Privacy Policy
Last updated: 8 Oct 2026
Welcome to byAir.
Your privacy is important to us. This Privacy Policy explains what data we collect, why we collect it, and how we protect it when you use our mobile apps, websites, and related services (collectively, “Services”).
1. Information We Collect
a. Account data
Email sign-in: your email address and information needed to verify your sign-in.
Google Sign-In: name, email, profile picture.
Apple Sign-In: anonymous Apple identifier; name/email only if you choose to share.
Signing in with Google does not itself grant byAir access to Gmail. Connecting Gmail is a separate, optional step.
b. Gmail flight-confirmation data (Google Workspace restricted scope)
- If you connect Gmail, we scan your inbox only for flight confirmation emails and extract flight number, airline, booking reference, departure/arrival airports and times.
c. Usage & device diagnostics
- App version, device model, crash logs, limited analytics.
d. Travel and sharing data
Flights, trips, travel statistics, notes, booking details, and preferences you add or manage through the Services.
Friends connections, invitation links, and friends' names and flight information available to your account under their sharing settings.
e. Web sign-in and MCP integration data
Web-session and OAuth authorization records, including account and client identifiers, approved permissions, token hashes, and expiry or revocation state.
Inputs submitted to byAir MCP tools, including flight or trip details supplied for import and requests to add, update, or remove data.
2. How We Use Your Information
Populate and display your flights, statistics, and travel insights.
Send alerts, Live Activities and calendar sync.
Provide customer support and improve app reliability.
Enable sharing features and carry out requests from AI assistants or other applications you connect through MCP.
Authenticate access, manage authorizations, and protect the Services against misuse.
We do not sell or share your personal data with advertisers.
Legal Bases for Processing
Where the GDPR applies, we rely on:
Performance of a contract: To provide your account and the flight-tracking and travel-management features you request.
Consent: For optional Gmail connections and sharing your account data with AI services you choose to connect. You may withdraw consent at any time using the controls or contact methods described below. Withdrawal does not affect the lawfulness of processing before withdrawal.
Legitimate interests: To maintain service security and reliability, prevent abuse, and diagnose technical problems, where those interests are not overridden by your rights and interests.
Legal obligations: To comply with applicable law and respond to lawful requests.
3. Google Workspace Data Use & AI Statement
byAir does not use data obtained from Google Workspace APIs (including Gmail) to develop, improve, or train generalized AI or machine-learning models.
Our use and transfer of information received from Google Workspace APIs, including information derived from Gmail messages, is subject to the Google Workspace User Data and Developer Policy, including its Limited Use requirements.
We process Gmail data to extract flight itineraries and provide the related travel features you choose to use. Transfers of Gmail data or derived information are limited to purposes permitted by those requirements, including providing visible, user-facing features with your consent, security, or compliance with law. Connecting an AI service does not remove these restrictions or permit the use of that information to train generalized AI models.
Gmail access can be revoked at any time in your Google Account settings. Signing in with Google and authorizing an MCP connection do not grant the connected AI service direct access to your Gmail inbox.
4. AI Assistants and MCP Integrations
When you connect an AI assistant or another application to byAir through MCP, that service can use the byAir tools covered by your authorization. These tools support both viewing and managing data, including adding, updating, or removing flights, trips, notes, and supported preferences.
Depending on the tools used, the connected service may receive flight and trip details, travel statistics, notes, booking details, friends' names and flight information available to your account, and invitation links. byAir receives the inputs submitted to its tools to carry out these requests.
The connected service's processing of received information is also subject to its own privacy policy and your account settings. The Google Workspace restrictions in Section 3 continue to apply to Gmail-derived information.
With OAuth, you sign in on the byAir website and approve access for the connected application. The application receives access tokens and, where authorized, refresh tokens. Refresh tokens allow it to renew access without asking you to sign in again, until the authorization expires or is revoked. A legacy personal MCP URL contains an API key; an application with that URL can use the access it grants.
To revoke an MCP authorization or access through a legacy personal URL, email connect@byairapp.com with your request. Revocation stops further authorized access to byAir but does not automatically delete information the connected service has already received. Contact that service to manage or delete its copies. Signing out of the byAir website does not revoke an existing MCP authorization.
5. Data Protection & Security
We employ industry-standard technical and organisational measures to safeguard all personal and sensitive data, including Gmail data:
Encryption in transit and at rest: All traffic uses TLS 1.2+; stored data is encrypted with AES-256.
Least-privilege & role-based access controls: Only authorised personnel with a need-to-know can access production data.
Isolated production environment: Credentials are stored in a secrets manager; direct database access is logged and audited.
Regular vulnerability scans & penetration tests (annually).
Incident response plan: We notify affected users and regulators of any data breach as required by applicable law.
Data Retention & Deletion
Gmail-derived flight data: Kept for the lifetime of your account or until you delete the trip, whichever comes first. Raw email bodies are never stored. If you disconnect Gmail or delete your account, associated Gmail data is purged within 30 days.
OAuth records: Retained indefinitely, including after an authorization expires or is revoked. Retaining a record does not keep an expired or revoked authorization active.
Technical logs: Retained for one week.
Backups: Retained for one month. Copies of deleted data may remain in backups until those backups expire.
Requests to delete personal data, including data in OAuth records, can be sent to connect@byairapp.com and are handled in accordance with applicable law.
6. Data Sharing
We share data only:
With trusted sub-processors (cloud hosting, error logging) bound by strict confidentiality and data-processing agreements.
With AI assistants or other applications you choose to connect, as described in Section 4, subject to the Google Workspace restrictions in Section 3 where applicable.
With other byAir users through the friends and sharing features you use, according to the applicable sharing settings.
When required by law or to protect rights, property, or safety.
A current list of sub-processors is available on request.
7. Your Rights & Controls
You may access, correct, export, or delete your data at any time. Email connect@byairapp.com or use in-app controls. EU users have GDPR rights (access, erasure, restriction, objection, portability). California residents have CCPA rights.
For MCP access revocation, currently contact connect@byairapp.com. Revoking MCP access, disconnecting Gmail, and deleting your byAir account are separate actions. Deleting data from byAir does not automatically delete copies previously received by a connected AI service.
Where processing is based on consent, you may withdraw it at any time. You may also lodge a complaint with a competent data-protection supervisory authority, including the Spanish Data Protection Agency (AEPD) or the authority in the EU country where you live or work, or where you believe an infringement occurred.
8. International Transfers
Data may be processed outside your country (e.g., EU-hosted servers). We rely on EU Standard Contractual Clauses or other lawful mechanisms for cross-border transfers.
An AI service you connect may process received information in other countries under its own arrangements. Review its privacy policy and account settings for details.
9. Children’s Privacy
byAir is not intended for children under 13 and does not knowingly collect their data.
10. Changes to This Policy
We may update this Privacy Policy. Material changes will be announced in-app or by email, and the date above will be updated. Where a change requires your consent, we will request it before carrying out that processing.
11. Contact
If you have questions or concerns, reach out to us at:
byAir (BYAIRAPP S.L.)
Email: connect@byairapp.com
Website: https://byairapp.com
Cl Rossello num.194 08008 - Barcelona