Privacy Policy

MileMarketplace is the controller of personal data processed through the Platform. Where we process personal data on behalf of Users (for example, data a Seller provides to complete a booking), we may act as a processor for that limited purpose.

For data-protection questions, contact admin@milemarketplace.com.

We collect the following categories of personal data:

You provide directly:

• Identity and contact data — name, email, phone, country/region, and (where verification is required) date of birth and government-ID information.
• Account data — username, password (stored hashed), and account preferences.
• Transaction data — listings, offers, messages, and details relating to miles, points, award bookings, and reservations you choose to provide (which may include loyalty-program identifiers, booking references, and passenger names).
• Payment data — handled primarily by our Payment Providers; we receive limited information such as transaction status, the last four digits of a card, and payout details. We do not store full card numbers.
• Communications — support tickets, correspondence, and dispute submissions.

Collected automatically:

• Device and usage data — IP address, device and browser type, operating system, pages viewed, referring URLs, timestamps, and interactions.
• Online identifiers — cookie IDs and advertising/analytics identifiers set by us and by our analytics and advertising partners (see Section 8).

From third parties:

• Identity-verification, fraud-prevention, and analytics providers; Payment Providers; and, where you connect them, third-party services you authorize.

We do not intentionally collect special-category data and ask that you not submit it.

We process personal data for the purposes below. Where the EU/UK GDPR applies, the legal basis is shown in brackets.

• Provide and operate the Platform, create and manage your account, and enable Transactions between Users (performance of a contract).
• Process payments, payouts, holds, refunds, and chargebacks via Payment Providers (performance of a contract; legal obligation).
• Verify identity and prevent fraud, abuse, money laundering, and prohibited activity (legitimate interests; legal obligation).
• Provide support and handle disputes (performance of a contract; legitimate interests).
• Maintain security, integrity, and availability of the Platform (legitimate interests; legal obligation).
• Improve and develop the Platform and analyze usage (legitimate interests; consent for non-essential analytics where required).
• Measure and run marketing and advertising, including via the advertising partners in Section 8 (legitimate interests; consent where required).
• Communicate with you, including service messages and, where permitted, marketing (legitimate interests; consent where required).
• Comply with law and respond to lawful requests, and establish, exercise, or defend legal claims (legal obligation; legitimate interests).

Where we rely on legitimate interests, we balance them against your rights. You may object as described in Section 9.

We will send marketing only where permitted by law, and you can opt out at any time via the unsubscribe link or by contacting admin@milemarketplace.com. Service and transactional messages are not marketing and cannot be opted out of while you have an account.

We share personal data with:

• Other Users, only to the extent necessary to complete a Transaction (for example, a Buyer and Seller may see information needed to coordinate a booking).
• Payment providers (such as PayPal), to process payments and payouts.
• Service providers / processors — hosting and infrastructure (such as Vercel), database and authentication (such as Supabase), email delivery, identity verification, fraud prevention, and customer support — bound by contract to process data only on our instructions.
• Analytics and advertising partners — Google (Google Analytics), Meta Platforms (the Meta/Facebook Pixel), and TikTok (the TikTok Pixel). These partners may receive online identifiers, device/usage data, and events (such as page views and purchases) to help us measure performance and deliver advertising. See Section 8 and your choices in Section 11.
• Affiliate partners — where you arrive via an affiliate link, a first-party cookie records the referring affiliate so we can attribute and pay commission; we share only aggregate referral and order information with that affiliate, not your personal contact details.
• Professional advisers — lawyers, accountants, auditors, and insurers.
• Authorities and third parties where necessary to comply with law, enforce our Terms, prevent fraud or harm, or protect our rights, property, or safety, or those of Users or the public.
• Corporate transactions — in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to this Policy.

We do not sell your personal data for money. See Section 11 for how “sale” and “sharing” are treated under U.S. state laws.

We operate from the United States, and your data may be processed in countries other than your own, primarily the United States, where our hosting and service providers operate. Where we transfer personal data from the EEA, the United Kingdom, or other regions with transfer restrictions to a country without an adequacy decision, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum) or another lawful transfer mechanism. You may request a copy of the relevant safeguards via admin@milemarketplace.com.

