Privacy Policy
Last updated: 2026-07-27
This policy explains what personal data GoRoutly collects, why we collect it, how long we keep it and what rights you have over it.
1. Data controller
- Owner: GOROUTLY S.L.
- Contact email: info@goroutly.com
- Website: https://goroutly.com
2. What we collect
What we collect depends on how you use the site. Your card details never reach our servers: they are collected and stored by Stripe, our payment provider.
a) If you browse without an account and accept analytics:
- Your IP address.
- Your approximate country and city, derived from that IP address.
- An anonymous visitor identifier (a random code stored in your browser).
- The searches you run: departure airport, month or dates, travel pace and number of results.
- The itineraries whose details you open.
- Clicks on booking links (flights, accommodation and train).
- How long you spend on each page, and which page it was.
b) If you create an account:
- Your name, email address and profile picture, provided by Google when you sign in.
- The trips you save and the links you share.
- A user identifier linked to the analytics events described above.
c) If you buy a transport pack:
- For each traveller: title, given names and surnames exactly as they appear on their travel document, date of birth, the sex shown on that document, nationality, document type and number, issuing country and expiry date. These are the fields carriers require to issue a ticket: without them the ticket cannot be bought.
- From the buyer: email address, phone number and billing address.
- The amount, the order reference and the status of the purchase.
- The three consents you tick before paying, with the date and time you ticked them.
Traveller data is stored encrypted (AES-256-GCM) and is only decrypted to buy the ticket and to email it to you. Every access is logged.
d) Always, for the service to work at all:
- Connection data in the server logs (IP, timestamp, requested resource), needed to run the service and detect abuse.
- Your language preference.
3. Why we process it, and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing the itinerary search and displaying results | Performance of a contract or pre-contractual steps (Art. 6(1)(b)) |
| Managing your account, saved trips and shared links | Performance of a contract (Art. 6(1)(b)) |
| Buying the tickets of your pack on your behalf and sending them to you: traveller, contact and billing data | Performance of the package travel contract (Art. 6(1)(b)) |
| Keeping the invoice, the amount and the order reference | Legal accounting and tax obligation (Art. 6(1)(c)) |
| Measuring site usage to improve the product (searches, itineraries viewed, booking-link clicks, time on page) | Consent (Art. 6(1)(a)), which you may withdraw at any time |
| Keeping the service secure and preventing automated abuse | Legitimate interest (Art. 6(1)(f)) |
| Complying with legal obligations where applicable | Legal obligation (Art. 6(1)(c)) |
GoRoutly takes part in affiliate programmes: if you book through our links we may earn a commission at no extra cost to you. We record that a link was clicked, but we do not receive information about what you book or how much you pay.
4. How long we keep it
| Data | Retention period |
|---|---|
| Traveller data in an order (name, travel document, date of birth) | 90 days after the last flight of the trip, then deleted |
| Amount, order reference and invoice | The periods required by commercial and tax law, even once traveller data has been deleted |
| Analytics events (including IP address) | 90 days, then deleted automatically |
| Account data, saved trips and shared links | For as long as the account is active; deleted on request |
| Technical server logs | Only as long as needed for security and diagnostics |
| Anonymous visitor identifier | Until you clear site data in your browser |
5. Who else processes your data
We do not sell your personal data and we do not share it for advertising purposes. The following third parties are involved:
- Stripe Payments Europe, Ltd. (payment gateway): collects and processes your card details, which never reach our servers. It acts as an independent controller.
- Resend (email delivery): receives your email address and the contents of the order emails, including your ticket references.
- Kiwi.com and Omio (ticket purchase): when each leg is bought, they receive the traveller details the carrier requires to issue the ticket. Without that disclosure there is no ticket.
- Google (sign-in): if you choose to sign in with Google, their own privacy policy applies.
- Mapbox: maps are loaded from their servers, so your IP address is visible to Mapbox whenever a map is displayed.
- The booking providers and comparison sites we link to (flights, accommodation and train): clicking a link takes you off GoRoutly and that provider's privacy policy then applies.
- Our server hosting provider, acting as a data processor.
Site analytics run on our own servers. Approximate location is derived from a database installed locally, so your IP address is never sent to an external geolocation service.
6. International transfers
Our servers are located in the European Union. Some of the third parties listed above may process data outside the European Economic Area, relying on the safeguards set out in the GDPR, such as the European Commission's standard contractual clauses.
7. Your rights
You may exercise the following rights at any time:
- Access: find out what data of yours we process.
- Rectification: correct inaccurate data.
- Erasure: ask us to delete your data.
- Objection and restriction: object to processing or ask us to restrict it.
- Portability: receive your data in a structured, commonly used format.
- Withdrawal of consent: revoke your consent to analytics at any time, without affecting the lawfulness of processing carried out beforehand.
To exercise them, write to info@goroutly.com. If you believe we have not handled your request properly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or your local supervisory authority.
8. Children
GoRoutly is not aimed at children under 14 and we do not knowingly collect data from anyone in that age group.
9. Changes to this policy
We may update this policy to reflect changes to the service or to the law. The date of the latest update appears at the top of this document.