Privacy policy

Who we are

The controller of your personal data is Longterm studio, which operates Dipback. Because we are established in the EU, the GDPR applies to our processing regardless of where you live. If you are in the United States, US state privacy laws also apply based on your state of residence. Contact us about privacy at hello@dipback.com — our contact details are at the bottom of this policy.

What we collect

• Account data — your email address and name when you sign up or join the waitlist.
• Booking data — the flight confirmation emails you forward to us, and the details extracted from them: airline, booking reference, passenger names, flight segments, fare class, and amount paid.
• Payment data — handled entirely by Stripe. Dipback never stores your card number.
• Usage data — analytics about how you use our site and product, collected via PostHog and Google Analytics. Contact us to opt out or request deletion of your analytics data.

How we use it, and our legal bases

We use your data to monitor your fares, recover savings on your behalf, notify you about drops and claims, charge the success fee after savings are secured, bill any membership you choose, and improve the product. Under the GDPR our legal bases are: performance of our contract with you (running the service and billing), our legitimate interests (securing, analyzing, and improving the service), your consent where we ask for it, and compliance with legal obligations. We do not use your data for third-party advertising.

We do not sell or share your data

We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA). We also do not use or disclose sensitive personal information beyond what is necessary to provide the service you asked for. Because we do not sell or share, there is no financial incentive tied to your data and no discrimination for exercising your rights.

Cookies

We use essential cookies to keep you signed in and analytics cookies (PostHog and Google Analytics) to improve the product. See our cookie policy for the details and how to opt out.

International data transfers

As an EU-established company hosting data in the United States, we transfer personal data from the EU/EEA (and the UK) to the US. Where required, these transfers are protected by the European Commission's Standard Contractual Clauses and/or a processor's certification under the EU–US Data Privacy Framework, together with appropriate safeguards.

How long we keep it

We keep your data for as long as your account is active and as needed to provide the service, meet legal and accounting obligations, and resolve disputes. When you delete your account we remove your bookings, forwarded emails, and personal data, retaining only what the law requires (for example, billing records).

Your rights — GDPR (EU/EEA and UK)

You have the right to access, correct, delete, restrict, or object to our processing of your data, and the right to data portability. Where we rely on consent, you can withdraw it at any time. You can also lodge a complaint with a supervisory authority — our lead authority is the Lithuanian State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija), and you may also complain to the authority in your own country.

Your rights — US state privacy laws

Depending on your state (for example California, and other states with comprehensive privacy laws), you have the right to know what personal information we collect and how we use it, to access and delete it, to correct it, and to opt out of the sale or sharing of personal information and of targeted advertising — none of which we do — and to limit the use of sensitive personal information. We will not discriminate against you for exercising these rights. You may exercise them, including through an authorized agent, by contacting hello@dipback.com; we will verify your request as required by law.

Marketing email

If you receive marketing email from us, every message includes an unsubscribe link and we honor opt-outs promptly, consistent with the US CAN-SPAM Act, applicable state laws, and (where it applies) the GDPR/ePrivacy consent rules.

Children

Dipback is not directed to children and is intended for users 18 and older. We do not knowingly collect data from children.

Security & contact

We protect your data with access controls, encryption in transit, and row-level security, and we never store card numbers. For any privacy request or question, contact us at hello@dipback.com.