Privacy policy

If you send a request on the “We book it for you” page, Kaviqa uses what you enter (your name, email address, where you want to go and, if you say, when, plus anything else you choose to write about the trip) and the campaign tags in the page’s address, only to contact you about that trip. Anything you tell us about who is travelling, such as family or accessibility details, is used only to plan the trip. The request is emailed to our team through Resend, and is not stored in our website database; the email is the record. We email you a confirmation that contains none of the details you entered, and to stop repeat confirmation emails we hold a one-way hash of your email address for 24 hours (the address itself is not kept for this).

Who sees it, and for how long. Only the Kaviqa team reads request emails. They are kept only as long as needed to plan and support your trip, and are deleted after your trip or within 12 months of your request, whichever comes first. You can ask support to delete yours sooner.

If you have agreed to analytics cookies, Kaviqa also counts that a request was sent. That count carries no name, email address or trip details.

If you use “Email me deals” on the Best deals pages, Kaviqa stores your email address, the departure city you chose, the page you signed up on, any campaign tags in that page’s address (utm_source and similar), the date and the wording you agreed to, and a hashed copy of a private link code. Kaviqa does not store your IP address with the sign-up.

What we send. First one email with a link to confirm your address. Until you tap it, you are not subscribed and nothing else is sent. After that, occasional emails with the best deals from the city you chose. These are marketing emails; they are separate from the booking and account emails above, and you do not need to subscribe to book or to use Kaviqa. If you gave your email address in a sign-up box that said we would also email you occasional deals, we send those deal emails only once you have confirmed the address by creating your Kaviqa account from the link in the email we sent you; an address nobody has confirmed gets no deal emails. If you asked us to watch a route and confirmed it, the occasional deal email is part of what you agreed to, for as long as that watch is on. Kaviqa members may also get them. You can stop them at any time.

How we choose which deals. When you have agreed to deal emails, we use your activity on Kaviqa to choose which deals to email you. That means the deals you open and tap, the routes you search, and the departure city you chose. It is only counted while analytics is allowed for you (see Cookies and similar technologies). Kaviqa links the analytics ID of your browser, or of your account, to your email address, builds a short summary of your interests (such as the places and cabin you look at), and sends an email when a new deal fits it, when a deal you opened has ended, or the day after you searched a route and left. We send you at most one such email every two days and three a week, and not between 9 pm and 7 am Sydney time. We delete the summary within a day of you unsubscribing. Prices in these emails are what we saw at the time shown, not a live quote.

How to stop. Every deal email has an unsubscribe link, and mail apps that support it show their own Unsubscribe button. Either takes effect at once, with no login. You can also email support@kaviqa.com. After you unsubscribe we keep the address and the unsubscribe date so we do not email you again by mistake. A sign-up through the “Email me deals” form that you never confirmed is not used for anything, other than the advertising measurement described next.

Advertising measurement. Where advertising measurement is allowed for you (see Cookies and similar technologies), Kaviqa tells Meta that a sign-up happened, with a one-way hash of your email address and your IP address so Meta can match it to the ad that led you here. Meta is told when you give your address, whether or not you later confirm it. If you have declined, nothing is sent. If you have not chosen, nothing is sent until you press Allow in the places that need your permission first; elsewhere it is sent unless your browser sends Global Privacy Control. Pressing Allow overrides Global Privacy Control.

Kaviqa uses cookies and similar browser storage. Some are essential: they keep you signed in, remember your choices and make payments safe, and they do not need your permission. Others are optional: analytics, which tells us how Kaviqa is used, and advertising measurement, which tells us which ads lead to customers. One choice, Allow or Decline, covers all of the optional ones.

Where the law requires your permission first — the European Union and the wider European Economic Area (Iceland, Liechtenstein and Norway), the United Kingdom, Switzerland, Türkiye, Brazil, Japan, South Korea, China, and Quebec in Canada — Kaviqa shows a short banner once. Until you choose Allow, it sets no analytics or advertising cookies, does not start PostHog or the Meta Pixel, and sends no advertising measurement to Meta. We remember Allow for 12 months. We remember Decline for 6 months and then ask again. If your browser blocks cookies so that we cannot tell where you are, we treat you as being in one of these places.

Everywhere else, including Australia and the United States, there is no banner: analytics and advertising measurement run automatically. You can turn them off at any time with “Your privacy choices” in the footer of every page, and we remember that for 12 months. If your browser sends the Global Privacy Control signal, Kaviqa turns Meta advertising measurement off on its own, in every country, unless you have pressed Allow.

We decide which of these applies from the country (and, for Canada, the province) of your connection, which our hosting provider derives from your IP address when a page loads. The result is kept in the kvq_consent_region cookie. Declining never limits what you can do on Kaviqa.

When you are signed in, Kaviqa keeps first-party records of your account activity — your searches, bookings and membership — to run the service. Those records are not cookies, so Allow and Decline do not switch them off. The choice controls analytics and advertising cookies and what is shared with PostHog and Meta.

Kaviqa sets a cookie called kvq_aid to count visits and searches and to see where people give up, so the service can be improved. It holds a random identifier, not your name, email address or account. PostHog uses the same identifier and keeps its own copy of it in a cookie and in your browser’s storage.

