Privacy notice
The short version
- To join the early-access list, the only thing we ask you for is your email address.
- We use it to manage your signup and send your invitation and access-related updates, because you asked us to. That’s all.
- Promotional emails are separate. We send them only to people who tick the optional box, and every one will have an unsubscribe link.
- Analytics is optional and stays off unless you accept it. Saying no never stops you signing up.
- Questions or requests: hello@trahlo.com.
Who we are
Trahlo is a product in development that helps people understand flight prices. It doesn’t sell tickets or take bookings. This notice covers the trahlo.com holding page and its early-access sign-up.
Trahlo is the trading name of Jordan Thomas, an individual (a sole trader). Trahlo is not currently a registered limited company. Jordan Thomas decides how and why the personal data in this notice is used, which makes him the “controller” under data protection law.
Contact us about privacy, or to make a request, at hello@trahlo.com.
What we collect, why, and our lawful basis
Data protection law (UK GDPR) says we need a “lawful basis” for each way we use personal data. They’re not all the same. Separate rules about electronic marketing also apply, which we explain just after the table. Giving us your email address is your choice: if you don’t, you simply won’t be on the list.
| What | Why we use it | Lawful basis |
|---|---|---|
| Your email address, when you join the early-access list. | To add you to the early-access list and send your invitation and access-related updates, as described below. | Your consent. You give it when you submit the sign-up form, which says what we’ll use your email for. You can withdraw it at any time (see “Your rights”). |
| Sign-up date and source (“trahlo.com holding page”). | To keep a basic record of who signed up, when and where, including as evidence of what you asked for. | Legitimate interests (running the list and keeping a record of sign-ups). |
| Your marketing choice, only if you tick the box: that you said yes, the date, and the version of the wording you saw. | To send marketing only to people who asked for it, and to keep the minimum evidence of what you agreed to. | Sending marketing: your consent. Keeping the consent and unsubscribe record: legitimate interests (showing what you agreed to and honouring your opt-out). |
| Technical data when you submit the form: your IP address and request details (handled by our host), a hidden anti-spam field, and how long the page was open before you submitted. | To keep the form secure and limit repeated or automated submissions. The anti-spam and timing checks are not stored. | Legitimate interests (security and preventing abuse). |
| Analytics data, only if you accept analytics. See the cookie policy for exactly what. | To understand how the site is used so we can improve it. | Your consent. |
| Emails you send us, and our replies. | To answer you and handle any request you make. | Legitimate interests (dealing with messages sent to us), and legal obligation when we handle a rights request. |
We rely on legitimate interests only for uses that are fair, necessary and proportionate and that don’t override your rights, and you can object at any time (see “Your rights”).
Marketing rules that apply on top
- Marketing emails. The Privacy and Electronic Communications Regulations (PECR) say we may only send marketing emails to individuals who have given consent. That is why marketing is a separate, optional tick-box, and why the invitation and access updates you ask for when you sign up are limited to what the form says.
- Cookies and similar storage. PECR also says non-essential storage on your device, such as analytics cookies, needs your consent. We ask first and switch analytics on only if you accept.
We don’t ask for your name, payment details or travel plans on this site. We don’t send your email address to our analytics provider. We don’t make automated decisions about you.
Early-access emails and marketing are different
Signing up for early access is not consent to promotional marketing. We keep the two apart.
| Topic | Early-access emails | Marketing emails |
|---|---|---|
| Who gets them | Everyone on the early-access list. | Only people who ticked the optional box. |
| Why you get them | You asked for them when you submitted the sign-up form. | You ticked the box. |
| What they are | Your invitation when access opens, and other updates that are genuinely about getting access to Trahlo. | Occasional travel deals, product news and promotional updates, including promotional launch announcements, as the box says. |
| What they never include | Promotions, travel deals, product news, launch announcements that aim to promote Trahlo, or any other marketing. | Anything sent to people who didn’t tick the box. |
| Opting out | Email hello@trahlo.com and we’ll remove you from the early-access list. You then won’t get your invitation. | Every marketing email will have an easy unsubscribe link. You can also email hello@trahlo.com. |
The optional box is never ticked for you. It says:
I’d like to receive occasional travel deals, product news and promotional updates from Trahlo.
Under it, the form says: “We’ll use your email to manage your early-access signup and send your invitation and access-related updates. Promotional emails are separate and only sent if you opt in.”
