Privacy policy

Email: kontakt@wie-lange-fliegt-man.de

The controller has no establishment in the European Union. The following has been designated as representative under Article 27 GDPR:

Data subjects and supervisory authorities can contact this representative in addition to the controller.

Without your consent, Wie lange fliegt man? sets no statistics or advertising cookies and loads nothing from third-party statistics or advertising services; we do not embed third-party font services — only the map fetches the font for its place names with the map images from OpenFreeMap. Only if you consent in the banner do we use Google Analytics and Google Ads (more under “Google Analytics and Google Ads”) and store your IP address ourselves (“Our own analysis with IP address”); we store your choice itself in a cookie. Only if you sign in or request a sign-in code do we also set the cookies that are technically necessary for that (list below under “Account”). Only the “Where to for €…?” map is loaded by your browser from third parties: the MapLibre map library from unpkg.com, and the map images including font and symbols from OpenFreeMap; your browser keeps the map images in its cache like other files from the internet (more under “Flight search”). The flight search is an exception: our server sends your IP address to our partner network Travelpayouts in Hong Kong; there is no EU adequacy decision for Hong Kong (more under “Flight search” and “Transfer to a third country”). We count visits ourselves, without an identifier in your browser. If you click on an offer, you go to the provider; from then on, their privacy policy applies.

As with every visit to a website, your browser transmits technical details that arise during operation: IP address, date and time, the address requested, the amount of data transferred, and browser and operating system details. They are used to deliver the site and to detect faults and attacks.

The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR). These logs are not combined with other data; with your consent to “Our own analysis with IP address” we additionally store some of these details ourselves (see there). They are created as logs at our host and are deleted there automatically, after 30 days at the latest.

We count how often our pages are viewed. Nothing is stored on your device for this and nothing is read from it — no cookie, no browser storage, no counting script. That is why we do not ask for your consent for it: § 25(1) TDDDG concerns precisely the storing of information on, and the reading of it from, end devices, and neither happens here.

Only what your browser sends anyway when you visit is evaluated: the address requested, the page you came from (only its domain, never the full address), the browser identifier, the preferred language and your IP address. From the IP address, our host Vercel determines country, region and city before the request reaches us; we adopt these details but do not query a location service of our own. If you arrive via a tagged link (for example from an ad), we store the campaign details from the address (utm parameters) and the name of the ad network whose click identifier was in it — but not the click identifier itself.

Without your consent, we do not store the IP address. (If you have consented to “Our own analysis with IP address”, see there.) Together with the browser identifier and a random value that changes daily, it is converted into an identifier. This makes it possible to recognise that two visits on the same day belong together — nothing more; only if your account is created on the same day do we use this identifier once to look up the route by which you came, and record that route (not the identifier) in your account (see “Account”). After two days, we delete the random value and the identifier and cut the time down to the full hour; after 180 days, the rows are deleted completely. We count location only as a daily total (day, country, city, number), separately from all other details. This applies to the count without consent; what we additionally store with your consent to “Our own analysis with IP address” is described there — during that period your visits can also be linked to each other via the IP address.

The legal basis is our legitimate interest in knowing whether and from where visitors come (Art. 6(1)(f) GDPR). We do not use any third-party tool for this, and the figures are kept in our database in Frankfurt am Main.

If you consent in the banner, we use Google Analytics 4 (statistics) and Google Ads conversion tracking (advertising). You choose each one separately. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Before you consent, nothing loads from Google and nothing is stored on your device for it. Wie lange fliegt man? is measured in its own Analytics property, separate from other websites.

Why: With “Statistics” we see which pages are visited, for how long, where visitors come from (search engine, ad, link) and from which region. With “Advertising”, Google Ads measures whether a click on one of our ads led to a visit and to a click through to one of our partners. We do not use personalised advertising (remarketing), and Google Signals — the link to Google accounts — is switched off.

