Privacy Policy

1Our commitment to your privacy

Million Points Plus Pty Ltd (ABN 54 664 419 103), trading as Gyoza Flights ("we", "us", "our"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store and disclose personal information in connection with the Gyoza Flights website, apps, alerts, AI Concierge and subscription service (the "Service").

We handle personal information in accordance with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth). This policy should be read together with our Terms of Service.

2What personal information we collect

The information we collect depends on how you use the Service.

Everyone, including visitors who are not logged in:

• Website and device data: IP address, browser and device type, approximate location derived from your IP address, pages visited, referring site, and the date and time of your visits. This is collected through cookies, analytics and advertising tools (see Section 7).

If you create an account or subscribe:

• Identity and contact information: your name and email address, and your mobile number if you opt in to SMS alerts.
• Account activity: when you are logged in, we may record how you use the Service, including:
  • the routes and dates you search or refresh;
  • the date and time of those searches and refreshes;
  • the alerts you create, change, delete and receive; and
  • when you sign in, with your IP address and approximate location, and which features you use.
• Subscription and billing information: your plan, billing history, payment status, and limited payment details such as card type, the last four digits of your card and billing country. Full card details are collected and stored by our payment processor, not by us.

If you use the AI Concierge:

• Conversations: the questions you ask and the responses generated, stored with an anonymous session identifier and the date and time of each conversation. Conversations are not currently linked to your account.

If you contact us:

• Support communications: the content of your emails or messages (including through Facebook Messenger) and any information you choose to include.

Please do not include passwords, full payment card numbers, passport numbers or other sensitive information in searches, AI Concierge conversations or support messages.

3How we collect personal information

• Directly from you: when you create an account, subscribe, set up alerts, use the AI Concierge, or contact us.
• Automatically: when you use the Service, through our own systems and through cookies, analytics and advertising tools.
• From service providers: for example, our payment processor tells us whether a payment succeeded, failed, was refunded or was disputed.

4Why we collect and use personal information

We use personal information to:

• Provide the Service: create and manage your account, process your subscription, run searches, and send alerts by email or SMS. Your email address is your login.
• Operate the AI Concierge: generate responses to your questions, and review conversations to check and improve the quality and accuracy of responses.
• Improve the Service: understand which routes, programmes and features people use, so we can decide which routes to cover and improve how the Service works.
• Protect the Service and enforce our Terms: detect and prevent scraping, automated access, account sharing, fraud and breaches of our Fair Use Policy.
• Handle refunds, billing disputes and chargebacks: assess refund requests and respond to payment disputes, including by reviewing your account activity (for example, whether and how you used the Service after subscribing).
• Communicate with you: send service messages such as renewal reminders, receipts, alerts and changes to our Terms or this policy, and respond to support enquiries.
• Direct marketing: send you news and offers about the Service by email. You can opt out at any time using the unsubscribe link in any marketing email or by contacting us. Opting out of marketing does not stop service messages such as alerts, receipts or renewal reminders.
• Measure our advertising: understand which ads, partners and referral links bring people to the Service.
• Meet legal obligations: for example, keeping financial records required by tax law.

We use automated systems, such as rate limits and bot protection, which use your IP address, device data and request patterns to detect unusual or automated usage. These systems may temporarily slow, limit or block access to the Service or to features such as search. If this affects you, contact us and a person will review it. Decisions on refunds, disputes and account suspension are made by a person.

5Disclosure of personal information

We do not sell or rent your personal information. We disclose it only as follows:

• Service providers who help us run the Service, such as hosting and infrastructure providers, payment processors, email and SMS delivery providers, email marketing platforms, analytics and advertising providers, our referral programme provider, and providers of the artificial intelligence models that power the AI Concierge. We give them only the information they need to perform their services, and they are required to protect it.
• Payment processors and card issuers in disputes: if you request a chargeback or dispute a payment, we may share relevant records, including your subscription details and account activity, with our payment processor and your card issuer so the dispute can be assessed.
• Professional advisers, such as lawyers and accountants, where reasonably necessary.
• A buyer or successor if our business, or part of it, is sold or restructured, subject to this policy.
• Where required or authorised by law, including in response to a valid request from a court or government agency.

We may use and share aggregated or de-identified information that does not identify you, for example overall route search trends, for any purpose.

6Overseas disclosure and storage

We hold personal information electronically, with cloud hosting providers in Australia and overseas. Some of our service providers store or process personal information outside Australia, including in the United States, the European Union and the United Kingdom. Where we disclose personal information overseas, we take reasonable steps to ensure the recipient handles it consistently with the APPs.

7Cookies and analytics

Cookies are small text files stored on your device. We use them, and similar technologies, to:

• keep you logged in and remember your preferences (essential cookies);
• understand how the Service is used, through Google Analytics and similar tools (analytics cookies); and
• measure how well our advertising and referral programme work, through tools such as Google Ads, Meta, Reddit and Rewardful (advertising and referral cookies).

You can set your browser to refuse cookies or alert you when they are sent. If you block essential cookies, parts of the Service, such as logging in, may not work. You can learn how Google uses data at policies.google.com/technologies/partner-sites.

8Security and retention

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure, using administrative, technical and physical safeguards.

We keep personal information for as long as we need it for the purposes in this policy. In general:

• account information and account activity are kept while your account is open, and for a reasonable period afterwards so we can deal with refunds, disputes and enforcement of our Terms;
• financial records are kept for as long as tax and accounting laws require (generally at least 5 years); and
• when we no longer need personal information, we take reasonable steps to delete or de-identify it.

9Your rights

You can ask us to:

• access the personal information we hold about you;
• correct information that is inaccurate, out of date, incomplete or misleading; and
• delete your account and personal information. We will do so unless we need to keep some information to meet legal obligations, resolve disputes or enforce our Terms, in which case we will keep only what is necessary.

To make a request, contact us using the details below. We may need to verify your identity first. We aim to respond within 30 days. There is no charge to request access. If we refuse a request, we will tell you why.

10Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page with a new "Last updated" date and, if a change is significant, we will also let account holders know by email.

11Contact us and complaints

If you have a question, want to exercise your rights, or want to make a complaint about how we have handled your personal information, contact us:

• Email: contact@gyozaflights.com
• Mail: Salesforce Tower, Level 22, 180 George Street, Sydney NSW 2000

We will acknowledge complaints promptly and aim to resolve them within 30 days. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.