This policy provides an overview of how personal data is processed when using the JetOpti platform. Personal data means any information relating to an identified or identifiable person.
JetOpti
Ronny Stephan
Großenhainer Str. 98
01127 Dresden
Germany
Email: info@jetopti.com
When you contact us or submit a booking request, we process the data necessary to handle your request.
Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures)
Registered users provide login credentials and profile information. Passwords are stored in encrypted form via Supabase.
You can also send a request without registering first. We then send a one-time code to the email address you entered in the request form. Entering the code confirms that the address is yours and signs you in. If you do not have an account yet, a customer account is created with the name, email address and phone number from the form, so that you can follow your request and pay for it once the operator accepts. No password is needed for this; you can sign in again at any time with a new code.
Legal basis: Art. 6(1)(b) GDPR
JetOpti uses cookies and similar technologies to ensure platform functionality and, with your consent, to analyze usage patterns. You can manage your preferences via our Cookie Consent banner.
These cookies are essential for the platform to function and cannot be disabled:
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing a functional website)
With your consent, we use Google Analytics to understand how visitors interact with our platform and to improve our services.
Data collected: Page views, session duration, device type, browser information, approximate location (country/city level), referral source.
IP anonymization: Enabled – the last octet of your IP address is removed before storage.
Website only: Google Analytics runs on our website. Our iOS and Android apps never load it and set no analytics cookies. The consent you give inside the app covers only the analysis of our request form described below.
Legal basis: Art. 6(1)(a) GDPR (your consent)
Opt-out: You can withdraw your consent at any time via the "Cookie Settings" link in the footer of our website, or using the button at the end of this section. You can also install the Google Analytics Opt-out Browser Add-on.
Data may be transferred to Google servers in the USA. Google is certified under the EU-US Data Privacy Framework. For more information, see Google Privacy Policy.
If you have consented to analytics, we record when you open a request form, which entry point you came from (AI Jet Match, the map, or a hot deal), the aircraft, route, number of passengers and the price shown to you, the platform used (web, iOS or Android), and whether you sent the request or left the form — and if you left it, how far you had got. If you are signed in, the record is linked to your user account. We use this to find out where our booking process fails people, so that we can fix it. We do not store your IP address, device or browser identifiers, or referring page with these records, and we do not use them for advertising or profiling. No cookies are set for this; the records are written on our own servers.
Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).
Withdrawal: You can withdraw your consent at any time via the "Cookie Settings" link in the footer of our website, or using the button below. Withdrawal stops any further recording; it does not affect records already made.
Retention: We delete these records after 12 months.
If you have consented to analytics, we also record when you open our operator calculator (jetopti.com/calculator) and which values you try there: route, price, markup and broker margin. Links that we send to charter operators contain a short code for the company (for example ?ref=company-name), so that we can see which of our messages led to a visit. We use this to understand whether our offer is useful to operators. We do not store your IP address, device or browser identifiers, or referring page with these records, and we do not use them for advertising or profiling. No cookies are set for this; the records are written on our own servers.
Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).
Withdrawal and retention: as for the request form analytics above. We delete these records after 12 months.
Cookie Settings
We use Mapbox to display interactive maps showing aircraft positions, airports, and routes. When you view the map, your browser connects to Mapbox servers and transmits your IP address and device information. To count map loads, Mapbox stores a random identifier in your browser's local storage. This also applies to the booking widget on a charter company's website.
Provider: Mapbox Inc., 740 15th Street NW, Washington, DC 20005, USA
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing core platform functionality)
For more information, see Mapbox Privacy Policy.
We use Resend to send transactional emails such as booking confirmations, payment receipts, and account notifications. The following data is shared with Resend for email delivery:
Provider: Resend Inc., San Francisco, CA, USA
Legal basis: Art. 6(1)(b) GDPR (contract fulfillment)
For more information, see Resend Privacy Policy.
To display real-time aircraft positions on the map, we query publicly available ADS-B data from community-operated services. Only aircraft registration data is queried — no personal user data is transmitted.
Providers: adsb.lol, airplanes.live, adsb.fi
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing live tracking)
We use Notamify to retrieve Notices to Airmen (NOTAMs) for airports relevant to scheduled flights. No personal user data is shared with Notamify.
Provider: Notamify
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing operational aviation data)
For charter companies using our platform, we integrate with their Flight Management Systems (Leon Software, FL3XX) to synchronise fleet, schedule and crew data. This may include names and contact details of crew members provided by the charter company. The charter company remains responsible for informing its personnel about this processing.
Providers: Leon Software Sp. z o.o. (Poland), FL3XX GmbH (Austria)
Legal basis: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(f) GDPR (legitimate interest in providing operational platform functionality)
Charter companies can use an AI assistant to query their own fleet and schedule data. Requests are processed by Anthropic PBC (USA). No customer or passenger data is transmitted. Data transfers are safeguarded by EU Standard Contractual Clauses.