Which data: a random identifier in a cookie, pages viewed and the times of viewing, and the page you came from (in each case only the path of the address, without search details such as destination, travel dates, number of guests or search terms — we remove these before the measurement leaves your device), campaign details and the click identifier of an ad, clicks through to partners (only the partner’s name and domain, not the address of the offer), device, browser, language and the approximate location that Google derives from the IP address. According to Google, Google Analytics 4 does not store IP addresses.

Cookies: _ga and _ga_… (statistics, up to two years), _gcl_… (advertising, up to 90 days). We store your choice itself for six months in the cookie einwilligung; after that, we ask again.

The legal basis is your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future: Cookie settings, also at the bottom of every page. When you withdraw it, we delete the Google cookies in your browser.

USA: Google may transfer data to Google LLC in the USA. Google is certified under the EU-US Data Privacy Framework, for which the European Commission determined an adequate level of protection on 10 July 2023 (Art. 45 GDPR). For Google Analytics, Google processes the data as a processor under the Google Ads Data Processing Terms. For Google Ads conversion tracking, Google is itself a controller (Google Ads Controller-Controller Data Protection Terms); Google’s privacy policy also applies to this.

Retention at Google: Google Analytics deletes event data after 14 months at the latest. More from Google: policies.google.com/privacy.

If you have consented to our own analysis with IP address in the banner (a separate question, independent of “Statistics”; “Accept all” includes it), we ourselves — not Google — store, on every page view and when you move on to a partner via our interstitial page: your IP address, the time, the country, region and city that our host Vercel derives from it, device, browser and operating system (from the browser identifier), the page visited (only the path of the address) and the route of your visit (channel, campaign, ad group or link content). When you move on to a partner, the partner’s name and the check value of our identifier for that move are added, not the identifier itself (see “Referral to partners”). Names and email addresses are not part of it. We set no additional cookie for this; whether you have consented we read from the cookie holding your choice.

Why: to detect programs and automated access (bots) and fraud, to check bookings reported to us by partner networks and their cancellations, and to see which routes (ads, search engines, AI services, links) lead to bookings. Via the IP address, your visits during this period can be linked to each other; via the check value, a reported booking can be matched to your visit.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future: Cookie settings. After that we store nothing new and immediately delete all entries with the IP address from which you withdraw. Entries stored under a different IP address are deleted at your request (see “Your rights”). Without consent, only the audience measurement above applies, without an IP address.

Storage period: 90 days. If an entry belongs to a reported booking via the check value, it is kept while the booking is open and then for three months from the last change to its report (usually its final settlement: confirmed, cancelled or rejected) — at most twelve months after the visit. It is stored in our database in Frankfurt (Neon); for the transfer to Georgia, see “Transfer to a third country”.

On Wie lange fliegt man? you can create a free account — from age 18. You can search, compare and go to a provider without one. You sign in with your email address: we send you a six-digit code, and the first correct code creates the account. There is no password.

It is one account for all our travel sites (the list is under “Our travel sites” in the footer of this page), which the same controller runs; on a site it becomes usable once that site offers it. You are signed in on each site separately, with a code of its own; if you sign in there with the same address, you are in the same account. What happens there with your details is set out in the privacy policy of that site.

We store your email address, optionally a first name if you give one, when the account was created and the address confirmed, and when you last signed in. For each sign-in we record which of our sites it took place on, when it began, until when it is valid, when it was last used, and browser and operating system in short form (such as “Safari on iOS”). With the first code that creates your account, we also record once where you came from: on which of our sites or in the app you signed up, on which page there (only its path, such as “/konto” or the route on a route page — without the query part of the address and without identifiers) and by which route you found us, in a rough classification (such as search engine, AI assistant, ad, direct visit, another of our sites or the app). We take the route from the entry of your visit in the audience measurement (see “Audience measurement”), which we look up briefly using the same daily value that this measurement forms anyway; only the site, the path and the rough classification stay in your account — no IP address and no identifier. Accounts created before then do not have this information. For each request for a code we store the address, a check value of the code (not the code itself), the number of entries, the site on which you requested it, and a hash value of your network, not your IP address. This limits how often codes can be requested and guessed.

