Privacy Policy

Overview

AwardBeacon is a service operated by Felsy, a sole proprietorship registered in the Netherlands. AwardBeacon allows you to create a Trip Monitor so we can look for potentially matching Flying Blue Business Class award trips and notify you when we identify a relevant option.

In this Privacy Policy, “we”, “us” and “our” refer to Felsy as the operator of AwardBeacon. This policy explains what personal data we process, why we process it, which service providers we use, and what rights you have in relation to your data.

AwardBeacon is an independent service and is not affiliated with, endorsed by, or operated by Flying Blue, Air France, or KLM. Flying Blue and related trademarks belong to their respective owners.

Who is responsible

Felsy is the controller of personal data processed through AwardBeacon.

Controller and contact details:

• Legal / business name: Felsy
• Product / service name: AwardBeacon
• Chamber of Commerce (KvK): 92309798
• VAT ID: NL004948157B39
• Business address: Burgemeester Augustijnstraat 158, 2721 DR Zoetermeer, Netherlands
• Privacy contact: privacy@awardbeacon.app
• General support: support@awardbeacon.app

What information we collect

Depending on how you use AwardBeacon, we may process the following information:

• Contact details — your name and email address when you create a Trip Monitor or contact us.
• Trip Monitor preferences — destination, travel dates, trip length, number of travelers, departure airports, cabin preferences, connection preferences and budget limits for Miles and fees.
• Payment-related records — payment status and identifiers needed to associate a Stripe Checkout payment with your Trip Monitor. We do not store your card number, CVC or full payment-card details.
• Trip Match records — itinerary and award information associated with potentially relevant matches that we identify for your Trip Monitor.
• Communications and requests — information you provide when contacting us, making a privacy request or exercising a consumer right such as withdrawal from a purchase.
• Optional analytics data — product events such as page views and Trip Monitor funnel steps if you consent to optional analytics. These events are designed not to include your name, email address or exact Trip Monitor preferences.
• Technical and security data — limited information necessary to operate, secure and troubleshoot the Service, such as IP addresses used for abuse prevention and ordinary server or application logs.

We do not ask for your Flying Blue password or other Flying Blue account credentials. We also do not store your payment-card details ourselves. Payments are handled through Stripe.

Why we use your information

We process personal data for the following purposes:

• To create, activate and operate your Trip Monitor
• To process your payment and associate it with the correct Trip Monitor
• To search for potentially relevant award options based on the preferences you submitted
• To send service-related emails, including payment confirmation and Trip Match notifications
• To respond to questions, privacy requests, withdrawal requests and other customer-service communications
• To protect AwardBeacon against abuse, unauthorized access, fraud and technical problems
• If you consent to optional analytics, to understand how AwardBeacon is used and improve the usability of the Service
• Where applicable, to comply with legal, accounting or regulatory obligations

Creating a Trip Monitor does not subscribe you to marketing emails. Emails necessary to provide the service you purchased are transactional service communications.

Legal bases for processing

Where the GDPR applies, we rely on different legal bases depending on why we process your information:

• Performance of a contract — we process your contact details, Trip Monitor preferences, payment-related records and Trip Match information where this is necessary to provide the AwardBeacon service you requested.
• Consent — optional product analytics and Session Replay are used only after you have chosen to accept optional analytics. You can withdraw this consent through Cookie settings.
• Legitimate interests — we may process limited technical, security and operational data where necessary to secure the Service, prevent abuse, investigate technical problems and protect our systems and users. We consider the impact on your privacy when relying on this basis.
• Legal obligations — we may retain or process information where this is necessary to comply with obligations imposed on Felsy by applicable law, for example accounting or tax requirements.

Trip Monitor submissions

When you submit a Trip Monitor, we store your contact details and trip preferences so we can provide the monitoring service you requested. Monitoring becomes active only after payment has been confirmed.

AwardBeacon may use manual and software-assisted methods to evaluate potentially relevant award availability. The method used to perform the monitoring does not change how your submitted personal data is handled under this policy.

Service providers we use

We use third-party service providers to operate AwardBeacon. They may process personal data only to the extent needed for the services they provide to us.

• Stripe — processes a one-time payment for AwardBeacon. Payment-card details are handled by Stripe; AwardBeacon receives payment status and related transaction references.
• Supabase — provides database infrastructure used to store Trip Monitors, payment-status information and Trip Match records.
• Resend — provides infrastructure for sending transactional emails such as payment confirmations and Trip Match notifications.
• PostHog — provides optional product analytics and privacy-masked Session Replay after you consent to optional analytics.
• Vercel — hosts and delivers the AwardBeacon application and may process ordinary request, infrastructure and security information in doing so.

We do not sell your personal data. We disclose information to service providers only where needed to operate AwardBeacon, comply with applicable law, or protect the Service and its users.

Optional analytics

If you accept optional analytics, we use PostHog to understand how visitors use AwardBeacon. This includes explicitly defined events such as homepage views and steps in the Trip Monitor creation process.

