Legal
Privacy Policy
What personal information Jetvala collects, why we collect it, who we share it with and the choices you have.
Last updated September 8, 2026
In effect since September 8, 2026
Effective 2026-09-08. Version 3.5.
This policy applies to all visitors and users of Jetvala services. Booking eligibility is limited as stated in the Terms of Service.
1. Who is responsible for your data
This policy is issued by Jetvala Travel LLC, operator of the Jetvala brand, located at 963 Park Ave, Plainfield, NJ 07060. We decide how and why personal information is processed when you use jetvala.com, our apps, our WhatsApp and SMS channels, and our phone support. For privacy questions or requests, contact our Privacy Lead at privacy@jetvala.com.
This policy describes our practices under applicable US privacy law. We provide the request methods in Section 7 to everyone, whether or not a particular state statute applies. Jetvala accepts bookings only from adults who reside in and are physically located in an eligible US state or the District of Columbia. We do not accept bookings from residents of, or persons physically located in, California, Florida, Washington or Hawaii, or the European Economic Area, United Kingdom or Switzerland. People elsewhere may browse informational pages, and we will honor a privacy request submitted through the process below.
2. What we collect
Information you give us when you search or book:
- Traveler details: full name, date of birth, gender as shown on your ID, and, where the airline or destination requires it, passport or national ID number, issuing country, expiry date and nationality.
- Secure Flight data for covered flights: name, date of birth, gender, and any Known Traveler Number or Redress Number you choose to provide. Before collecting it online, we make the complete TSA Privacy Notice below available as required by 49 CFR 1560.103.
TSA Privacy Notice
The Transportation Security Administration of the U.S. Department of Homeland Security requires us to collect information from you for purposes of watch list screening, under the authority of 49 U.S.C. section 114, and the Intelligence Reform and Terrorism Prevention Act of 2004. Providing this information is voluntary; however, if it is not provided, you may be subject to additional screening or denied transport or authorization to enter a sterile area. TSA may share information you provide with law enforcement or intelligence agencies or others under its published system of records notice. For more on TSA Privacy policies, or to view the system of records notice and the privacy impact assessment, please see TSA's Web site at www.tsa.gov.
- Contact details: email address, phone number, WhatsApp number, billing address.
- Payment details: your card is processed by Stripe, our payment provider. Jetvala never receives your full card number. We store a Stripe payment identifier (never the card number), together with the last four digits and card brand for your receipt, and we use that identifier to issue refunds.
- Transfer, car rental, tour, and group or charter details when you request a quote for those services.
- Travel preferences and special requests: meal, seat, wheelchair or other assistance, frequent flyer numbers.
- Messages you send us on WhatsApp, SMS, email, chat or phone, and notes our team makes while helping you.
- Anything you add to your account, such as saved travelers.
Sensitive and special-request information. When you voluntarily provide passport, citizenship, health, disability, accessibility, dietary or similar information, you instruct us to use and share it only as needed to arrange the booking or assistance you requested, comply with law, prevent fraud or handle a claim. You may withdraw an optional request or consent by contacting us, but withdrawal does not undo prior lawful processing and may not be possible where the information is still required for travel, recordkeeping or a legal claim.
Information we collect automatically: IP address, device and browser type, language, pages viewed, searches made, referring site, and approximate location derived from IP. We collect this through server logs and the strictly necessary cookies described in our Cookie Notice. We do not use third-party analytics tools today, and we do not use an advertising service.
Information from others: airlines, ground service providers and our travel technology provider send us booking status, ticket numbers, schedule changes and refund decisions. Our payment provider sends us fraud signals. If you sign in through a third party in future, we will receive the identifiers you authorize.
Minors. Jetvala's services are for adults. A traveler under 18 must be booked by a parent or legal guardian, who attests at booking that they are entitled to book for the child and to give us the child's details. We do not knowingly collect information from children under 13 except as traveler details entered by a parent or guardian for a booking.
