example a Google Ads click, a search result, or a link from another site) and attaches that kind of source to partner link clicks. This needs both choices, because it is advertising measurement and it is sent through Site statistics. Only the kind of source is kept, for the visit, in your browser; the advertising click identifier itself is not stored, and it is removed from the page address before that is sent to Vercel (the referrer your browser provides is outside that cleaning).

What is stored on your device. JetStash itself sets no cookies. It uses your browser's local storage for two entries that record your choices (named jetstash-ad-consent and jetstash-stats-consent, each holding “granted” or “denied”), which stay until you clear this site's data and are never sent to JetStash. Only if you have allowed both Google Ads measurement and Site statistics, it also keeps one word in session storage (named jetstash-acquisition-source) naming the kind of source that brought you here, which your browser removes when the tab is closed. If your browser blocks JetStash from saving a choice to decline, a “denied” note is kept in session storage for that tab instead (named jetstash-ad-consent:denied-override or jetstash-stats-consent:denied-override). Vercel's scripts set no cookies; the only entry of theirs we know of is the __va_attribution entry described above, which JetStash does not expect to exist. If you accept Google Ads measurement, Google's tag may set its own conversion-measurement cookies from this website's domain. Google's published cookie information (business.safety.google/adscookies) lists cookies of this kind, such as _gcl_aw, _gcl_gb and _gcl_au, as used for analytics, advertising and security purposes, each with a stated lifespan of 90 days. That is Google's description, not something JetStash has observed: we have not recorded which cookies the tag actually sets in your browser, so the names and durations may differ, and Google lists other advertising cookies too.

Your choices are remembered locally in your own browser, not in a JetStash account or server-side profile. Declining or withdrawing switches that measurement off for every page you load after that (a one-off page reload may be needed to fully clear an already-loaded script from the current tab, which the control handles for you). The current JetStash implementation does not configure remarketing or personalised advertising. That describes JetStash's code, not every setting or behaviour in Google's or Vercel's wider service ecosystems.

• To reply to your message or quote request.
• To send Travel Club or Route Watch updates you've opted in to receive.
• To keep the website running securely and to prevent abuse.
• With your permission, to measure website usage and performance so we can improve JetStash.
• To meet our legal obligations, where they apply.

UK data protection law requires a lawful basis for each way we use your information:

• Contact form and quote requests: legitimate interests. You've reached out to us directly, and replying is the plainly expected next step.
• Travel Club and Route Watch: consent. You choose to sign up, and every email we send includes a way to unsubscribe.
• Website security and abuse prevention: legitimate interests and, where relevant, legal obligation.
• Site statistics (Vercel Analytics and Speed Insights): consent. These scripts access your device (they look in its browser storage) and send information from it, so the Privacy and Electronic Communications Regulations require us to ask first, and nothing loads until you accept. We also rely on your consent for the personal data they then process under UK GDPR, such as the page address, browser and device type, country and any referrer. You can withdraw consent at any time with ‘Cookie settings’ in the footer. JetStash's event payloads do not include direct identifiers.
• Optional Google Ads measurement: consent. It only ever runs if you actively accept it in the cookie banner, and you can decline it at any time.

We don't rely on ‘contract’ as a basis anywhere on this site. JetStash doesn't take bookings or payments, so there's no contract between you and JetStash to point to.

We don't sell your personal data. We use:

• Vercel, to host this website and its server logs.
• Google, only when you run an Arrive By check: its Maps Platform services (Geocoding, Routes and Places) resolve places and calculate journey times, as described under Arrive By.
• Upstash, a database service that holds Arrive By's short-lived rate-limit entries and its anonymous usage counts.
• Resend, to deliver contact form and quote request emails to us.
• Brevo, to store the Travel Club and Route Watch subscriber list and send those emails.
• A Microsoft 365 mailbox, provided via GoDaddy, which is where email sent to our published addresses actually lands.

We may also share the minimum necessary detail with a professional adviser, such as an accountant or solicitor, or with an authority such as the Information Commissioner's Office, where the law requires it. If, and only if, you accept optional Google Ads measurement, Google Ads receives the configured conversion signals described under Cookies and analytics. The current JetStash code does not put your name, email address, phone number, form contents or the partner URL into those conversion-event payloads. Google's tag may also process ordinary browser, page, device or referrer information according to Google's own service behaviour and policies. We do not use Google Analytics, and the current JetStash implementation does not configure remarketing or personalised advertising.

Some of the service providers we use, including Vercel, Resend, Brevo, Microsoft 365, Google and Upstash, may process personal information outside the UK. Where this happens, JetStash takes reasonable and proportionate steps to use providers that apply appropriate protections and relies on the contractual and legal safeguards available for the relevant processing. The arrangements may vary depending on the provider and the country involved.

We don't keep personal information for longer than we need it for the reason we collected it. Rather than one fixed period for everything, we decide by purpose, as set out below.

• Contact form and quote request messages: kept only for as long as reasonably needed to deal with your enquiry, any follow-up, and any related legal or administrative need. They are deleted when they are no longer needed.
• Travel Club and Route Watch: your email address and preferences are kept while you remain subscribed. If you unsubscribe or ask us to delete your details, we stop using them for those messages and delete them where appropriate, while retaining only the minimum information needed to honour your opt-out or meet a legal obligation.
• Website server logs and security data: held by our hosting provider for the short periods it sets, and used only to keep the site secure and working.
• Arrive By: we do not retain your journey details. The short-lived and anonymous items it does keep are described under Arrive By above.
• Optional Google Ads measurement: used only if you accept it. Google processes that measurement data under its own terms and privacy policy.

To ask what we hold about you, or to have something deleted sooner, email privacy@jetstash.co.uk.

We use security practices proportionate to a small operation like JetStash: our hosting, form and mailing-list providers each run their own security measures, and this site sends security headers on every page, including protections against clickjacking and content-type sniffing. No website can guarantee to be completely secure, and we don't claim ours is. We don't hold any formal security certifications at this time.

Under UK data protection law, you have the right to:

• ask what personal data we hold about you, and get a copy (access)
• ask us to correct anything that's wrong (correction)
• ask us to delete your data (deletion)
• ask us to limit how we use it (restriction)
• object to us using it, particularly for Travel Club or Route Watch emails
• receive your data in a portable format, where that applies
• withdraw consent at any time, for anything we do on the basis of consent

To use any of these rights, email privacy@jetstash.co.uk. We'll respond as quickly as we reasonably can.

If you're unhappy with how we've handled your data, we'd genuinely like the chance to put it right first, at privacy@jetstash.co.uk. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office, at ico.org.uk.

JetStash is built for UK-based adults planning their own international travel. It is not designed for, or aimed at, children, and we don't knowingly collect personal data from children. If you believe a child has given us personal data, contact us at privacy@jetstash.co.uk and we'll remove it.

This site links to airlines, booking partners such as Trip.com, and official government pages for visa and entry information. Once you leave jetstash.co.uk, that site's own privacy practices apply, not ours. We'd encourage you to check them before sharing any personal information.

We'll update this page as the site, or how we use your information, changes. The date below always shows when it was last revised.