Signing up again later without ticking the box does not withdraw consent you already gave, and doesn’t change your earlier consent record. If you tick the box again, we record your new choice, the date and the wording you saw then. To withdraw consent, use the unsubscribe link in any marketing email, or email hello@trahlo.com.
We don’t ask you to click a link to confirm your address when you sign up (sometimes called double opt-in), so please only enter your own address. If someone has used your address without your permission, email us and we’ll remove it from both lists.
How sign-ups are handled
When you press “Get early access”, your browser sends your email address and your marketing choice to a small function that runs on our host, Netlify. The function passes your details to Brevo, our email service, and the page only says you’re on the list once Brevo has accepted them. That on-screen message is the only confirmation: the site doesn’t send a confirmation email. Our function doesn’t keep its own copy.
In Brevo we use two lists:
- Trahlo Early Access: everyone who signs up.
- Trahlo Marketing: only people who ticked the box.
Each contact in Brevo holds your email address and: sign-up source, sign-up date and, only if you ticked the box, your marketing consent status, consent date and the version of the wording you saw. If you sign up again with the same address, we update your existing record instead of creating a duplicate.
Our sign-up function writes nothing to our host’s logs when a sign-up works. If a sign-up fails, it may log a short technical error (a status code and Brevo’s error message, with any email address removed), never the address itself.
Analytics (PostHog)
We use PostHog to count visits and see how the site is used, so we can improve it. It is off by default. Nothing from PostHog is downloaded, stored or sent unless you choose “Accept all” or switch Analytics on in your cookie settings. You can switch it off again at any time, and declining never affects signing up. If your browser sends a “Do Not Track” or “Global Privacy Control” signal, we treat that as a refusal: analytics doesn’t start, even if you click “Accept all”.
If you accept, PostHog receives:
- the pages you view (address and title), where you came from, and any campaign tags in the link you used, such as
utm_source; - when you leave a page, how long you stayed and how far down it you got;
- clicks on links and buttons: which link or button, by its text and where it points;
- page-speed measurements (“Web Vitals”);
- your browser, operating system and device type, screen size, language, time zone and the browser’s user-agent text;
- random identifiers for your browser and visit; and
- one event when you sign up, with a yes-or-no value for whether the marketing box was ticked.
It does not receive your email address or anything you type. The sign-up form and the cookie panel are excluded from click tracking, and anything that looks like an email address is removed from the data before it leaves your browser. Advertising click identifiers in links (such as gclid and fbclid) are masked. We don’t use session recordings, heatmaps, surveys or feature flags, we don’t build profiles of individual visitors, and we don’t try to identify you. The cookie policy lists the cookies and storage involved.
We send analytics to PostHog’s EU Cloud address (eu.i.posthog.com). PostHog says its EU Cloud data is stored in Germany, on Amazon Web Services, and that traffic passes through Cloudflare’s network. Your browser’s connection necessarily shows your IP address to PostHog’s servers. Our PostHog project is set to discard IP addresses instead of storing them. PostHog may use the address to work out an approximate location, such as a country or city, as the data arrives.
Who we share it with
These providers help us run the site. They act for us (they’re our “processors”) and may only use your data on our instructions.
| Provider | What they do | Data involved |
|---|---|---|
| Brevo (the trading name of Sendinblue SAS, France, and its group companies) | Stores our early-access contacts and marketing-consent records, and sends our emails. | Your email address, sign-up details and, if you opted in, your consent record. |
| Netlify (Netlify, Inc., USA) | Hosts this website and runs the sign-up function. | Web request data such as your IP address, and your sign-up details while they pass through. |
| PostHog (PostHog, Inc., USA; we use its EU Cloud) | Analytics, only if you accept. | The analytics data described above. |
We don’t sell your personal data, and we don’t share it for advertising. Our Instagram, TikTok and YouTube links are ordinary links. We don’t embed those platforms’ code in this site.
Transfers outside the UK
Some of our providers are based outside the UK or use systems there. This is what each says in its own published documents, last checked on 11 October 2026.
- Brevo says the servers that hold our contacts are in the European Union (France, Germany and Belgium). Sending personal data from the UK to the EU is permitted, because the UK treats EU countries as providing adequate protection. Brevo also says data may be transferred to other countries without an adequacy decision, naming the United States and India, with appropriate safeguards, and that Brevo, Inc. is certified under the EU-US Data Privacy Framework and its UK and Swiss extensions.