3. Why we use it
| Purpose | Examples | Legal basis (where required) |
|---|---|---|
| Making and managing your booking | sending traveler data to the airline or ground service provider, issuing tickets, sending confirmations and schedule changes, processing refunds | Contract |
| Legal duties | Secure Flight, sanctions screening, tax and accounting records, responding to lawful requests | Legal obligation |
| Support | answering your messages, resolving problems with the airline or provider | Contract, legitimate interest |
| Fraud prevention and security | checking payments, detecting abuse, protecting accounts | Legitimate interest, legal obligation |
| Improving Jetvala | understanding which routes people search, fixing bugs, testing features, using our own server logs | Legitimate interest |
| Marketing, only if you opt in | fare alerts, route news, promotions by email, SMS or WhatsApp | Consent |
We do not use your data for automated decisions that have legal or similarly significant effects on you. We do not sell your personal information, and we do not use it for targeted advertising.
4. Who we share it with
We share personal information only with parties who need it to serve you or where the law requires it.
| Recipient | What and why | Where |
|---|---|---|
| Airlines and their systems | Traveler, contact and Secure Flight data to issue and manage your ticket. Each airline handles your data under its own privacy policy. | Airline's country |
| Ground service providers (transfers, car rentals, tours, group and charter operators) | Traveler and booking details for a service you accepted in a concierge quote. | Provider's country |
| Duffel (flight booking platform) | Passes booking data between Jetvala and airlines. | United States and United Kingdom |
| Stripe (payments) | Processes your card payment and refunds and performs fraud screening. Jetvala never receives your full card number; we keep a Stripe payment identifier to issue refunds. | United States |
| Neon (database) | Hosts our database. | United States (US East) |
| Vercel (hosting and edge network) | Hosts the site and runs our application code. Vercel's edge network may serve static content from locations close to the visitor. | United States, with edge locations worldwide for static content |
| Resend (email delivery) | Sends transactional and, if you opted in, marketing email. | United States |
| Twilio (SMS and WhatsApp), only when those channels are enabled | Delivers transactional and, if you opted in, marketing messages. SMS and WhatsApp sending is not yet switched on. | United States |
| Government agencies | TSA (Secure Flight), Customs and Border Protection, and foreign authorities where a destination requires passenger data (APIS), and law enforcement under valid legal process. | Various |
| Professional advisers and successors | Accountants, lawyers, insurers, and any buyer of the business under confidentiality. | United States |
Vendors process data under written terms that limit their use of your data to the services they provide to us. We will update this list when a vendor changes.
Where our systems are. Our database is in the United States (Neon, US East). Our web application runs on Vercel, whose edge network may serve static content from locations close to the visitor. Airlines, ground service providers and destination governments are often outside the United States; your booking data travels to them because the trip requires it.
5. How long we keep it
We delete from our live systems on the schedule below. Encrypted backups are retained up to 35 days and then expire, so a record can remain in a backup for up to 35 days after it is deleted from the live system.
| Data | Retention |
|---|---|
| Tax and accounting records | For the period required by applicable law: generally at least 3 years after the return is filed; at least 4 years for employment-tax records; longer when a longer limitations period, claim, audit, legal hold or other law applies |
| Booking records, receipts, disclosures shown at checkout, and refund evidence | 5 years after travel |
| Booking travel document data: passport number, date of birth, gender, Known Traveler Number and Redress Number collected to complete a booking (each encrypted at rest with AES-256-GCM), together with the issuing country, expiry date and nationality stored with them | Deleted from active systems 90 days after the last scheduled flight on the booking, subject to legally required retention and to backup copies that expire within 35 days |
| Saved Traveler Profile data: the same fields when you choose to save them to a traveler profile in your account (passport number, date of birth, gender, Known Traveler Number and Redress Number encrypted at rest with AES-256-GCM) | Kept until you delete the profile information or close your account. When you delete saved traveler information yourself, it is removed from active systems immediately. When you ask us to close your account, it is deleted from active systems within 30 days of your request. Backup copies expire within 35 days |
| Support messages and notes | 2 years after the last message |
| Marketing consent evidence (date, time, number, how you opted in) | As long as we rely on the consent, plus 4 years |
| Permanent suppression list (numbers and addresses that opted out) | Indefinitely, so we never contact you again by mistake |
| Login codes | 1 day |
| Search history | 400 days |
| Account data | Until you delete your account, then 30 days |
| Backups | Encrypted backups are retained up to 35 days and then expire |
| Legal holds | Any data subject to a litigation hold, regulator request or open dispute is kept until the matter closes, then handled per the rows above |
Retention exceptions. We may keep a record longer when a tax rule, legal hold, court order, regulator request, unresolved dispute, fraud investigation or seller-of-travel rule requires it. When the reason ends, the schedule above applies. Backup copies expire through the ordinary backup cycle and are not restored for ordinary business use after a deletion request.