We keep personal data only for as long as necessary for the purposes in this Policy, including to provide the Platform, comply with legal, tax, and accounting obligations, resolve disputes, prevent fraud, and enforce our agreements. Retention periods vary by data type and legal requirement; transaction and financial records may be kept for up to seven (7) years or longer where required. When data is no longer needed, we delete or anonymize it.

We use cookies and similar technologies to operate the Platform, remember preferences, maintain security, measure performance, and (where permitted) analyze usage and personalize advertising. Strictly necessary cookies — including the session cookies set by our authentication provider — are always active.

We use the following non-essential analytics and advertising technologies:

• Google Analytics (Google) — measures site usage and traffic. Opt out with Google's browser add-on at tools.google.com/dlpage/gaoptout.
• Meta Pixel (Meta Platforms) — measures conversions and supports advertising on Facebook and Instagram. Manage ad preferences in your Meta account settings.
• TikTok Pixel (TikTok) — measures conversions and supports advertising on TikTok. Manage preferences in your TikTok ad settings.
• Affiliate cookie — a first-party cookie that records a referring affiliate for up to 60 days so we can attribute orders.

You can control cookies through your browser settings, and we honor recognized opt-out preference signals (such as Global Privacy Control) where required by law. Disabling some cookies may affect functionality, including the ability to stay signed in.

Subject to applicable law, you may have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate or incomplete data;
• Erase data (“right to be forgotten”) in certain circumstances;
• Restrict or object to processing, including processing based on legitimate interests and direct marketing;
• Portability — receive certain data in a structured, machine-readable format;
• Withdraw consent at any time where processing is based on consent (without affecting prior processing); and
• Lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner's Office; in the EEA, your national authority).

To exercise any right, contact admin@milemarketplace.com. We may need to verify your identity, and we respond within the time limits required by law.

If you are in Hong Kong, you have the right under the Personal Data (Privacy) Ordinance to request access to and correction of your personal data and to be informed of our data-handling policies. Requests and any complaints may be directed to admin@milemarketplace.com. We handle personal data in accordance with the six Data Protection Principles under the PDPO.

If you are a U.S. resident in a state with a comprehensive privacy law (including California under the CCPA/CPRA), you may have the right to: know/access the personal information we collect and how we use and disclose it; correct inaccurate information; delete personal information; and opt out of the “sale” or “sharing” of personal information and of certain targeted advertising.

We do not sell personal information for monetary consideration. However, our use of the analytics and advertising technologies in Section 8 (Google, Meta, and TikTok) may be considered “sharing” for cross-context behavioral advertising, or a “sale,” under some U.S. state laws. You may opt out by enabling a recognized opt-out preference signal such as Global Privacy Control (GPC) in your browser, by using the platform opt-outs in Section 8, or by emailing admin@milemarketplace.com. We do not discriminate against you for exercising your rights, and authorized agents may submit requests with proof of authorization.

We implement technical and organizational measures designed to protect personal data, including encryption in transit, access controls, and monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential. If we become aware of a personal-data breach, we will notify affected individuals and authorities where required by law. If you suspect unauthorized access, contact support@milemarketplace.com.

The Platform is not directed to, and we do not knowingly collect personal data from, anyone under eighteen (18). If you believe a minor has provided data, contact admin@milemarketplace.com and we will take appropriate steps to delete it.

The Platform may link to or integrate third-party services, including Payment Providers and loyalty programs. Those services have their own privacy practices, which we do not control. Review their policies before using them.

We may use automated tools for fraud detection and risk scoring. Where a decision producing legal or similarly significant effects is based solely on automated processing and the GDPR applies, you may request human review by contacting admin@milemarketplace.com.

We may update this Policy from time to time. We will post the updated version with a new “Last updated” date and, where required by law, provide additional notice. Material changes take effect as stated in the notice. Continued use after changes constitutes acknowledgment.

Questions, requests, or complaints about this Policy or our data practices: MileMarketplace, admin@milemarketplace.com.