Your data, handled the way everything else here is: plainly

JetStash is operated by Faiz Ahmed, trading as JetStash. For anything to do with your personal data, JetStash is the controller: the one who decides what's collected and why.

For any privacy question, to see what we hold about you, or to ask us to delete it, email privacy@jetstash.co.uk directly.

What we collect depends entirely on how you use the site:

• Contact form: your name, email address and the message you send.
• Quote request: your name, email address, trip type and region, and any optional details you choose to add, such as phone number, traveller count, approximate travel dates or a budget note.
• Travel Club or Route Watch sign-up: your email address, and any optional preferences you give us, such as your nearest UK airport, travel interest, or the specific route you'd like us to watch.
• Technical information generated automatically by visiting the site: your IP address, browser and device information, and standard web server logs.
• Aggregate, cookieless usage information, described under Cookies and analytics below.
• Only if you explicitly accept optional Google Ads measurement: JetStash loads the Google Ads tag and sends configured conversion signals for certain flight, hotel or baggage-partner clicks. JetStash's current code does not put your name, email address, phone number, address, form contents or the partner URL into those conversion-event payloads. Google may also process ordinary browser, page, device or referrer information according to Google's own service behaviour and policies.

Travel Ready Check is different from everything above. Whether you're travelling on a British passport, which document exemption applies to you, and the dates you enter, are used only to work out an answer inside your own browser. None of it is sent to us, stored by us, or seen by us. See How we collect information below for more on this.

We do not ask for, and do not knowingly collect, passport or other document numbers, payment card details, copies of passports or other identity documents, or any other sensitive document files. Travel Ready Check asks which type of document or exemption applies to you, never the document itself.

We collect information when you fill in a form on this site, subscribe to Travel Club or Route Watch, email us directly, or simply browse the site, which generates the standard technical information described above. Travel Ready Check works entirely differently: it runs in your browser and never sends what you enter anywhere, including to us.

JetStash doesn't use cookies for anything by default. Vercel Web Analytics and Vercel Speed Insights operate independently of Google Ads consent and are built to work without cookies. JetStash's own analytics event payloads contain named events with limited contextual fields such as route, destination, state, source, trip type, region, intent, verdict or interest — not names, email addresses, phone numbers or form contents. Vercel and its services may process ordinary technical information needed to provide those services.

Separately, a cookie banner shown on your first visit offers optional Google Ads measurement. Nothing about the Google Ads tag loads until you actively accept: no Google script is requested before that point, or if you decline, or if you close the banner without choosing. If you accept, JetStash loads the Google Ads tag and sends configured conversion signals for certain flight, hotel or baggage-partner clicks. The current JetStash code does not put your name, email address, phone number, address, form contents or the partner URL into those conversion-event payloads. Google's tag may also process ordinary browser, page, device or referrer information according to Google's own service behaviour and policies.

Your choice is remembered locally in your own browser, not in a JetStash account or server-side profile. You can see and change it at any time using ‘Cookie settings’ in the footer of every page — declining after previously accepting switches this measurement off again for every page you load after that (a one-off page reload may be needed to fully clear an already-loaded Google script from the current tab, which the control handles for you). The current JetStash implementation does not configure remarketing or personalised advertising. That describes JetStash's code, not every setting or behaviour in Google's wider account ecosystem.

• To reply to your message or quote request.
• To send Travel Club or Route Watch updates you've opted in to receive.
• To keep the website running securely and to prevent abuse.
• To understand, in aggregate, how the site is used, so we can improve it.
• To meet our legal obligations, where they apply.

UK data protection law requires a lawful basis for each way we use your information:

• Contact form and quote requests: legitimate interests. You've reached out to us directly, and replying is the plainly expected next step.
• Travel Club and Route Watch: consent. You choose to sign up, and every email we send includes a way to unsubscribe.
• Website security and abuse prevention: legitimate interests and, where relevant, legal obligation.
• Analytics and Speed Insights: legitimate interests, limited to understanding overall site usage and product or route interaction. JetStash's event payloads do not include direct identifiers.
• Optional Google Ads measurement: consent. It only ever runs if you actively accept it in the cookie banner, and you can decline it at any time.

We don't rely on ‘contract’ as a basis anywhere on this site. JetStash doesn't take bookings or payments, so there's no contract between you and JetStash to point to.

We don't sell your personal data. We use:

• Vercel, to host this website and its server logs.
• Resend, to deliver contact form and quote request emails to us.
• Brevo, to store the Travel Club and Route Watch subscriber list and send those emails.
• A Microsoft 365 mailbox, provided via GoDaddy, which is where email sent to our published addresses actually lands.

We may also share the minimum necessary detail with a professional adviser, such as an accountant or solicitor, or with an authority such as the Information Commissioner's Office, where the law requires it. If, and only if, you accept optional Google Ads measurement, Google Ads receives the configured conversion signals described under Cookies and analytics. The current JetStash code does not put your name, email address, phone number, form contents or the partner URL into those conversion-event payloads. Google's tag may also process ordinary browser, page, device or referrer information according to Google's own service behaviour and policies. We do not use Google Analytics, and the current JetStash implementation does not configure remarketing or personalised advertising.

Some of the service providers we use, including Vercel, Resend, Brevo and Microsoft 365, may process personal information outside the UK. Where this happens, JetStash takes reasonable and proportionate steps to use providers that apply appropriate protections and relies on the contractual and legal safeguards available for the relevant processing. The arrangements may vary depending on the provider and the country involved.

We don't yet have formal, fixed retention periods set for every kind of information described above. As a general principle, we keep it for as long as it's needed for the purpose it was collected for, for example for as long as you stay subscribed to Travel Club or Route Watch, or for a reasonable period after we've answered a one-off enquiry, and delete or anonymise it once that purpose has passed. Setting exact retention periods for each type of data is still on our to-do list and needs a formal decision. Email privacy@jetstash.co.uk if you'd like more detail on a specific case in the meantime.

We use security practices proportionate to a small operation like JetStash: our hosting, form and mailing-list providers each run their own security measures, and this site sends security headers on every page, including protections against clickjacking and content-type sniffing. No website can guarantee to be completely secure, and we don't claim ours is. We don't hold any formal security certifications at this time.

Under UK data protection law, you have the right to:

• ask what personal data we hold about you, and get a copy (access)
• ask us to correct anything that's wrong (correction)
• ask us to delete your data (deletion)
• ask us to limit how we use it (restriction)
• object to us using it, particularly for Travel Club or Route Watch emails
• receive your data in a portable format, where that applies
• withdraw consent at any time, for anything we do on the basis of consent

To use any of these rights, email privacy@jetstash.co.uk. We'll respond as quickly as we reasonably can.

If you're unhappy with how we've handled your data, we'd genuinely like the chance to put it right first, at privacy@jetstash.co.uk. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office, at ico.org.uk.

JetStash is built for UK-based adults planning their own international travel. It is not designed for, or aimed at, children, and we don't knowingly collect personal data from children. If you believe a child has given us personal data, contact us at privacy@jetstash.co.uk and we'll remove it.

This site links to airlines, booking partners such as Trip.com, and official government pages for visa and entry information. Once you leave jetstash.co.uk, that site's own privacy practices apply, not ours. We'd encourage you to check them before sharing any personal information.

We'll update this page as the site, or how we use your information, changes. The date below always shows when it was last revised.