- Netlify is a US company. Its data processing agreement says it and its sub-processors may process data outside the European Economic Area. For transfers from the UK it relies first on the UK Extension to the EU-US Data Privacy Framework (sometimes called the UK-US data bridge), and uses the UK International Data Transfer Agreement where that doesn’t apply. It doesn’t name where data is hosted.
- PostHog says its EU Cloud data is stored in Germany and that traffic passes through Cloudflare’s global network. PostHog, Inc. is a US company. Its data processing agreement says it participates in the EU-US Data Privacy Framework (with the UK Extension) and also provides for the EU standard contractual clauses and the UK International Data Transfer Addendum.
How long we keep it
These are the periods we follow. We’ll review them as Trahlo develops. “Launch” means the day Trahlo opens to the public.
| Data | How long |
|---|---|
| Early-access list (email and sign-up details) | Through launch, and up to 12 months after it. We then delete these contacts unless we have a recorded reason to keep them (for example, you also joined the marketing list, below). If Trahlo hasn’t launched within 24 months of your signing up, we’ll delete your entry or ask whether you still want to hear from us. |
| Marketing list | While you stay subscribed. At least every two years we review the list. We may ask people to confirm they still want our emails, and we remove anyone who says no or doesn’t confirm, and addresses that stop working. |
| Consent and unsubscribe records | Only the minimum evidence we can justify: whether you consented, when, and which wording. If you unsubscribe, we may keep a minimal record (your email address and the fact you opted out) so we don’t email you again. We keep that for as long as we send marketing emails, and review it at least every two years. |
| Deletion requests | We delete data we no longer need. We may keep a limited record, such as an opt-out or a note of your request, where we can justify it, for example to keep honouring your opt-out or to show we handled your request. |
| Analytics events (only if you accepted analytics) | PostHog keeps events for a period set by its plan, not by us, and we can’t shorten it. PostHog’s documentation gives 1 year on its free plan and 7 years on paid plans. We can ask PostHog to delete your data on request. |
| Hosting and function logs | Set by Netlify. Its documentation says function logs are kept for at least 24 hours, rising to 7 days on certain plans. Its data processing agreement says it keeps its service logs online for 90 days and offline for 1 year. |
| Email sending records (Brevo) | Set by Brevo. Its terms say it deletes logs, with their statistics and reports, at least every 24 months, and deletes your account content when the account ends. |
| Emails you send us | As long as we need them to deal with your message and any follow-up. |
| Your cookie choice and any analytics cookie on your device | See the cookie policy. |
Your rights
Depending on where you live, you can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or give it to you in a portable format. You can object to us using your data where we rely on legitimate interests, and you can always object to direct marketing. Where we rely on your consent, you can withdraw it at any time, and doing so doesn’t affect what we did before.
How to make a request
Email hello@trahlo.com and tell us what you’d like. Please write from the address you signed up with, or tell us which address it is, so we can find your record. We’ll reply within one month, as the law requires, which can be extended in some cases. We may ask you to confirm you control the address, for example by replying from it, before we act, so that we don’t give your data to someone else.
How to withdraw consent
- Early-access emails: email hello@trahlo.com and we’ll remove you from the list.
- Marketing: click the unsubscribe link in any marketing email, or email hello@trahlo.com.
- Analytics: open “Cookie settings” in the footer of any page and switch Analytics off. We stop sending analytics data and remove PostHog’s cookie and storage from your browser.
Withdrawing consent for marketing or analytics doesn’t remove you from the early-access list.
Complaints
If you’re unhappy with how we’ve handled your personal data, please tell us at hello@trahlo.com. You can complain to us directly, and we’ll accept your complaint however you send it. We’ll acknowledge it within 30 days, look into it, and tell you the outcome without undue delay. We may ask you to confirm who you are or, if someone is complaining on your behalf, that they’re authorised to.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator:
- Online: ico.org.uk/make-a-complaint
- Helpline: 0303 123 1113 (Monday to Friday, 9am to 5pm, excluding bank holidays)
- Post: 4th Floor, No.3 Circle Square, 5 Hawkshaw Street, Manchester, M1 7BL
If you live elsewhere in Europe, you may also be able to complain to your local data protection authority.
Children
This site isn’t designed for children, and we don’t ask visitors their age. We don’t knowingly collect children’s personal data. If you think a child has joined the list, email hello@trahlo.com and we’ll remove them.
Changes to this notice
If anything changes, we’ll update this page and the date at the top.