We run a reservation service, so we hold as little as we can: an email address, the itinerary you asked for, and the booking reference we issue.
Controller under the GDPR: AI Handels AG, Düsseldorf, Germany. Contact for anything privacy-related, including exercising your rights: kontakt@flightmonster.store. The full company details are in the imprint.
When you lock a route we store: the route (origin and destination IATA codes), travel date, number of travellers, your email address, the carrier and aircraft we quote, the quoted price, the reservation status and timestamps, and — once you pay — the passenger name you type and the booking reference issued. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and, for the period before you pay, steps taken at your request before entering into one.
Payment is handled by Stripe on its own checkout page. Your card details go directly to Stripe; we never see or store them. We receive a session identifier and the payment status. Legal basis: contract (Art. 6(1)(b)) and our legitimate interest in documenting that a payment happened (Art. 6(1)(f)).
Your e-ticket and the buy link are sent through Resend, which needs your email address and the message content to deliver it. Legal basis: contract (Art. 6(1)(b)).
On the home page we count page views per country per day, taken from the country Cloudflare derives from the connection. The stored row is “DE had 12 views on 2026-10-23” — a number per country per day. No IP address, no cookie and no identifier is stored with it, and it cannot be traced back to a person. Legal basis: our legitimate interest in knowing which markets reach us (Art. 6(1)(f)).
Our host (Cloudflare) processes technical request data, including IP addresses, to deliver the site and defend it against abuse. We do not build profiles from it and do not combine it with anything above. Legal basis: legitimate interest in a secure, available service (Art. 6(1)(f)).
There is no advertising, no analytics product, no social pixel and no cross-site tracking on this site.
Only the processors needed to run the service: Cloudflare (hosting, database, email routing infrastructure), Stripe (payments), Resend (transactional email). They act on our instructions under data-processing agreements. We do not sell data and do not share it for advertising.
Where a processor is outside the EEA (for example in the United States), the transfer relies on the EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework.
Reservation rows stay while the booking is live and afterwards so we can answer questions about it and document the payment. If you want a reservation deleted, ask us at the address above and we will delete it unless a statutory retention duty (for example tax law) requires us to keep a record. Aggregated country counts contain nothing personal and are kept indefinitely.
You have the right to access your data, to have it corrected, to have it erased, to restrict or object to its processing, and to receive it in a portable format. You can withdraw consent at any time with effect for the future. Write to kontakt@flightmonster.store; we answer within one month.
You may also complain to a supervisory authority — for us that is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.
The price you are quoted is calculated automatically from the route, distance and demand, but it does not produce legal effects or significantly affect you in the sense of Art. 22 GDPR, and no decision about you is made without a human able to review it.
Verantwortlich: AI Handels AG, Düsseldorf. Kontakt: kontakt@flightmonster.store.
Reservierung: Wir speichern Strecke, Reisedatum, Anzahl der Reisenden, deine E-Mail-Adresse, die Airline, den Preis, den Status und – nach Zahlung – den Passagiernamen und den Buchungscode. Rechtsgrundlage: Vertragserfüllung (Art. 6 Abs. 1 lit. b DSGVO).
Zahlung: abgewickelt über Stripe; Kartendaten sehen wir nie. Wir erhalten eine Sitzungskennung und den Zahlungsstatus.
E-Mail: Versand über Resend (Adresse und Nachrichteninhalt).
Besucherkarte: Wir zählen Seitenaufrufe je Land und Tag („DE hatte 12 Aufrufe“). Keine IP-Adresse, kein Cookie, keine Kennung wird dabei gespeichert. Rechtsgrundlage: berechtigtes Interesse (Art. 6 Abs. 1 lit. f).
Cookies: fm_consent (deine Auswahl, 180 Tage, notwendig), fm_id (Partner-Code, 90 Tage, nur nach Klick auf „Akzeptieren“), fm_lang (Sprachwahl, im lokalen Speicher des Browsers, kein Cookie). Keine Werbung, keine Analyse-Tools, kein site-übergreifendes Tracking.
Empfänger: Cloudflare (Hosting, Datenbank), Stripe (Zahlung), Resend (E-Mail). Kein Verkauf von Daten. Übermittlungen außerhalb der EU stützen sich auf die Standardvertragsklauseln bzw. das EU-US Data Privacy Framework.
Speicherdauer: solange die Buchung läuft und danach zur Beantwortung von Rückfragen und zum Nachweis der Zahlung; auf Wunsch löschen wir, soweit keine gesetzliche Aufbewahrungspflicht entgegensteht.
Deine Rechte: Auskunft, Berichtigung, Löschung, Einschränkung, Widerspruch, Datenübertragbarkeit und Widerruf einer Einwilligung. Beschwerde bei der Landesbeauftragten für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf.