Privacy Policy
Last updated: July 2026
We keep this simple: we collect your email to send you flight deals. We don't sell your data. You can delete your account anytime by emailing us.
Who We Are
Mr Cheap Flights is a flight deal alert service covering Irish and UK departure airports. We operate at mrcheapflights.ie and mrcheapflights.co.uk. For data protection purposes, the data controller is Mr Cheap Flights (contact: hello@mrcheapflights.ie).
What Data We Collect
- Email address — required to send deal alerts. Collected when you sign up.
- First name — optional. Used to personalise email greetings if you provide it.
- Region preference — Ireland or UK. Determines which deals you receive.
- Payment information — if you upgrade to Premium, your payment is processed by Stripe. We never see or store your card details.
- IP address — collected temporarily for rate-limiting to prevent spam signups. Not stored long-term.
- Cookies — we use a single signed cookie to remember your login status and premium tier. No third-party tracking cookies unless you accept analytics.
- Analytics — if you accept cookies, we use Google Analytics 4 to understand which deals perform best. This collects anonymised usage data (pages visited, deal clicks). You can decline this on the cookie banner.
How We Use Your Data
- To send you flight deal alerts by email (the core service you signed up for).
- To manage your account and subscription status.
- To process Premium subscription payments via Stripe.
- To improve the site and understand what deals our members find most valuable.
- To prevent spam and abuse (rate limiting).
Legal Basis (GDPR)
We process your data on the basis of contractual necessity (delivering the service you signed up for) and, where applicable, legitimate interest (security and fraud prevention). Analytics processing is based on consent, which you can withdraw at any time.
Who We Share Data With
- Stripe — for payment processing (Premium subscribers only). Stripe is PCI-DSS compliant.
- Resend — our email sending provider. Your email address is transferred to Resend solely to deliver deal alerts.
- Google Analytics — anonymised usage analytics, only if you consent.
- Cloudflare — our infrastructure provider. All traffic passes through Cloudflare, which may log IP addresses per their own privacy policy.
We do not sell, rent or trade your personal data with any third party for marketing purposes.
Data Retention
We retain your account data for as long as your account is active. If you unsubscribe or request deletion, we remove your email and account data within 30 days. Stripe may retain payment records per their own legal obligations.
Your Rights
Under GDPR you have the right to:
- Access — request a copy of the data we hold about you.
- Correction — ask us to correct inaccurate data.
- Deletion — ask us to delete your account and all associated data.
- Portability — receive your data in a machine-readable format.
- Object — object to processing based on legitimate interests.
- Withdraw consent — withdraw analytics consent at any time via the cookie banner or by declining cookies.
To exercise any of these rights, email us at hello@mrcheapflights.ie. We'll respond within 30 days.
Cookies
We use the following cookies:
- mcf_member — a signed session cookie that remembers you're signed up. HttpOnly, expires after 400 days.
- mcf_admin — admin session cookie. HttpOnly, expires after 8 hours.
- mcf_gdpr — stores your cookie consent preference in localStorage (not a cookie). Expires after 1 year.
- _ga, _gid — Google Analytics cookies, set only if you accept analytics.
Security
All data is transmitted over HTTPS with HSTS enabled. Session cookies are signed with HMAC-SHA256 and marked HttpOnly. Passwords are hashed with PBKDF2 (100,000 iterations). We use Cloudflare's network for DDoS protection and WAF.
Changes to This Policy
We'll update this page if our practices change and note the updated date at the top. Continued use of the service after changes constitutes acceptance.
Contact
Questions? Email us: hello@mrcheapflights.ie