Privacy Policy

İST AND TRAVEL TURİZM LTD ŞTİ, Şişli, Istanbul, Türkiye, operates FlightByte and decides how the personal data described here is used. It is the data controller under the EU and UK General Data Protection Regulation (GDPR) and the “veri sorumlusu” under Türkiye’s Personal Data Protection Law No. 6698 (KVKK). Write to support@flightbyte.dev about anything in this policy.

• Visiting the website. flightbyte.dev runs no analytics, advertising or tracking scripts. Our hosting provider keeps standard server logs, such as IP address, browser and the page requested, for security and troubleshooting. The forms use your IP address briefly to limit how often they can be sent.
• Contact and key request forms. Your email address, and what else you choose to give: name, project, use case, plan, expected volume and your message.
• Your dashboard account. Your email address, the IP address you signed up from, a bot check at sign-up, and when you last signed in. Sign-in links are emailed to you and work for 15 minutes; a session cookie keeps you signed in for up to 30 days.
• Using the API. Your API keys, of which we store only a hash; a log of your requests (method, path, status, duration and time); usage counts; the subscriptions you create, with their flight, webhook URL, any custom headers and metadata; and the history of webhook events and deliveries.
• Payments. Paddle collects your billing and card details as Merchant of Record; we never see full card numbers. We receive what we need to run your account: your name, email address, country, plan, amounts and order numbers.
• Support. The emails and Telegram messages you send us.

Flight data itself is not personal data. Subscription metadata and custom headers are yours: we store them and send them back to your endpoint, and for any personal data you put there we act on your behalf. Put no more there than you need.

• To provide the Service under our agreement with you: accounts, keys, subscriptions, webhooks, billing and support.
• To keep it secure and fair, which is our legitimate interest: logs, rate limits, bot checks and one Free account per person.
• To meet our legal obligations, such as tax and accounting records and lawful requests from authorities.
• To tell you about changes to the Service, your plan or these policies.

These correspond to the legal bases of contract, legitimate interests and legal obligation in Article 6 of the GDPR and Article 5 of the KVKK. We do not sell personal data, use it for advertising, send marketing email without your consent, or make automated decisions about you that have legal effects.

• The hosting and infrastructure providers that run our website, API and databases.
• Resend, which sends our sign-in emails.
• Cloudflare, which runs the Turnstile bot check at sign-up.
• Paddle, which handles payments, invoices, tax and refunds as Merchant of Record under its own privacy policy.
• Telegram, if you contact us there; its own privacy policy applies to those messages.
• Our team chat provider, which notifies us when a form is sent.
• Authorities, when the law requires us to.

The flight data providers we query receive flight numbers and dates, never your personal data.

Some of these providers process data outside Türkiye and the European Economic Area, for example in the United States. Where the law requires it, we rely on appropriate safeguards such as standard contractual clauses and, for transfers from Türkiye, the mechanisms in Article 9 of the KVKK.

• Request logs: 7 days.
• Webhook events and deliveries: 30 days.
• Sign-in links: 15 minutes. Sessions: up to 30 days.
• Your account, keys and subscriptions: while your account is open. When you close it, we delete or anonymise them, except what the law makes us keep.
• Form messages and support conversations: as long as we need them to answer you and follow up.
• Billing records: as long as tax and commercial law requires, which in Türkiye can be up to 10 years.

You can ask to see the personal data we hold about you, correct it, delete it, receive a copy, restrict or object to how we use it, and withdraw any consent you gave. These include your rights under Article 11 of the KVKK. Write to support@flightbyte.dev, from your account’s email address if it is about your account, and we answer within 30 days.

You can also complain to a supervisory authority: in Türkiye the Personal Data Protection Authority (KVKK), in the EU or UK the data protection authority where you live.

The website sets no cookies for analytics or advertising. The dashboard uses one essential cookie to keep you signed in, and Cloudflare Turnstile may set cookies it needs for the bot check at sign-up. Neither needs your consent, because the Service cannot work without them.

Everything travels over HTTPS, API keys are stored only as hashes, webhooks are signed, and access to our systems is limited to the people who run them. No system is perfectly secure; if a breach affects your data, we tell you and the authorities as the law requires.

FlightByte is a tool for developers and businesses. It is not meant for anyone under 18.

When this policy changes, the date at the top changes with it. We tell you about material changes by email or in the dashboard before they take effect.

İST AND TRAVEL TURİZM LTD ŞTİ, Şişli, Istanbul, Türkiye.

Email support@flightbyte.dev or message @flightbyte on Telegram.