Privacy policy

Who is responsible

Bonusinsider (Norwegian org. no. pending) is the data controller for personal data collected on bonusinsider.no. Privacy questions go to kontakt@bonusinsider.no.

What data we process

• Account: your email address when you create an account. If you sign in with Google or Apple, we receive what the provider shares (email, and possibly name and profile picture).
• Content you save: saved trips, the journey builder and alerts (the route, date and cabin you want watched). Alerts are used to email you when award seats open.
• Subscription: if you take out Premium, our payment provider Stripe processes your card details — they are never stored with us. We keep only a customer reference and the subscription status.
• Anonymous usage statistics: which routes are searched, counted once per session via a random session cookie, with no link to your identity. The statistics are used to prioritise which routes we monitor. Visit statistics (Vercel Analytics) are cookie-free and aggregated.

Searching and browsing without an account involves no processing beyond the anonymous statistics above.

Purposes and legal basis

• Contract (GDPR art. 6(1)(b)): providing your account, saved trips, alerts and subscription.
• Legitimate interest (art. 6(1)(f)): operation and security, and anonymous statistics to prioritise which routes we monitor.
• Consent (art. 6(1)(a)): the map loads content from Mapbox, and only does so once you have consented in the cookie settings.

Cookies and local storage

• Necessary: sign-in cookies (Supabase) that keep you logged in, and a random session id that counts a route search once per session. Sign-in is per site, so you log in separately on each of our country domains.
• Local storage in your browser: theme and your cookie choice. These settings stay on your device and are not sent to us.
• Map (optional): map content from Mapbox loads only after consent.

You can change your choices at any time via the "Privacy and cookies" link at the bottom of the page.

Providers (data processors)

We use a small set of providers to run the service:

• Supabase — database and sign-in
• Vercel — hosting and cookie-free visit statistics
• Stripe — payment and subscriptions
• Resend — sending email (login codes and alerts)
• Mapbox — map rendering, only after consent

Some providers may process data outside the EEA. Such transfers rely on a valid transfer mechanism, such as the EU-U.S. Data Privacy Framework or the EU standard contractual clauses.

How long we keep data

Account details and content you have saved are kept until you delete them or ask us to delete the account. Payment records are kept for as long as accounting law requires. Anonymous statistics are kept as aggregate figures.

Your rights

You have the right of access to, correction of and deletion of your data, as well as restriction, data portability and to object to processing based on legitimate interest. To exercise your rights — for example to have your account deleted — email kontakt@bonusinsider.no. Requests are answered without undue delay.

If you believe we process your data incorrectly, you can complain to Datatilsynet (Norway), or to the supervisory authority in your own country of residence.

Changes

For material changes to this policy the date at the top is updated, and you are notified in the service if the change affects you. See also the terms of use.