Privacy policy

Effective October 16, 2026

TripDifference books flights for businesses and their employees, then watches each fare and rebooks the same flight when it gets cheaper. This policy explains what information we collect to do that, what we use it for, who we share it with, and the choices you have. In this policy, "TripDifference", "we" and "us" mean the company that runs tripdifference.com.

Who this covers

• Account users — people who sign up and book travel for their company.
• Travelers — the people flights are booked for. A traveler's details are usually entered by someone at their company, not by the traveler.
• Scouts — people in our referral program who introduce businesses to us.
• Visitors to tripdifference.com.

What we collect

When you create an account

• Your email address, and a password, which we store only as a one-way hash. We never store or see it in readable form.
• If you sign in with Google: your Google account's email address, name and an identifier Google assigns to you. We don't receive your Google password, and we don't ask for access to your Gmail, contacts, calendar or files.
• Your name, date of birth and how you heard about us.
• The referral code you signed up with, which tells us which scout introduced you.
• Your company's name, legal name, size and billing address.

When you book a flight

• Each traveler's name, title, date of birth, gender, phone number and nationality. Airlines require these to issue a ticket.
• Optional travel details: frequent-flyer numbers, Known Traveler Number, Redress number, Canadian travel number, CLEAR Plus, home airport, and seat and airline preferences.
• The itinerary, fare, price paid, ticket and booking references, and the history of every fare check, exchange, cancellation, refund and airline credit on the ticket.

Payment details

Card details are collected and stored by our payment processor, Stripe. They go from your browser straight to Stripe, and we never receive your full card number. We keep the card's brand, last four digits and expiry date so we can show you which card is on file, along with Stripe's references for your customer record, payments and refunds.

If you're a scout

Your name, email address and company, the referral codes you use, the businesses you referred, and your earnings and payouts. Payouts go through Stripe Connect. Stripe collects the identity and bank details it needs for that, and we don't receive your bank account number.

Automatically

• Your IP address, when you sign in or enter a referral code. We use it to slow down password guessing and code guessing.
• Records of security-relevant and money-related actions in your account (for example, who confirmed an exchange and when).
• Cookies, described below.

How we use it

• To book, change and cancel flights for you, and to issue tickets in each traveler's name.
• To monitor fares on the tickets we issue and, when the same flight gets cheaper, to rebook it and get the difference back for you.
• To charge for tickets and for our success fee, to send refunds to your card, and to keep invoices and accounting records.
• To credit the scout who referred your business, and to pay scouts.
• To sign you in, keep your account secure, and prevent fraud and abuse.
• To answer your questions, and to tell you about changes to your bookings, your account or these policies.
• To meet our legal, tax and accounting obligations.

We don't sell your information, we don't share it for advertising, and we don't use advertising or analytics trackers.

Who we share it with

• Airlines, through our booking provider Duffel. To issue a ticket, Duffel passes traveler details to the airline operating the flight, and the airline handles them under its own privacy policy. Airlines and governments may also pass passenger details to border and security authorities, as the law requires.
• Stripe, to take payments, refund cards and pay scouts.
• Supabase, which hosts our database and handles Google sign-in; Vercel, which hosts the website; and Google, if you sign in with Google. Our pages also load fonts from Google's servers, so Google sees your IP address when a page loads.
• Your scout. The scout who referred your business sees your company's name, when you signed up, whether you've booked, how many rebookings you've had, and what they earned. They never see your trips, routes, travelers or fares.
• Your own company. People on your company's account can see the bookings and traveler details on that account.
• Authorities or advisers, when the law requires it, to protect people's rights or safety, or to enforce our terms.
• A buyer or successor, if TripDifference is merged, acquired or sells its business. This policy would continue to apply to your information.

These providers only receive what they need to do their part. They process it under their own security and privacy terms.

Cookies

We use only the cookies the site needs to work:

• a session cookie that keeps you signed in, plus a security token that protects your forms;
• a referral cookie (td_ref), set when you open a scout's link. It remembers which scout referred you, for up to 90 days or until you sign up.

Stripe may set its own cookies on the payment page to prevent fraud. We use no advertising or analytics cookies.

How long we keep it

We keep your account information while your account is open. Records of tickets, payments, refunds, fees and payouts are kept after an account closes for as long as tax, accounting and anti-fraud rules require (generally seven years). Records of security-relevant actions are kept so that what happened on an account can always be reconstructed. Information we no longer need is deleted or anonymized.

Security

All traffic to tripdifference.com is encrypted. Passwords are stored only as strong one-way hashes, and each business's data is kept separate from every other business's. Access to production systems is limited to the people who need it. No system is perfectly secure, but if a breach affects your information, we'll tell you as the law requires.

Your choices and rights

You can see and update most of your information in the app. You can also ask us to:

• give you a copy of the information we hold about you;
• correct anything that's wrong;
• delete your information, apart from records we have to keep, as described above;
• stop using your information for a purpose you object to.

Email phoenix@tripdifference.com from the address on your account, and we'll respond within 30 days. If you're a traveler and your company entered your details, you can ask us directly or ask your company. Depending on where you live (for example California, the EU or the UK), you may have further rights under local law, including the right to complain to your data-protection authority. We won't treat you differently for using any of these rights.

International transfers

We're based in the United States, and our providers process information in the US and elsewhere. Booking an international flight necessarily sends traveler details to the countries involved. Where the law requires it, we rely on appropriate safeguards for these transfers.

Children

TripDifference is a service for businesses, and accounts are for adults. A child's details may be entered as a traveler by an adult booking for them. We don't knowingly let anyone under 18 open an account.

Changes to this policy

If we change this policy, we'll update the date at the top. If a change is significant, we'll tell account holders by email or in the app before it takes effect.

Contact

Questions or requests: phoenix@tripdifference.com.