The short version. You can read the whole site without giving us anything. An account needs an email address and a name. If you ask for a place on a tour, we pass what the operator needs in order to reply to you. We do not sell data and we do not take card details for tours, because we do not take payment for tours.
The controller of your personal data is Cryptionis sp. z o.o., registered in Warsaw at the address above. Write to us about anything in this policy at privacy@hubionis.com.
Nothing that identifies you is required. Our server keeps ordinary technical logs — IP address, time, page requested, browser — which we need to keep the Service running and secure. Legal basis: our legitimate interest in operating and protecting the Service (Art. 6(1)(f) GDPR). Logs are kept for 90 days.
Your language and theme choices are stored in your own browser, not on our servers, and never reach us.
To register we need an email address and a name. You may add a phone number and country; both are optional. Your password is stored only as a hash — we cannot read it.
We also record when the terms were accepted, whether the email was confirmed, and the time and IP of the last sign-in, which is what lets you and us notice an account being used by somebody else.
Legal basis: performance of the contract for the account (Art. 6(1)(b)) and, for the sign-in records, security as a legitimate interest (Art. 6(1)(f)).
When you press "Request a place", we send the tour operator what they need to answer you: your name, your email address, and which tour and date you are asking about. From that moment the operator is a separate controller of that data, under their own privacy policy.
Legal basis: performance of a contract at your request (Art. 6(1)(b)).
Where a tour is run by a partner and booked on their site, pressing the button takes you there and we send them nothing; what you enter is collected by them.
If you use "My trip", we store what you put in it: a name for the trip, the month, the number of travellers, and which of the six decisions you have ticked. It is yours, visible only to you, and you can delete it at any time.
Legal basis: performance of the contract for the account (Art. 6(1)(b)).
Searching flights sends the route and dates you typed to the flight data providers we use, so they can return offers. That query does not carry your name or email. If you save a route to watch, we store the route, the dates and your account id so we can tell you what the price does.
We record that a link to an airline or agency was followed, and which one, so that we can tell which partners are useful and be paid for referrals. That record is tied to your account only if you were signed in.
Legal basis: performance of the contract (Art. 6(1)(b)) for the search and the watchlist; legitimate interest (Art. 6(1)(f)) for the referral record.
We send transactional email — confirming an address, resetting a password, an operator's reply — because the Service cannot work otherwise.
A newsletter is sent only if you asked for it, and every message carries a one-click unsubscribe. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time without affecting what was sent before.
Only the parties that have to:
Some of these providers may process data outside the European Economic Area. Where they do, the transfer relies on the European Commission's standard contractual clauses or an adequacy decision.
Under the GDPR you may ask us to:
Write to privacy@hubionis.com. We answer within one month. You may also delete your account yourself from your account settings.
If you think we have handled your data badly, you may complain to the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw.
We use cookies and equivalent browser storage only for what the Service needs to work:
We set no advertising or cross-site tracking cookies. You can clear all of it in your browser at any time; signing in again will be required.
The Service is not directed at children under 16 and we do not knowingly create accounts for them. If you believe a child has registered, tell us and we will remove the account.
Traffic is encrypted in transit (HTTPS). Passwords are stored as hashes. Access to production data is limited to the people who need it. No system is perfect; if a breach ever puts your rights at risk, we will tell you and the supervisory authority within the deadlines the GDPR sets.
If we change this policy materially, registered users are told by email at least 14 days beforehand. The version and date at the top always say which text is in force.
In force from 10 September 2026. Version 2.0.
Data protection contact: privacy@hubionis.com