If you arrive through a link with campaign tags, such as an ad or a creator’s post, Kaviqa saves those tags in a second cookie called kvq_ft. It is only used if you subscribe: Kaviqa then records the tags and your kvq_aid on your Stripe subscription, so it can see which campaign led to a sign-up.

On the first visit where this is allowed, Kaviqa also saves the campaign tags, the site that linked you here and the page you opened, in a cookie and in this browser’s storage, both called kvq_sa. A later visit leaves a first visit that already has campaign tags in place. A later ad click is saved as well, and it replaces a first visit that had none. If you create an account, Kaviqa stores that with the account.

If you open a link that carries a member’s referral code (the part after ?ref=), Kaviqa saves that code in a cookie called kvq_ref. If you create an account, Kaviqa stores which member’s code it was with your account, so the member can be credited if you start a paid membership, and so you can be too. The code is random and holds no personal information. It is not used for marketing, and Kaviqa does not email you on a member’s behalf. Choosing Decline removes it.

Other companies set their own cookies on their own websites when you go to them from Kaviqa: Kiwi.com and Awin (whose tracking link sits in front of Kiwi.com) when you follow a booking link, Stripe’s secure payment pages, and Google if you sign in with it. We do not control those cookies; please see their privacy policies. Security tools that protect search and payment requests from automated abuse may also store identifiers in your browser for that purpose only.

Meta (when advertising measurement is on): on the home, Points and Cash & Points search pages, guides, flight hacks and Best deals, Meta Pixel sends Meta the page address — including search details in it such as your origin, destination and dates — together with browser and device information, your IP address and the _fbp and _fbc identifiers. Kaviqa’s server also sends Meta, through the Conversions API, the same page views and searches, views of a deal page (which deal it is and its advertised price), clicks through to a deal’s seller (which ticket and which seller), a sign-up for deal emails or a route watch, a verified new registration, the start of a membership checkout and an initial paid membership. Every one of these also carries your IP address, your browser and device information and, where you have them, your _fbp and _fbc values, with a hashed identifier (a hash of your visitor or account ID, not your name or email address) and, for a first membership payment, its amount and currency.

The sign-up, registration, checkout and payment events also carry a one-way hash of your email address, so Meta can match them to the ad that led you here. A sign-up for deal emails or a route watch counts when you give your address, whether or not you later confirm it (see Deal emails). To report a first membership payment, your IP address is kept with your browser details and your _fbp and _fbc values on your Stripe subscription from checkout. We do not send passenger details, passwords, payment-card details, signed email links or authentication tokens. The Pixel and the page, search, deal and seller-click events do not run on account, booking, billing or sign-in pages; the only events tied to those pages are the registration, checkout and payment events above. Automatic form matching and inferred purchase events are disabled. Meta handles the data under its Privacy Policy.

PostHog (when analytics is on): page views and a few actions, such as starting or submitting a search or clicking a booking button on a deal, with the page address (sign-in tokens, codes and secrets are removed before anything is sent), your visitor ID, browser and device information and, as with any request to a website, your IP address. Kaviqa does not run PostHog on pages reached from a signed email link or from a password-reset or sign-in link.

Session replay (when analytics is on): for about four in ten visitors, and for every visitor on the plans, billing, booking and account pages, PostHog records how the page looks and where you tap and scroll, so that we can see where people get stuck. Everything you type is hidden, on the plans, billing, booking and account pages all the text on the page is hidden as well, and the card form is never recorded. If you choose Decline, nothing is recorded.

Meta, PostHog and some of Kaviqa’s other providers may process data outside Australia and outside the European Economic Area, including in the United States. Where that happens we rely on the safeguards in our contracts with them.

Where the law requires it, we use optional cookies and similar technologies only with your consent. Essential cookies are used without consent because the service you asked for cannot work without them. Where consent is not required, we rely on our legitimate interest in understanding how Kaviqa is used and which ads lead to customers, and you can opt out at any time.

You can change your choice at any time, as easily as you gave it: use Your privacy choices here or in the footer of any page and choose Allow or Decline. Withdrawing your consent does not affect what was done before you withdrew it. You can also delete cookies in your browser’s settings. Kaviqa honours the Global Privacy Control signal.

Your rights in the EU, EEA, United Kingdom and Switzerland: you can ask for access to your personal data, correction, deletion, restriction of its use, or a portable copy; you can object to processing that rests on our legitimate interests; you can withdraw consent at any time; and you can complain to your data protection authority (in the United Kingdom, the Information Commissioner’s Office). To use these rights, email support@kaviqa.com.

Kaviqa does not sell personal information. Under some US state privacy laws, such as California’s, using the Meta Pixel and Conversions API to measure and target advertising counts as “sharing” personal information for cross-context behavioural advertising, or as targeted advertising. The information is the identifiers, page and search details and membership purchase details described above. You can opt out at any time with “Your privacy choices” in the footer, and Kaviqa treats the Global Privacy Control signal as an opt-out automatically. You can also ask to know, correct or delete your personal information, and Kaviqa will not treat you differently for doing so: email support@kaviqa.com.