Provider: Anthropic PBC, San Francisco, CA, USA
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing operational tooling to charter companies)
When you search for a flight — on our website, in our mobile apps, or through a booking widget on a charter company's website — we record the search itself: departure and destination airport, requested date and time, number of passengers, luggage category, route distance, how many aircraft matched, the lowest price shown, the positioning distance of the best match, and, where no aircraft matched, the reason. If you are signed in, the record is linked to your user account.
We use this to identify demand we cannot currently serve, so that we can add charter companies in those regions and improve availability. We do not store your IP address, device or browser identifiers, or referring page with these records, and we do not use them for advertising or profiling. For the website widget we also count how often it is loaded and how often visitors continue to jetopti.com, without IP address and without an identifier of the device.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in analysing demand and improving the availability of our service). You may object to this processing at any time under Art. 21 GDPR — see section 7.
If you tick the corresponding box — during registration, or later in your profile under "Hot Deal Alerts" — we email you when a discounted empty leg matches your saved airports. The box is never pre-ticked, and registering does not depend on it.
Legal basis: Art. 6(1)(a) GDPR (your consent)
Withdrawal: Every one of these emails carries an unsubscribe link that works without signing in, and the switch in your profile turns them off at any time. Withdrawal takes effect immediately and does not affect the lawfulness of the processing carried out beforehand.
We are required to be able to demonstrate that consent was given (Art. 7(1) GDPR). Each time consent is given or withdrawn, we therefore record:
Consent given during registration is recorded at your first sign-in, because that is the point at which your email address is confirmed. The time of registration is stored alongside it.
Where you unsubscribe through the one-click button of your email provider, the IP address recorded is that of the provider's server rather than your own device. The record states which of the two it is.
Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR (compliance with the obligation to demonstrate consent)
Retention period: Three years after consent is withdrawn or the account is deleted, matching the standard limitation period under German law (§ 195 BGB).
Server logs are collected for technical security and stability. Log files are deleted after 14 days.
Payments are processed via Stripe. Payment is made directly to the charter company's Stripe account; the charter company is the recipient of the payment and processes your payment data as an independent controller. JetOpti receives only its commission and does not store full credit card details.
Legal basis: Art. 6(1)(b) GDPR
Stripe may process data in the EU and USA under Standard Contractual Clauses. For more information, see Stripe Privacy Policy.
For accounting and legal compliance, transaction-related data such as booking references, payment status and timestamps are stored.
Retention period: 10 years (tax law)
To protect our platform from spam and automated abuse, we use Google reCAPTCHA on the registration form of our website. Our mobile apps do not use reCAPTCHA.
reCAPTCHA analyzes user behavior to determine whether the interaction is performed by a human or a bot. This may involve the transmission of the following data to Google:
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in preventing fraud and ensuring platform security)
Data may be transferred to Google servers in the USA. Google is certified under the EU-US Data Privacy Framework. For more information, see Google Privacy Policy and Google reCAPTCHA Terms.
The platform is hosted via:
Data processing agreements (DPAs) are in place with all hosting providers. Data is stored on EU servers where possible, with appropriate safeguards for international transfers.
Legal basis: Art. 6(1)(b) GDPR (necessary for platform operation)
JetOpti is available as a native mobile application on the Google Play Store (Android) and the Apple App Store (iOS). The mobile apps provide the same functionality as the web platform with additional native features.
With your permission, the JetOpti app sends push notifications for:
You can disable push notifications at any time through your device settings. When you grant notification permissions, a device token is generated and stored in our database to deliver notifications.
Legal basis: Art. 6(1)(a) GDPR (your consent)
Push notifications are delivered via Google Firebase Cloud Messaging. The following data is processed:
Firebase may process data on Google servers. No personal user data beyond the device token is shared with Firebase. For more information, see Firebase Privacy Policy.
Legal basis: Art. 6(1)(a) GDPR (your consent via notification permission)
When you download JetOpti from the Google Play Store or Apple App Store, the respective store operator may collect data according to their own privacy policies. JetOpti has no control over this data collection.
The JetOpti app may request the following device permissions:
No location data, camera access, contacts, or other sensitive device data is collected by the JetOpti app.
Under the GDPR, you have the following rights regarding your personal data:
To exercise any of these rights, contact us at: info@jetopti.com
You also have the right to lodge a complaint with a supervisory authority. The authority responsible for JetOpti is:
Sächsischer Datenschutzbeauftragter
Devrientstraße 5, 01067 Dresden, Germany
https://www.saechsdsb.de
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, or misuse:
Despite our best efforts, no method of transmission over the internet is 100% secure. We continuously work to improve our security measures.
Some of our service providers may process data outside the European Economic Area (EEA). Data transfers to third countries are safeguarded using:
Personal data is retained only as long as necessary for the purposes for which it was collected:
You can request deletion of your data at any time, subject to legal retention obligations.
JetOpti is not directed at children under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately.
This privacy policy may be updated to reflect legal, technical, or operational changes. We will notify users of significant changes via email or platform notification.
Last updated: October 2026
Version: 1.9
For questions about this privacy policy or data protection matters, please contact:
JetOpti - Data Protection
Ronny Stephan
Email: info@jetopti.com