The legal basis is the user agreement for your account (Art. 6(1)(b) GDPR); limiting code requests and keeping a record of a deletion rest on our legitimate interest in preventing abuse and being able to prove deletions (point (f)). Recording where you signed up from is based on our legitimate interest in seeing through which of our sites and routes accounts come about, and in improving our offer accordingly (likewise point (f)). We use the details only for the account itself, including the emails we write to you for it: the sign-in code and the confirmation of a deletion. In addition, your account is listed individually in our internal administration area — with first name, email address, the day it was created and of the last sign-in, and the number of trips saved and booked in the account and of signed-in devices — so that we can manage the accounts; for the first 30 days it also lists your account as a new account, with the time it was created and a shortened form of your email address, so that we notice new accounts (both point (f)). Beyond that, we do not evaluate the details about you; for our statistics we only count totals (such as new accounts by site and route; point (f)). You do not receive advertising for it.

The details are stored in our database at Neon in Frankfurt am Main. The email with the code comes from “Wie lange fliegt man?” and leaves through our mailbox at united-domains; its sender address is on nighthopper.de, another of our domains, not on this site’s. We do not keep a copy.

Cookies. Only when you request a code do we set the sign-in cookies below; they are indispensable for the account (§ 25(2) no. 2 TDDDG), which is why we do not ask for your consent for them. If you do not request a code, we set none of them.

• __Host-nh_anmeldung — ties the code to the browser in which you requested it. 15 minutes; it appears as soon as you request a code.
• __Host-nh_konto — your sign-in on this site. Up to 30 days, until you sign out; it appears with the correct code.
• nh_angemeldet — the “signed in” hint for the page header; only the value “1”, no identifier. It ends with the sign-in.

The account stays until you have it deleted. We delete the details of a code request (address, check value, hash of the network) after 24 hours, at the latest in our next daily clean-up (so after 48 hours at most); a sign-in is valid for a fixed 30 days and ends sooner when you sign out. If you sign out on one of our sites, your sign-in ends on all our websites, including in other browsers and on other devices; “Sign out everywhere” also ends the one in our app.

We delete your account when you write to kontakt@wie-lange-fliegt-man.de, with all details stored for it, also on our other sites, because it is one account. Ideally write to us from your account’s address; otherwise we will briefly check with you there. As a record of the deletion we keep only the date and a shortened form of your email address for 180 days. The origin of your sign-up is kept as long as your account exists and is deleted with it; it is part of the details you get as a copy on request. You also get information about your details and a copy on request; more under “Your rights”.

If you search for flights — using the search form or a shared link — your browser sends the departure airport, destination, travel dates, number of travellers, travel class and the “direct flights only” option to our server; they are in the address of the page. With them, our server asks the Aviasales flight search (via its partner network Travelpayouts) for current offers; if it returns nothing, our server uses the most recently found prices from the Travelpayouts Data API. These requests are made by our server, not by your browser: apart from your IP address in the search via Aviasales (see below), Aviasales and Travelpayouts learn nothing about you as a person, not even your browser identifier. We keep the same answer available to all visitors for up to five minutes, and the Data API’s answer for up to 30 minutes; we store nothing about you as a person.

One exception: your IP address to Travelpayouts. For the search via Aviasales, our server sends your IP address to Travelpayouts together with your search. Travelpayouts requires it for every new search and uses it to limit how often searches can be made from one address; without it, all our visitors would share a single quota, and the search would fail when traffic is heavy. We do not store the address for this. According to its own information, Travelpayouts is operated by companies based in Hong Kong; what this means for your data is set out under “Transfer to a third country”. The legal basis is our legitimate interest in a flight search that works even with many visitors (Art. 6(1)(f) GDPR).

