Last updated: 2026-10
1. Controller
Akross, Inh. Thotli — postal address: see Imprint. Email: support@waylumio.com.
2. Summary
- You can use Waylumio without an account. Searches are calculated on the fly and not stored.
- Third-party partner technology (Travelpayouts) loads only after you consent.
- If you create an account, we store your email address, saved trips and fare alerts — until you delete them.
- Group trips store each member's name, departure airport, budget and wishes — deleted after 90 days of inactivity. Budgets are never shown to other members.
- No advertising networks, social-media pixels, external fonts or analytics cookies. Photos are hosted on our own server, so loading them contacts no third party.
3. Processing in detail
3.1 Visiting the website (server logs)
Our server processes your IP address, date and time, requested URL, status code, data volume, browser/user agent and referrer to deliver the site and defend against attacks. Legal basis: Art. 6(1)(f) GDPR. Logs are deleted or anonymised after 14 days unless needed to investigate a security incident.
3.2 Trip search, Days-off Maximiser and trip pages
The values you enter (departure airport, budget, travellers, dates, interests, federal state) are processed to compute results and are not stored. If live fares are enabled, our server asks the Travelpayouts price interface for a route and month only — no personal data is transmitted. Legal basis: Art. 6(1)(b) and (f) GDPR.
3.3 Group Wish
When you start or join a group we store your first name, departure airport, budget, party size, maximum flight time, interests and your votes, plus a random identifier in your session cookie that recognises you as a member. Other members see your name and departure airport only. Your budget is used solely to calculate whether a trip fits. You can leave a group at any time, which deletes your entry; groups inactive for 90 days are deleted automatically. Legal basis: Art. 6(1)(b) GDPR.
3.4 Account, saved trips and fare alerts
To sign in we send a one-time link to your email address. We store your email address, saved trips and fare alerts. Alerts are checked against cached fares several times a day and we email you when your target is reached. You can delete individual items or your whole account in “My account”. Legal basis: Art. 6(1)(b) GDPR and your consent given when signing in (Art. 6(1)(a)).
3.5 Email delivery
Sign-in and alert emails are sent via Brevo (Sendinblue SAS, France) as our processor under Art. 28 GDPR. Brevo processes your email address and the message content to deliver it.
3.6 Outbound partner clicks
When you click a partner button we count the click anonymously (partner, destination, language, time) — without IP address or user identifier — to understand which partners are useful. Legal basis: Art. 6(1)(f) GDPR.
3.7 Storage on your device
Strictly necessary (§ 25(2) TDDDG): session and CSRF security cookies; local storage for your consent choice (wl.consent.v2), theme (wl.theme) and text size (wl.large). Details: Cookies.
4. Travelpayouts partner technology (consent)
If you click “Accept” or enable the flight search, your browser loads scripts from Travelpayouts servers (emrldtp.cc, tpwdgt.com): an affiliate tool that attributes bookings to Waylumio, and the live flight search. These servers receive at least your IP address, device information and the page visited, and may set cookies or similar identifiers. The provider processes this data under its own responsibility — see the privacy information at travelpayouts.com. Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw consent at any time via “Cookie settings” in the footer.
5. Partner websites
When you follow a partner link you leave Waylumio; the partner's privacy policy applies. We receive commission reports (e.g. that a booking occurred and its commission), which do not identify you.
6. Hosting and recipients
The site runs on a virtual server under a data-processing agreement. Further recipients: Brevo (email) and, with your consent, Travelpayouts.
7. Third-country transfers
We do not intentionally transfer personal data outside the EU/EEA. Travelpayouts and its partners may process data in other countries; such transfers rest on your consent (Art. 49(1)(a) GDPR) and/or the provider's safeguards.
8. Your rights
You have the right to access (Art. 15), rectification (16), erasure (17), restriction (18), data portability (20), to object to processing based on legitimate interests (21), to withdraw consent at any time (7(3)), and to lodge a complaint with a supervisory authority. Write to support@waylumio.com.
9. Automated decisions, children, security
Trip rankings are recommendations, not decisions with legal effect. Waylumio is not directed at children under 16. All traffic is encrypted (TLS, HSTS).
10. Changes
We update this policy when our services change. The date at the top shows the current version.