Privacy policy
Updated 21 October 2026
WEB LOVE Ltd (УЕБ ЛОВ ЕООД), Bulgarian company number 207677341, operates AirMark and controls your personal data. For privacy questions or requests, email [email protected].
Company details and postal address: About AirMark.
What we use and why
We use your account, profile, flights, hotels, booking details, notes, forwarded emails and uploaded documents to provide the features you choose. Google or Apple sign-in supplies an identifier, email, verification status and available profile details; it does not give us access to your mailbox, contacts or files. Passwords are stored as hashes. Google access tokens are not saved; Apple authorization tokens are encrypted for account-deletion revocation.
Providing account, travel, import and sharing features relies on performance of our contract with you (GDPR Article 6(1)(b)). Security and troubleshooting rely on legitimate interests (Article 6(1)(f)). Optional device location relies on consent (Article 6(1)(a)), which you can withdraw in device or browser settings. Account details are needed to sign in; other data is needed only for the feature you choose.
Session records include browser/device labels and sign-in and last-active times. Troubleshooting records can include your account identifier, IP address, browser information, error messages, affected page/action and technical traces. We use these to secure the service and investigate failures.
Imports and AI
Forwarded emails, attachments, uploaded files and hotel details may be processed by Google's paid Gemini API under its data-processing terms. Validated email flights and hotels are saved independently; uncertain flights and uploaded documents require review. AI does not make decisions with legal or similarly significant effects. Original documents are private; authorized administrators may inspect them and diagnostics to resolve problems. Only submit other travellers' information when you are entitled to do so.
Optional device features
Location helps show travel hints for up to 15 minutes and is not saved to your account. Camera access scans friend QR codes. Camera frames stay on your device; the decoded email is used for the friend request you choose to send. You can use an email address instead and revoke camera or location permissions in device settings.
Notifications use delivery identifiers and may show travel details or names on your lock screen. Your browser or operating system's push provider processes notification content and delivery identifiers. Disable notifications in the app or device settings. The map remembers its last viewed area; external map providers may receive that area and network information.
Sharing
Accepted friends can see your existing and future flights. Anyone with a public flight link can view the shared flight. Friend requests and friendships store names, emails and sharing records. Sharing does not expose private emails or hotel reservations. Remove friends or revoke links to stop that access; recipients may have kept copies. Blocking ends friend sharing and prevents friend requests between the accounts. We keep your blocks until you unblock someone or delete your account. Public links remain accessible to anyone who has them until revoked.
Abuse reports
When you report abuse, we store your message, account identifier, submission time and review status so our admin team can investigate and protect users. Reports are not shared with other users or processed by AI. This relies on our legitimate interests in preventing misuse (GDPR Article 6(1)(f)). Reports remain until your account is deleted, are included in your data export and are erased during account cleanup.
Providers and security
Railway hosts the app and database; Cloudflare provides delivery, security and inbound email storage; Brevo sends account emails; Microsoft provides the mailbox for privacy requests; Google and Apple provide sign-in and native push delivery; Gemini processes AI requests. Mapbox supplies maps when selected and receives map-load events with a rotating device identifier for billing. Flight-data providers supply schedules and aircraft information. Airplanes.live supplies aircraft broadcasts; our server requests public aircraft identifiers and bounded geographic areas, without sending your booking documents, passenger names or account details. Providers receive data needed for their features, including network information such as IP addresses.
We use HTTPS, authenticated access controls and restricted administrator access. Providers may process data outside the EEA. Their applicable processing terms describe transfer safeguards, including standard contractual clauses where applicable; contact us for details or copies. Brevo may add measurement pixels or redirect links; we request no per-recipient pixel tracking and do not use open or click analytics for account emails.
Cookies and offline storage
Secure first-party cookies keep you signed in and protect account requests. Sign-in cookies last 30 days and renew with use; sign-in providers may use temporary protocol cookies. AirMark uses no advertising, cross-site tracking or analytics cookies.
Your device stores preferences, catalogue caches and your last loaded account, flights, drafts, friends, shared flights and import inbox metadata for offline reading. Signing out or switching accounts clears the private snapshot. Offline statuses may be outdated. Android app backups are disabled.
Retention and deletion
Account and travel records remain until removed or account deletion is requested. Completed, deleted or archived email imports become eligible for original-email cleanup after 14 days; unresolved reviews remain until resolved or removed. Cleanup runs periodically and retries failures. Diagnostics normally remain for 90 days (configurable from 7 to 365); provider-call records remain for 30 days.
Account-email history retains recipient, subject, time and submission status for troubleshooting, without bodies or attachments. Account deletion removes the recipient address from that history. Backup and external-provider retention periods are separate; contact us for details.
Request deletion in Settings → Your account → Delete account, through our website, or by email. Access and sharing stop immediately; background cleanup erases account data, including hotels and private emails, and retries failures. An account ID and one-way inbox-address hashes remain to prevent delayed imports or diagnostics from restoring deleted data. Regenerating an import address permanently retains its unlinked one-way hash to prevent reuse. Removing a Google or Apple connection alone does not delete your AirMark account. Request account deletion.
Your rights
You may request access, correction, export, deletion, restriction or objection, and withdraw consent without affecting earlier lawful processing. Settings → Your account → Your data exports saved account and travel data, drafts, friends, import metadata, sharing and notification records. It excludes original emails and attachments, friends' flights, credentials and internal diagnostics; email us for other personal data.
Contact [email protected]. We may verify your identity and normally respond within one month, explaining any lawful extension. You may complain to Bulgaria's Commission for Personal Data Protection or your local authority.