Without any information about you as a person, our server asks Kiwi.com for guide prices for the days in the calendar of the search form as soon as you have chosen the departure and destination, and Travelpayouts for the most recently found prices if you choose “Everywhere” as the destination. We deliver the photos of the destinations (from Pexels, Pixabay and Wikimedia Commons) and the logos of the airlines and travel sites from our own server; your browser loads nothing from Pexels, Pixabay, Wikimedia or the providers before you tap an offer. “Share” opens your device’s share menu or copies the address of the page — we learn nothing about it.

The “Where to for €…?” map shows the same destinations as “Everywhere” on a map; our server gets the prices in the same way as there. For the map, your browser loads the MapLibre map library from unpkg.com and the map images including font and symbols from OpenFreeMap (tiles.openfreemap.org). Both services learn your IP address and which map section you are viewing, as with any retrieval of a file from the internet — but not your budget or month; the initial map section is roughly based on the departure airport. No cookies are set for this, and we do not pass anything on to them. Your browser keeps the map images in its cache like other files from the internet, so that the map appears faster next time; we do not read any of it. As under “Everywhere”, we suggest the departure airport there based on your approximate location (see below). The basis is our legitimate interest in being able to show you the destinations on a map (Art. 6(1)(f) GDPR).

We pre-fill the “From” field with the major airport nearest to your approximate location. Our host Vercel derives the location (country, region, city and approximate coordinates of the city) from your IP address; we do not query a location service of our own. In the flight search without a chosen route, under “Everywhere” and on the “Where to for €…?” map the airport is already part of the page. Our server only calculates the distance to the airports. We store neither your IP address nor the location nor the suggested airport – only our host’s usual logs are created, as with every request (see “When you visit the site”). Nothing is stored on your device for this, and you can change the airport at any time. We do not suggest an airport to programs and search engines that we recognise as such. The legal basis is our legitimate interest in making your search easier (Art. 6(1)(f) GDPR).

So that nobody can trigger the search en masse, our server counts how often searches are made or offers opened from the same IP address, and uses the browser identifier to recognise programs and search engines (for which it does not search again). The counters are kept only in the server’s memory, apply for an hour at most and are not stored anywhere.

If you tap an offer, an intermediate page shows where it leads; for this, our server fetches the address of the offer from the provider or from Travelpayouts, and your browser then opens it itself. From then on, what is set out under “Referral to partners” applies. The legal basis is our legitimate interest in being able to show you current flight prices (Art. 6(1)(f) GDPR).

If you click on an offer, you leave Wie lange fliegt man? and arrive at the provider concerned — often first at a partner network that counts the click and forwards you. In the process, an identifier is passed on with which the provider can attribute a booking to our recommendation; this is how our commission arises. Depending on the offer, this is an identifier of this switch made up of the route, the travel date, the time at which the link was created and a random part, or just a word for the place on our site; it contains no name and no contact details. This only happens when you click yourself; before that, this site loads nothing from providers or networks. Only in the flight search does our server send your IP address to Travelpayouts before that (see “Flight search”).

From the click onwards, the network and the provider are responsible for the processing; their privacy policies apply. They decide for themselves which data they collect and whether they set cookies. We count the click itself (day, page, provider). If you have consented in the banner, the click also goes to Google Analytics, only with the partner’s name (see “Google Analytics and Google Ads”).

If you open an offer via our interstitial page, we also store a check value calculated from our identifier for that move — not the identifier itself — together with the partner, the full hour and the route by which you arrived (channel, campaign, ad group), for 90 days. For this we set no cookie and read nothing additional from your device except the cookie holding your banner choice. With your consent to “Our own analysis with IP address”, we also store your IP address in the process, and the check value is kept with that entry for as long as the entry (see there).

