Privacy Policy

Hopway is a travel planning application operated by Spacetime Technology, registered in Dubai Silicon Oasis, Dubai, United Arab Emirates. We are the data controller responsible for your personal data.

We collect the following categories of personal data:

• Account information. Your email address and, if you sign in with Apple or Google, the profile information those services share with us (typically name and email).
• Booking and travel content. The content of booking confirmation emails and travel documents you forward or import into the app. This may include names, flight numbers, dates, reference codes, and other details contained in those documents.
• Location search queries. When you search for a destination or point of interest within the app, your query is sent to a third-party places lookup service to return results. We do not store your precise device location.
• Country presence (optional). If you turn on automatic country tracking in the Passport, your device uses its location, including in the background, to work out which country you are in. The lookup happens on your device: your coordinates never leave your phone, and only the resulting country and date are stored in your account. Detected countries are marked in the app, you can edit or delete them, and you can turn the feature off at any time. It is off by default.
• Usage data. Information about how you interact with the Service, including pages visited, features used, and error logs. This is used to improve the Service.
• Device information. Device type, operating system, and app version, collected for compatibility and debugging purposes.

We use your personal data to:

• Create and maintain your account.
• Parse your booking documents and build your travel timeline.
• Add the countries you visit to your Passport, when you have turned on automatic country tracking.
• Retrieve flight status and travel information from third-party data providers.
• Process subscription payments for Hopway Plus.
• Send transactional emails (account confirmation, password reset, subscription receipts).
• Diagnose and fix technical issues.
• Improve and develop new features of the Service.
• Comply with legal obligations.

For users in the European Economic Area and United Kingdom, our legal bases for processing your personal data are:

• Contract. Processing necessary to deliver the Service under our Terms and Conditions (account management, booking parsing, subscriptions).
• Legitimate interests. Service improvement, fraud prevention, and security, where our interests are not overridden by your rights.
• Legal obligation. Where we are required to retain or share data by applicable law.
• Consent. For optional analytics or marketing communications, where we ask for your consent before processing.

We share your data with the following third-party processors as necessary to provide the Service. All processors are bound by data processing agreements and handle your data only on our instructions.

• Cloud hosting and storage. Your account, trip timeline, and booking content are stored and processed on cloud infrastructure providers that host the Service.
• Automated processing of your bookings. To turn a forwarded booking, uploaded document, or voice note into a timeline entry, its contents are processed by automated services, including third-party AI providers that extract the relevant details. We do not use this content for advertising.
• Analytics and diagnostics. We use analytics and crash-diagnostics providers to understand how the Service is used and to detect and fix errors. Product events are associated with your account identifier so we can measure feature usage; we do not send them your booking content.
• Advertising measurement (marketing site). We use TikTok's pixel on hopway.io to measure how our TikTok ads perform (for example, page visits and app-download button taps). That involves sharing limited browser and event data with TikTok for ad delivery, measurement, and optimisation under TikTok's terms. We do not send your trip or booking content to TikTok.
• Maps and places. Location and place searches you enter are sent to third-party maps and places providers to show results and render maps.
• Email delivery. Transactional emails (verification, password reset, trip invites) are sent through an email delivery provider.
• Sign in with Apple / Google. If you choose to sign in with Apple or Google, those services share limited profile information with us as part of the authentication flow.
• App Store / Google Play billing. Subscription payments are handled by Apple or Google. We do not store your payment card details.

We do not sell your personal data to third parties. We do not share trip or booking content for advertising. We do share limited marketing-site event data with TikTok as described above so we can run and measure our own ads.

We retain your account data and trip content for as long as your account remains active. If you delete your account, we will delete your personal data within 30 days except where retention is required by law (for example, financial records related to subscription transactions, which we may retain for up to 7 years).

Anonymised, aggregated usage analytics that cannot be linked back to you may be retained indefinitely.

Depending on where you are located, you may have the following rights regarding your personal data:

• Access. Request a copy of the personal data we hold about you.
• Correction. Ask us to correct inaccurate or incomplete data.
• Deletion. Request deletion of your personal data, subject to legal retention obligations. You can delete your account and its data from inside the app (Account > Delete account) or by following the steps at hopway.io/delete-account.
• Portability. Receive your data in a structured, machine-readable format.
• Objection. Object to processing based on legitimate interests.
• Restriction. Request that we restrict processing in certain circumstances.

These rights apply to users in the EU/EEA (under GDPR), the UK (under UK GDPR), and the UAE (under UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection).

Your data may be transferred to and processed in countries outside your country of residence, including the United States and other locations where our third-party processors operate. Where required, we rely on standard contractual clauses or other lawful transfer mechanisms to safeguard your data.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. This includes encryption in transit (TLS) and at rest, access controls, and regular security reviews. No transmission over the internet is completely secure, and we cannot guarantee absolute security.

The Service is not directed at children under 16. We do not knowingly collect personal data from children under 16. If you become aware that a child has provided us with personal data, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by a notice within the Service at least 14 days before they take effect. The updated policy will always be available at this page.

If you are in the EU/EEA and believe we have handled your data unlawfully, you have the right to lodge a complaint with your local data protection authority.