Privacy Notice

1. Data controller

Patrik Back, trading as PB-Import (Finland), operator of flymelon.net, is the data controller for personal data processed through this service. Contact: hello@flymelon.net.

2. What we collect

• Account data — email address, and name if you provide one, plus login timestamps.
• Travel preferences — home airports, destinations, price ceilings, discount thresholds, trip types.
• Notification settings — alert frequency, quiet hours, email and push preferences, and records of alerts sent to you.
• Purchase data — subscription status, plan, renewal dates and payment identifiers. Card details are handled by Paddle and never reach our servers.
• Technical data — IP address, browser and device information, and error logs generated when you use the site.

3. Why we use it and on what basis

To provide the service and your account (performance of a contract); to send deal alerts you have configured (contract and, where required, consent); to take payment and meet tax and accounting duties (contract and legal obligation); to keep the service secure and improve it (legitimate interests). We do not sell personal data, and we do not use it for automated decision-making with legal effects.

4. Who we share it with

• Paddle.com Market Ltd — our payment provider and Merchant of Record; receives your email, billing country and transaction data to process payments, tax and refunds.
• Supabase — database, authentication and hosting infrastructure.
• Resend — delivery of account and deal-alert emails.
• Duffel — flight fare search. Queries are route-based; we do not send your identity.
• Authorities, where we are legally required to disclose data.

5. International transfers

Some providers process data outside the EEA. Where that happens, transfers rely on the European Commission's Standard Contractual Clauses or an adequacy decision.

6. Retention

Account and preference data is kept while your account exists and deleted within 30 days of account closure. Transaction records are retained for as long as tax and accounting law requires (typically six years). Technical logs are kept for up to 12 months.

7. Your rights

Under the GDPR you can request access to your data, correction, erasure, restriction or portability, and you can object to processing based on legitimate interests. You can withdraw consent to marketing at any time via the unsubscribe link or your settings. Email hello@flymelon.net and we will respond within one month. You may also lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi) or your local supervisory authority.

8. Cookies

We use strictly necessary cookies and local storage to keep you signed in and remember your preferences. Paddle sets cookies during checkout to process payments and prevent fraud. We do not use advertising cookies.

9. Changes

We will post updates on this page and, for material changes, notify you by email. See also our Terms & Conditions and Refund Policy.