MileSeat
Search

Privacy Policy

Effective date: 10 September 2026

1. Who we are

MileSeat (“we”, “us”, “our”) operates the website at mileseat.com. We provide an award flight availability search service that helps travellers find and monitor Business and First Class award seats.

If you have questions about this policy, contact us at support@mileseat.com.

2. Information we collect

Account information

When you create an account we collect your email address and, if you sign in via Google, your Google profile name and profile photo URL. Passwords (when using email/password sign-in) are hashed and managed by Supabase — we never store your plaintext password.

Alert preferences

When you create a seat alert we store the route details you provide: airline code, origin, destination, cabin class, and date range. This is used exclusively to send you email notifications when matching seats become available.

Usage data

Google Analytics assigns pseudonymous browser and session identifiers and collects pages viewed, selected button and link interactions, search parameters such as airport codes and cabin class, scroll depth, active time, referrer, campaign attribution, browser and device characteristics, approximate location, and timestamps. When you are signed in, we may associate analytics events with a non-identifying internal account ID. We do not send Google Analytics form field contents, email addresses, passwords, payment details, mouse movements, or full page replays. We may also process standard server logs, including IP addresses, for security and reliability.

3. How we use your information

  • To create and manage your account
  • To send you seat availability alert emails you have explicitly requested
  • To improve and maintain the MileSeat service
  • To respond to your support enquiries
  • To comply with legal obligations

We do not sell your personal data. We do not use your data for third-party advertising.

4. Third-party services

Supabase

We use Supabase for authentication and database storage. Your account credentials and alert data are stored on Supabase infrastructure. Supabase is SOC 2 Type II certified. See Supabase's Privacy Policy.

Google OAuth

If you choose to sign in with Google, we receive your name, email address, and profile photo from Google. We do not receive or store your Google password or access tokens beyond the authentication session.

Vercel

Our website is hosted on Vercel. Vercel may process request logs as part of hosting the service. See Vercel's Privacy Policy.

Google Analytics

We use Google Analytics to understand aggregate website usage and conversion performance. Google may process device, browser, page-view, interaction, and approximate location information in accordance with its own privacy terms.

Payment processing

Paid subscriptions are sold through a third-party merchant of record, which acts as the reseller of the subscription and appears as the merchant on your card or bank statement. Subscriptions started from 10 September 2026 onwards are handled by Waffo Pancake (Waffo.com Limited); subscriptions started before that date continue to be handled by Creem. Your receipt and card statement show which one applies to you.

MileSeat never receives or stores your full card number, CVC, or bank details — payment details are collected and processed exclusively by that PCI-DSS certified provider. We receive only what we need to operate your subscription: your email address, the plan you bought, the billing period, and the status of the subscription.

5. Cookies

MileSeat uses cookies required for authentication and may use Google Analytics cookies and browser storage for usage measurement. Browser privacy signals such as Global Privacy Control and Do Not Track disable Google Analytics collection on our site. We do not use this information for third-party advertising.

6. Data retention

We retain your account data and alert preferences for as long as your account is active. Google Analytics event-level data is retained according to the retention period configured for our Analytics property; aggregate reporting may be retained for longer. If you delete your account or request deletion, we will remove your personal data within 30 days, except where we are required to retain it by law.

7. Your rights

Depending on your location, you may have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate data
  • Request deletion of your data
  • Object to or restrict certain processing
  • Data portability

To exercise these rights, email us at support@mileseat.com.

8. Security

We use industry-standard security practices including HTTPS encryption, hashed passwords, and access controls. However, no internet transmission is completely secure and we cannot guarantee absolute security.

9. Children

MileSeat is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date above. Material changes will be communicated via email to registered users or via a notice on the website.