Privacy policy
Last updated: 24 October 2026. It covers the estimate, contact and the handling of cases. This English version is a translation provided for your convenience; in the event of any discrepancy, the French version prevails.
Who is responsible for your data?
Nassim Benkhelifa, sole trader trading under the name FLYORA, 1 avenue Pierre Grenier, 92100 Boulogne-Billancourt, France. For any question or request about your data: nb.flyora@gmail.com.
What data, for what purpose, and for how long?
| Situation | Data | Purpose | Legal basis | Retention period |
|---|---|---|---|---|
| Estimate without sending | Flight, date, route, disruption, expenses declared | Calculating the estimate | Pre-contractual steps at your request | Draft stored in your browser, deleted when the tab is closed |
| Sending the estimate | Email, estimate, reference | Replying to you | Pre-contractual steps | 12 months after the last exchange, unless a case is opened |
| Request started but not completed | Confirmed email, first name, last name, flight details entered, estimate | Allowing you to resume your request and sending you a single reminder email | Pre-contractual steps taken at your request | 30 days |
| Case opened | Identity, date of birth, contact details, booking, boarding passes, exchanges with the airline, receipts for expenses | Performing the mandate and claiming from the airline | Contract | Duration of the case, then 5 years (limitation period) |
| Minor passenger | Identity of the minor and of their legal guardian | Same | Contract concluded by the guardian | Same |
| Other adult passenger named by the requester | Last name, first name, date of birth, email and, if provided, phone number, sent by the passenger who opens the request with that person’s consent | Offering them the chance to sign their own mandate (invitation email and no more than two reminders) | Legitimate interest, then contract if they sign | Deleted with the case; if the person does not sign or refuses, their data is not used for anything else and is deleted when the case is closed |
| ID document, if the airline requires it | Copy of the document | Proving the mandate to the airline | Contract | Deleted as soon as the case ends |
| Bank details | IBAN | Paying sums over to you | Contract | Deleted after the last transfer, except for accounting records |
| Electronic signature | Name, email, drawn signature, timestamp, IP address, proof file | Proving the signature of the mandate | Contract and legitimate interest (proof) | Duration of the case, then 5 years |
| Case refused or withdrawn | Case data | Replying to the customer, proving the refusal or withdrawal | Legitimate interest | Deleted within 30 days |
| Invoicing | Name, address, amounts, invoices, statements | Accounting obligations | Legal obligation | 10 years |
| Website security | IP address | Limiting abuse | Legitimate interest | 1 hour to 1 day |
| Google Ads measurement | Technical data, advertising identifiers, request reference | Measuring campaigns | Consent | Depending on your cookie choice |
We do not sell your data and we do not make any automated decisions about you.
Who receives your data?
- The airline concerned, only after the mandate has been concluded and for your claim.
- Our technical service providers, who act on our instructions:
| Provider | Role | Location |
|---|---|---|
| OVHcloud | Hosting of the website and cases | France |
| Resend | Sending automatic emails | United States (appropriate safeguards) |
| nb.flyora@gmail.com mailbox; Google Ads tag if you accept it | European Union and United States | |
| AeroDataBox via API.Market | Flight and airport search (flight number, date and airport code only) | Depending on the provider; no personal data sent |
| WhatsApp (Meta) | Only if you choose to write to us on WhatsApp | European Union and United States |
When data is transferred outside the European Union, the transfer is based on an adequacy decision (in particular the EU–US Data Privacy Framework) or on the European Commission’s standard contractual clauses. We never ask you for an ID document or bank details on WhatsApp.
Cookies and trackers
Session storage keeps your draft estimate. A strictly necessary cookie keeps you logged in to the private area (7 days at most). The Google Ads tag is only loaded with your consent; the “Cookie choices” button lets you change this at any time.
Security
The website is served over HTTPS. Cases can only be accessed after authentication. Sensitive documents are deleted as soon as they are no longer needed.
Your rights
You can request access to your data, its rectification, erasure, restriction or portability, and object to processing based on our legitimate interest. You can withdraw your consent to advertising cookies at any time.
Write to nb.flyora@gmail.com; we reply within one month. Some data cannot be deleted before the end of a legal obligation, in particular invoices. You can also lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).