Privacy Policy

Last updated 31 August 2026

Controller: TJ NOVA LTD, 124-128 City Road, London, EC1V 2NX, United Kingdom. Contact: info@tjnovaltd.com.

Data we use

• Search criteria and source-response metadata.
• Account email, display name, language and currency.
• Optional passport country/residence preference, never a passport number.
• Saved itineraries, watch thresholds, notification status and support messages.
• Order, entitlement, refund and dispute metadata; we never receive full card details.
• Security and audit records using salted IP hashes where configured.

Purpose and legal basis

We process data to provide requested searches and accounts, perform a contract for purchased digital services, protect the service, comply with law, and pursue legitimate interests in reliability and fraud prevention. Optional marketing requires separate consent.

Providers and transfers

Processors may include Cloudflare, email delivery, OAuth providers, app stores, the TJ Payment Hub and approved flight-data partners. A provider is activated only after its role and data rights are recorded. International transfers use applicable safeguards.

Retention

Raw provider responses default to memory-only and a 15-minute cache. Search history is retained only when rights and account choice allow. Watch data is deleted 30 days after expiry unless explicitly retained. Payment records are kept only as required for legal, tax and dispute purposes.

Your rights

You may request access, correction, deletion, restriction, portability or objection, and may complain to the UK ICO. Use the signed-in in-app deletion control or follow the account deletion instructions.

Security and children

We use access controls, hashed session tokens, encrypted platform secrets and audit logs. TJfly is not directed at children under 13; a parent or guardian must manage a child's travel data.