With your consent, PostHog may also create a privacy-masked Session Replay to help us identify usability problems. The current AwardBeacon configuration is designed so that:

• names, email addresses and exact Trip Monitor preferences are not intentionally included in analytics events
• automatic click and input autocapture is disabled
• automatic page-view capture is disabled and AwardBeacon sends explicitly defined analytics events
• Session Replay starts only after analytics consent has been given
• form inputs and on-page text are masked in Session Replay
• admin pages and the payment-success page are excluded from Session Replay

You can accept or decline optional analytics through the consent banner. You can change your choice later using “Cookie settings” in the footer. Refusing analytics does not prevent you from purchasing or using a Trip Monitor.

Cookies and browser storage

AwardBeacon does not use third-party advertising or marketing cookies. Your analytics preference and, after consent, identifiers required by PostHog may be stored in your browser. The “Cookie settings” control in the footer allows you to manage the optional analytics choice.

A secure httpOnly session cookie is used for AwardBeacon's internal admin area. This cookie is not used to track public visitors and is not part of the customer Trip Monitor or Stripe Checkout flow.

Server logs and security data

We use limited technical information to operate and protect AwardBeacon. This may include IP-based rate limiting and operational logs recording, for example, whether a request failed or an email could not be sent.

We use this information for security, troubleshooting and reliable operation of the Service, not to create advertising profiles.

Retention and deletion

We keep personal data only for as long as it is needed for the purpose for which it was collected, to handle legitimate follow-up or disputes, or to meet applicable legal obligations. The periods below are upper bounds (“for up to …”); we may delete sooner when data is no longer needed.

• Trip Monitors and Trip Matches — we retain these records, including the customer name and email linked to a Trip Monitor, for up to 24 months after the monitoring period ends. If a Trip Monitor was never activated, we use the creation date as the starting point for that 24-month period.
• Withdrawal and similar requests — we retain withdrawal requests for up to 24 months after the request has been resolved (for example refunded or rejected). Support and privacy communications are retained for up to 24 months after resolution.
• Payment and accounting information — AwardBeacon does not store your card number, CVC or full card details. We keep only minimal payment references and status needed to operate the service and to meet statutory accounting and tax obligations applicable to Felsy in the Netherlands (commonly seven years for core business records). Stripe holds the primary payment records.
• Operational / server logs — ordinary application and hosting logs are retained for no longer than the retention period provided by the active Vercel plan, up to 30 days. AwardBeacon does not itself purge Vercel's platform logs.
• Optional analytics (PostHog) — product analytics events are retained for up to 12 months. Session Replay recordings are retained for up to 30 days. These retention periods are managed through PostHog's project and plan settings rather than by AwardBeacon application code.
• Transactional email (Resend) — delivery logs and message content held by Resend follow Resend's provider-managed retention, currently about 30 days for the plan used by AwardBeacon. AwardBeacon stores limited send timestamps related to confirmations and match notices, not a complete long-term email archive.

Expiry of a 30-day monitoring period does not itself delete stored data. Operational cleanup of eligible Trip Monitor and related records is performed through controlled internal processes and is not an always-on automatic deletion job that runs the moment monitoring ends.

You can ask us to delete personal data that is no longer needed, subject to any information we are required or permitted to retain under applicable law (for example unresolved disputes, open withdrawal requests, or statutory accounting records).

Your privacy rights

Where the GDPR applies, you may have the right to request access to your personal data, correct inaccurate information, request deletion or restriction of processing, object to certain processing, and receive certain data in a portable form where the legal requirements are met.

Where processing is based on your consent, you may withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of processing that took place before withdrawal.

To exercise a privacy right, contact Felsy at privacy@awardbeacon.app .

You also have the right to lodge a complaint with a competent data protection authority. In the Netherlands, the supervisory authority is the Autoriteit Persoonsgegevens.

International data transfers

Some of the technology providers used by AwardBeacon may process or make personal data accessible from countries outside the European Economic Area (EEA).

Where such transfers require additional safeguards under the GDPR, we rely on the safeguards applicable to the relevant provider and service. These may include an adequacy decision, participation in the EU-U.S. Data Privacy Framework where applicable, and/or the European Commission's Standard Contractual Clauses incorporated into the provider's contractual data-protection terms.

Our providers may also use subprocessors in other countries. We review the relevant provider terms, data-processing arrangements and subprocessor information as part of operating AwardBeacon. You can contact us at privacy@awardbeacon.app if you would like more information about the safeguards relevant to AwardBeacon.

Changes to this policy

We may update this Privacy Policy when AwardBeacon, our service providers or applicable requirements change. The “Last updated” date at the top of this page shows when this policy was most recently revised.

Where appropriate, we may also notify users of material changes that are relevant to an active Trip Monitor.

Contact

For privacy questions or requests, contact: privacy@awardbeacon.app

For general questions about AwardBeacon, contact: support@awardbeacon.app