If a partner network reports a booking for our identifier (the networks and partner programmes through which we are paid by the providers, for example Travelpayouts, CJ, Awin, Expedia and Trip.com), we store the network, partner, status, time of booking, booking value and our commission, the network’s reference for the booking, our identifier and, where the network provides them, the customer’s country and city (only the place name), device type, operating system, start of travel and destination and the page from which you switched — no names, contact details or IP addresses. This shows us which advertising and which of our pages lead to bookings and lets us check our commissions. We delete our identifier and the city 180 days after the booking, the whole row 400 days after the booking. The legal basis is our legitimate interest in measuring the success of our advertising and our pages and in checking commissions (Art. 6(1)(f) GDPR); you can object to this (see “Your rights”). For our overview, we also pass individual bookings without identifiers, names or the customer’s city to the same AI service: day, network, partner, area, status, amount, commission, channel and campaign, country and device type, and in our notes and evaluations on a booking also start of travel, destination, operating system and the pages of our website through which it came. This happens once a day (see “Evaluation with AI” under “Contact form and email”).

If you write to us using the contact form or by email, your name, your email address, the subject and your text go to our inbox. We use them to reply to you and for the evaluation with AI (below); otherwise we do not pass them on to anyone. The basis is our legitimate interest in being reachable (Art. 6(1)(f) GDPR).

So that the form is not flooded by machines, our server briefly checks, when you send it, how often messages have been sent from the same origin. For this, your IP address is immediately converted into a hash value; the plain text is not stored, and the hash value is kept only in working memory and is gone after one hour at the latest. We keep the message itself until the matter has been dealt with, for three years at most; what goes to Anthropic from it for the evaluation with AI, for as long as described below.

Evaluation with AI. Once a day, a program on our own computer evaluates the previous day’s mail in our inboxes so that nothing gets left behind and we see what matters to customers and partners: it summarises enquiries and recognises, for example, booking confirmations, deadlines and problems. For this we use Claude, the AI service of Anthropic. For each email, the time, inbox and folder, the sender’s name, the domain of their address, the subject and the text go to Anthropic, PBC in the USA, shortened to 1,500 characters and without attachments, at most 80 emails a day; undeliverable-mail notices stay out. This includes anything you write in it yourself; for messages sent via the form, your name is in the text. Before that, we black out email addresses, telephone numbers, IBANs and card numbers, ID and booking numbers and dates of birth where a cue word such as “booking number”, “confirmation” or “born” precedes them, and common words for illnesses and disabilities; this does not catch everything, and we do not black out names or addresses — please only send us health information if your request needs it. All we store is the result: a short summary into which no names or contact details are meant to be carried over; before storing it, we additionally filter out email addresses and telephone numbers, and we delete it after 13 months, except for what we take over from it as a task. We delete the file with the emails and the AI’s answer after each run.

The legal basis is our legitimate interest in dealing with enquiries and business mail completely and quickly and in aligning our offering accordingly (Art. 6(1)(f) GDPR). You can object: write to us at kontakt@wie-lange-fliegt-man.de; we then put your address on a block list, and from the next run after that, emails from it — also as a reply-to address or via the form — no longer go into the evaluation. We already leave out emails that are recognisable as an objection — reliably if “objection” is in the subject line. Anthropic is not our processor for this: we use a Claude subscription, and Anthropic processes the data under its terms for subscriptions and its privacy policy. We have switched off their use for training its models; according to its own information, Anthropic then keeps inputs and outputs for 30 days. If its safety systems detect a breach of its usage policies, inputs and outputs are kept for up to two years and the safety systems’ classification scores for up to seven years, or longer where the law requires. Anthropic, PBC is not certified under the EU-US Data Privacy Framework, and we have not concluded standard contractual clauses with Anthropic for this subscription. In the USA, your email may therefore be less protected than in the EU, for example against access by authorities. More from Anthropic: anthropic.com/legal/privacy.

With the switch at the top of every page, you choose a light or a dark appearance. We do not store this choice — neither as a cookie nor in your browser’s storage, and it is not transmitted to us either. It applies until you reload the page; after that, the appearance follows your device’s setting again.

