Privacy policy
This review version describes the implemented data model and planned processors. Hosting region, transfer safeguards and backup practices require confirmation before launch.
Who is responsible?
For account and product data, contact Rankup in Tunisia: contact@rankup.cloud. The agency determines the purposes of traveler records it uploads. The controller/processor allocation and a suitable data-processing agreement require legal review before production processing.
Information processed
Account email and authentication records; organization name, locale, time zone, memberships and invitations; flight occurrences; traveler names, optional emails, internal references and groups; operational impacts; tasks, notes, incident and audit history; notification preferences and delivery metadata; CSV import results; and subscription identifiers, status and usage. Original CSV files are parsed in the browser and are not stored as files. Passwords are handled by Supabase Auth. TravelHub does not collect card details or passport numbers.
Purposes and access
Data supports account access, team coordination, monitoring, notifications, quota enforcement, billing synchronization, abuse prevention and security investigation. Access is limited by organization membership and role. Legal bases and international transfer mechanisms must be confirmed for the launch markets and contractual roles before commercial release. No advertising tracking is installed.
External services
The code integrates Supabase for authentication/database, Netlify Free for hosting when deployed, Resend for transactional email and Paddle Billing for payments when configured. Aviationstack is an isolated optional flight-data provider and remains commercially gated. A provider query contains flight identifiers and route/date information, not traveler names. Each service’s contractual terms, region, subprocessors and applicable safeguards must be reviewed before activation.
Retention
The supplied scheduled cleanup deletes archived monitoring records after 90 days, with dependent operational records, and removes orphan traveler records older than 90 days. Email content and provider logs are removed after 30 days; audit logs after 365 days. Active workspace records remain until archiving or an account deletion request. Billing usage and payment event metadata require a reviewed statutory retention schedule. Backups and provider-held data follow settings that must be confirmed before launch. These jobs require scheduler activation; the public demo stores fictional changes only in your browser until reset or site data is cleared.
Your requests
Contact contact@rankup.cloud for access, correction, export, objection or erasure requests. Identity or organization authority may need verification. Applicable rights and supervisory channels depend on your jurisdiction. No automated consequential decision about a traveler is made, and traveler messages require human review.