Privacy notice

Controller and contact

Paul Carline is responsible for how Reward Seat Scout uses personal information. For a privacy question or request, email privacy@rewardseatscout.co.uk. You may also reply to any Reward Seat Scout email you received.

What we collect

When you create an alert, we store your email address and the trip details you choose: route, dates, cabins, passenger count, voucher choice and alert rule. If you send website feedback, we store the feedback type, the public page, any optional message and any optional reply email you choose to provide. We do not attach your search criteria, saved alerts or account details to feedback. We also keep essential security, rate-limit and email-delivery records needed to protect the service and diagnose failed messages. Complete live-search responses may be cached for up to 30 minutes. Successful route-and-month sections used by hourly monitoring may be reused as fresh data for up to 55 minutes; a clearly labelled older indication may be displayed for up to two hours if Virgin’s calendar is temporarily unavailable. These caches contain route and availability data only, never your email address or private alert settings.

To show points-price history, Scout keeps anonymous observations for an exact route, travel dates and cabins, including the points per person and the time checked. These observations are shared service records, not a history of an individual visitor. They are never linked to an email address, saved alert, points balance, passenger identity or companion-voucher choice.

How and why we use it

We use your alert details to provide the service you asked for: verifying your address, giving you private access to My Alerts, checking your criteria and sending qualifying or test emails. We use feedback to understand problems, consider suggestions and reply only when you voluntarily provide a reply address. We rely on taking steps at your request and providing the alert service. We rely on legitimate interests for proportionate service improvement, security, abuse prevention, email-delivery records and fault diagnosis. We do not sell your information, send marketing or use advertising or third-party analytics cookies.

Privacy-friendly usage reporting

To understand whether Reward Seat Scout is useful, we keep daily aggregate counts of public visits and page views, searches started, completed or failed, alert creation starts, new alert requests, verified alerts, triggered alert emails, completed deal shares for shared trips and clicks opening Virgin Atlantic’s booking site. We also count only a broad source category such as Google, another search engine, social media, another referral, direct or an internal page.

We also collect rounded, aggregate page-performance measurements: server response time, first content, largest visible content, interaction responsiveness and unexpected layout movement. These measurements are grouped by day, public page category, performance rating, broad browser family, broad device type and whether the page used a local edge cache, an R2 snapshot, a browser cache or a fresh render. We also aggregate connection setup, response waiting, page transfer and application-preparation durations, rounded to ten milliseconds, by site version and whether the page was opened, reloaded or reached through browser history. These are timing totals and counts, without individual visit records. This helps separate a general problem from one affecting a particular type of visit.

This reporting does not use tracking cookies or create visitor profiles. It never stores an email address, trip details, IP address, browser version, raw user agent, raw URL or raw referring address. A session marker prevents one browser session being counted as several arrivals, and day-only first-visit and return-report markers allow one aggregate returning-visitor count on a later day; all three markers remain only in that browser and no identifier is sent. Admin pages, preview environments and automated browser checks are excluded. The owner can also exclude an individual browser; that preference is stored only in that browser and is never sent to the reporting database. The browser sends only approved measurements and broad categories, without private session cookies. To prevent inflated counts and excessive submissions, a secret-keyed, one-way address hash is retained for no more than 48 hours and used only for rate limiting and short duplicate windows; the original address cannot be read from the stored key. Hourly comparison buckets are deleted after 8 days; daily aggregate usage and performance rows are deleted after 90 days. All are visible only on the owner-only operations dashboard.

The original 31 August–1 October 2026 baseline is retained as a saved aggregate summary after its daily source rows expire. It contains counts and broad categories only. The weekly dashboard also counts the first retained verified alert per email using existing saved-alert records; no email addresses are copied into analytics or displayed in that report.

Services involved

The site and database are hosted through OpenAI Sites on Cloudflare infrastructure, and requested emails—including owner notifications about website feedback—are delivered through Resend. Virgin Atlantic receives route-and-month calendar requests needed to check availability; it does not receive your email address from Reward Seat Scout. The Manrope and Cormorant Garamond typefaces are served directly by Reward Seat Scout rather than requested from a font provider during your visit. These providers may process limited technical information such as an IP address when delivering their service. No third-party analytics service receives Reward Seat Scout’s aggregate usage events. Reward Seat Scout is not affiliated with or endorsed by Virgin Atlantic.

Essential cookies and security

My Alerts uses one essential, secure session cookie called __Host-rss_session, lasting for up to 30 days. It keeps your verified alert area private and is not used for tracking. Alert-confirmation links expire after 24 hours and one-time access links expire after 20 minutes.

Cloudflare may also set strictly necessary security cookies when its bot protection or browser checks are triggered. These can include __cf_bm, which normally expires after 30 minutes of inactivity, and cf_clearance, which remembers that a security challenge has been completed for a limited period. They protect the website and are not used by Reward Seat Scout for advertising, analytics or visitor profiling.

Because these cookies are necessary for security and private account access, Reward Seat Scout does not ask for cookie consent. If non-essential analytics, advertising or personalisation cookies are introduced in future, this notice and the consent controls will be updated before they are used.

Control and retention

A verified alert remains saved until you delete it. You can pause, resume, test or permanently delete each alert in My Alerts, and sign out at any time. Deleting your final alert also removes your private access sessions and outstanding sign-in links.

Unconfirmed alert details are deleted within seven days after their 24-hour confirmation link expires. During that short recovery window, requesting another confirmation email replaces the old secure link and starts a fresh 24-hour confirmation period. Used or expired sign-in links are removed during the next daily maintenance run, sessions are removed when they expire or are revoked, and rate-limit records are retained for no more than 48 hours. The full saved email body is erased as soon as an alert email is sent successfully. Delivery troubleshooting records are retained for up to 30 days, after which only a minimal, de-identified duplicate-prevention record may remain. De-identified records preventing repeat owner warning and recovery emails are removed after 14 days.

Website feedback, including any optional message or reply email, is visible only to the owner and is deleted automatically within 90 days. The owner can delete it sooner from the private operations dashboard. The feedback record never contains your search criteria, saved alerts, IP address, browser identifier, user agent or raw referring address.

Anonymous points-price history is removed after the recorded itinerary’s travel date has passed.

Private, integrity-checked backups of saved alerts and their duplicate-prevention state are created for disaster recovery and retained for no more than 30 days. They are kept in non-public storage, are available only through the owner-only operations controls and are never used for marketing or analytics. Information deleted or changed in the live service may remain in an earlier backup until that backup expires. A restore is used only to recover from loss or corruption and signs out private alert sessions as a safety measure.

Your rights

You may ask for access to your information, correction, deletion, restriction or a portable copy, and you may object where legitimate interests are used. You can also complain to the UK Information Commissioner’s Office at ico.org.uk. Contact Paul at privacy@rewardseatscout.co.uk so the request can be matched safely to your verified email.

International processing

Some service providers may process information outside the United Kingdom. Where this happens, the provider’s contractual and legal transfer safeguards apply.