Privacy Policy — Rahal Travel

1. Who Controls Your Data

ARISTOCRAT GROUP LIMITED (167-169 Great Portland Street, London, England, W1W 5PF) is the data controller for the personal data described in this policy — we decide how and why it's processed when you use rahaljourney.com.

2. What We Collect

Account data

Name, email address, and password (hashed — we never see or store it in plain text) if you create an account.

Passenger data

For each traveler on a booking: full name, date of birth, gender, email, and phone number. Where the airline requires it for the specific flight, we also collect passport number, expiry date, and issuing country. This data is sent to Duffel and the airline to issue your ticket — it is never optional decoration, only what's actually required to book your flight.

Payment data

Your payment is handled entirely by Stripe. We never receive, see, or store your full card number — only a payment confirmation and a reference id from Stripe.

Usage data

Search queries, pages visited, and technical data (browser, device). Analytics-level usage data is only collected if you accept analytics cookies — see our Cookie Policy.

3. Why We Process It

Booking a flight for you (search, checkout, ticketing)Necessary to perform our contract with you

Sending booking confirmations and refund noticesNecessary to perform our contract with you

Fraud prevention and rate limitingOur legitimate interest in keeping the service safe to use

Marketing emailsOnly with your explicit, opt-in consent

Analytics (Google Analytics)Only with your consent — see our Cookie Policy

4. Who We Share Data With

We share data only with the processors that make the service work — never for their own marketing, and never sold to advertisers.

StripeProcesses your payment. We never receive or store your full card number — Stripe handles that directly.

DuffelThe flight-booking technology we use to search fares and place your booking with the airline, including passenger and passport details required to issue your ticket.

ResendSends transactional emails — booking confirmations, refund notices, and, if you contact us, replies to your message.

VercelHosts the application and serves the website.

Database hosting (Neon/Postgres)Stores account, booking, and passenger data.

Google Analytics / Google Tag ManagerAggregate usage analytics — only loaded if you accept analytics cookies. See our Cookie Policy.

Passenger data is also shared with the operating airline, as required to issue your ticket — this is an unavoidable part of booking a real flight.

5. How Long We Keep It

Booking records (including passenger data) — kept as long as needed for legal, tax, and accounting obligations after your trip.
Account data — kept until you ask us to delete your account.
Payment data — we don't hold card numbers at all; Stripe retains transaction records per its own policy.

6. Your Rights

If you're in the EU/EEA (or a jurisdiction with similar law), you have the right to:

Access

Request a copy of the personal data we hold about you.

Rectification

Ask us to correct inaccurate or incomplete data.

Erasure

Request deletion of your personal data.

Restriction

Ask us to limit how we use your data.

Portability

Receive your data in a structured, machine-readable format.

Objection

Object to processing based on legitimate interest.

Withdraw consent

Withdraw marketing or analytics consent at any time.

To exercise any of these rights, email hello@rahaljourney.com. You also have the right to lodge a complaint with your local data protection authority.

7. Contact

Questions about this policy or how we handle your data? Email hello@rahaljourney.com.