6. How we protect it
Data in transit is encrypted with TLS. Passport numbers, dates of birth, gender, Known Traveler Numbers and Redress Numbers are encrypted at rest with AES-256-GCM. Access to travel-document data is limited to personnel who need it to complete or support a booking. Stripe processes card details; Jetvala keeps the Stripe payment identifier, last four digits and card brand used for receipts and refunds. We use one-time email codes rather than a reusable Jetvala password. No system is perfectly secure; if a breach affects your data, we will give the notices required by law.
7. Your choices and rights
Depending on where you live, you may have the right to:
- Know what personal information we hold about you and receive a copy.
- Correct inaccurate information.
- Delete your information, subject to records we must keep by law.
- Opt out of the sale or sharing of personal information and of targeted advertising. Jetvala does not sell personal information and does not use it for targeted advertising, so there is nothing to opt out of today. We honor the Global Privacy Control browser signal and will treat it as an opt-out if that ever changes.
- Limit the use of sensitive personal information to what is needed to provide the service.
- Withdraw consent to marketing at any time. Reply STOP to any SMS or WhatsApp message, click unsubscribe in any marketing email, or contact us.
- Appeal a decision we make on your request.
- Not be discriminated against for exercising your rights.
To make a request, email our Privacy Lead at privacy@jetvala.com from the address on your booking, or write to us at 963 Park Ave, Plainfield, NJ 07060. We will verify your identity by sending a code to the email or phone on file and, for sensitive data, may ask for the booking reference. You can use an authorized agent; we will ask for proof of authorization. We respond within 45 days and will tell you if we need more time. New Jersey and California residents who disagree with our response can appeal by replying to our decision; we will answer the appeal within 45 days and tell you how to contact your state attorney general.
California residents. Jetvala started operating in 2026 and has not yet completed 12 months of activity. Since we began, we have collected only the categories listed in Section 2 for the purposes in Section 3 and disclosed them only to the recipients in Section 4; we will keep this statement current as our data inventory changes. We do not sell or share personal information as those terms are defined in the CCPA, and we have no actual knowledge of selling or sharing the data of anyone under 16. Under California's Shine the Light law you may ask once a year for a list of third parties to whom we disclosed personal information for their own direct marketing; we do not do this.
Nevada residents. We do not sell covered information as defined in NRS 603A. You may still submit an opt-out request to privacy@jetvala.com.
8. Do Not Track and Global Privacy Control
We honor the Global Privacy Control signal. Browsers' older "Do Not Track" setting has no agreed meaning, so we do not respond to it. We do not use third-party analytics tools today, and we do not run advertising trackers on the site.
9. Marketing messages
We send marketing email only if you opt in, and every message has an unsubscribe link.
SMS and WhatsApp. Email is the default channel for booking notices. We send booking notices by SMS or WhatsApp only after the separate unchecked consent for that channel. SMS marketing and WhatsApp marketing each require their own separate unchecked box and prior express written consent, which is never required to book. STOP ends the selected channel. A later START may reactivate only the category and channel covered by your most recent valid consent and does not create written marketing consent where none exists. We keep a channel- and number-specific suppression record. Reply HELP for help. Details are on our SMS and WhatsApp Consent page.
10. Links to other sites
Airline, provider, partner and government sites have their own privacy policies. We are not responsible for them.
11. Changes to this policy
When we change this policy, we will update the date at the top and, for material changes, notify you by email or a notice on the site before the change applies. Past versions are available on request.
12. Contact
- Privacy requests: Privacy Lead, privacy@jetvala.com
- General support: support@jetvala.com
- Mail: Jetvala Travel LLC, 963 Park Ave, Plainfield, NJ 07060
Applicability. Some state-law rights depend on statutory thresholds and definitions. Jetvala nevertheless offers the request process in Section 7 to everyone. We do not sell personal information or use it for targeted advertising. If those practices change, we will update this policy and implement any required opt-out mechanism before the change begins.