Privacy policy
Last updated: 25 October 2026
SunFinder has no user accounts. We do not ask for, or store, your name, e-mail address or payment details. Searches (departure city, dates, filters) are processed to produce results and are not tied to an identity.
Who is responsible for your data
The data controller is Jean-Nicolas Laurent Josi, Avenue Yvan Lutens 42, 1150 Brussels, Belgium, hello@sunfinder.ai. We have not appointed a Data Protection Officer; write to the address above for any privacy request.
What we process
| Processing | Data | Legal basis | Retention |
|---|---|---|---|
| Server logs and rate limiting | IP address, user agent, URL, timestamp | Legitimate interest (security, abuse prevention) | 30 days |
| Your search | Departure city, travel dates, filters — processed to compute results, not stored with your identity | Legitimate interest (providing the service) | Not stored |
| Plausible Analytics (cookieless) | Page URL, referrer, browser and device type — no cookies, IP never stored (hashed and discarded daily by Plausible) | Legitimate interest (audience measurement) | Aggregated statistics only |
| Google Analytics 4 | Cookies, usage statistics | Consent | 14 months |
| Google AdSense (where ads are shown) | Cookies, ad interaction data | Consent | Per Google's policy |
| Outbound click logging | When you click a booking link: partner, destination, page, list position, truncated IP (/24 IPv4, /48 IPv6), user agent, referring page — no cookies, not tied to an identity | Legitimate interest (measuring which recommendations are useful, funding the service) | 13 months |
| Travelpayouts affiliate tracking | Click identifier on outbound booking links | Legitimate interest (funding the service) | Per Travelpayouts' policy |
| Contact e-mails | Name, e-mail address, message | Legitimate interest (answering you) | 12 months after last exchange |
Open-Meteo (our weather data provider) receives no personal data from us: your searches trigger reads from our own database, and city-name autocomplete runs against our own city list, topped up through a server-side, cached proxy — your IP is never sent to the geocoding provider.
Cookies
Without consent, SunFinder sets no analytics or advertising cookies. With consent, GA4, AdSense and Travelpayouts set their own cookies as described in their policies. You can withdraw consent at any time via "Cookie settings" in the footer.
Transfers outside the EU
Our hosting (Vercel) and database (Supabase, Ireland) are in the EU or operate under EU standard contractual clauses. Google (Analytics, AdSense) is certified under the EU–US Data Privacy Framework. Travelpayouts processes click data under standard contractual clauses. Open-Meteo receives no personal data from us.
Your rights
You can ask us to access, correct, delete or restrict the processing of your personal data, object to processing based on legitimate interest, and receive your data in a portable format. Where processing relies on consent, you can withdraw it at any time via "Cookie settings" in the footer. Write to hello@sunfinder.ai; we answer within one month. You can also lodge a complaint with the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit), Rue de la Presse 35, 1000 Brussels, contact@apd-gba.be, www.dataprotectionauthority.be.