The fonts of this site — for headings and text — are delivered with the site by our host Vercel (see “Who works for us”). Your browser does not load them from Google Fonts or any other font service — only the “Where to for €…?” map fetches the font for its place names with the map images from OpenFreeMap (see “Flight search”).

We do not run the site on our own computers. These service providers process data exclusively on our behalf and according to our instructions:

• Vercel — operation of the website. The pages and interfaces run in the Frankfurt am Main region.
• Neon — the database that holds the visit counts and the reported bookings, the IP addresses stored with your consent (“Our own analysis with IP address”) and, if you create one, your account. Location: Frankfurt am Main.
• united-domains — our email inbox, that is, everything you write to us, and the sending of sign-in codes.

Vercel and Neon are companies based in the USA; access from there cannot be technically ruled out. The basis for this is the European Commission’s adequacy decision on the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.

For the daily evaluation of our inboxes and our bookings, we also use Claude from Anthropic (Anthropic, PBC, San Francisco, USA) via a subscription. For this, Anthropic is not our processor but processes the data under its own terms (see “Contact form and email”).

The controller is based in Georgia. There is no adequacy decision of the European Commission for Georgia. The operation of the site and the database, on the other hand, are located in the European Union (Frankfurt am Main). We access them from Georgia only to operate the site, manage the accounts and to answer your enquiries and — with your consent — to evaluate the entries under “Our own analysis with IP address”. For the daily evaluation with AI, emails and bookings without identifiers also go to Anthropic in the USA (see “Contact form and email”). What goes to Google, and possibly to the USA, with your consent is set out under “Google Analytics and Google Ads”.

For the “Where to for €…?” map, your browser loads the MapLibre map library from unpkg.com and the map images including font and symbols from OpenFreeMap. Both services deliver their files via the network of Cloudflare (Cloudflare, Inc., USA); Cloudflare usually answers the requests from a data centre near you, but access from the USA cannot be ruled out. Cloudflare is certified under the EU-US Data Privacy Framework, for which the European Commission determined an adequate level of protection on 10 July 2023 (Art. 45 GDPR). OpenFreeMap is operated by Hyperknot Software Kft. in Hungary; according to its own information, its server logs usually contain no IP address and are deleted after seven days. unpkg.com is an open-source project of the developer Michael Jackson in the USA. unpkg.com publishes no privacy policy, no certification under the Data Privacy Framework is apparent, and we have no contract with unpkg.com. What unpkg.com may learn in the process — your IP address, which files your browser loads and from which website — may therefore be less protected in the USA than in the EU, for example against access by authorities.

Travelpayouts (Aviasales). When you search for flights on Wie lange fliegt man?, our server sends your search together with your IP address to the search interface of Travelpayouts (see “Flight search”); when you choose an offer, it asks Travelpayouts for the offer’s address using the identifier of the search the offer comes from. According to its own information, Travelpayouts is operated by companies based in Hong Kong (according to its privacy policy, by Go Travel Un Limited). There is no adequacy decision of the European Commission for Hong Kong, and we have not agreed standard contractual clauses or other safeguards under Art. 46 GDPR with Travelpayouts. Your IP address may therefore be less protected there than in the EU, for example against access by authorities, and your rights may be harder to enforce there. What Travelpayouts does with the address and how long it keeps it is decided by Travelpayouts itself; general information is given in Travelpayouts’ privacy policy.

You have the right of access, rectification, erasure, restriction of processing and data portability, and the right to object to processing based on a legitimate interest. An informal message to the address given above is enough; we reply within one month.

Right to object: you can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest (Art. 6(1)(f) GDPR) — for example the audience measurement, passing your IP address to Travelpayouts in the flight search, the departure airport based on your location and the evaluation of reported bookings (Art. 21(1) GDPR). An informal message to the address above is enough.

You can also complain to a data protection supervisory authority — as a rule, the authority where you live or the authority at the seat of our EU representative.