Privacy Policy

Last updated: April 18, 2026

1. Who we are

FlyToMama ("we", "our service") is an aggregator of cheap flight alerts from Canada to Africa, operated from Montreal (Quebec, Canada). The service is available at flytomama.com.

For any question regarding this policy: contact@flytomama.com.

2. What data we collect

When you sign up for alerts, we collect only:

  • Your e-mail address (required — that's where you receive the alerts)
  • Your language preference (French or English)
  • Your departure airport (Montreal YUL or Toronto YYZ, optional)
  • At signup, technical audit data: your public IP address and your browser signature (user-agent), so we can later prove that the signup was genuine if it is contested
  • Timestamps: signup, confirmation, any unsubscribe, date of the most recent alert e-mail sent

We collect nothing else. No first name, no last name, no phone number, no date of birth, no family information, no geolocation, no payment data. Ever.

3. Why and how we use it

The sole purpose of processing is to send you by e-mail the cheap flight alerts matching your departure airport, for as long as you stay subscribed.

Legal basis: your explicit and revocable consent (Law 25 sec. 12; GDPR art. 6.1.a where applicable), given at signup via the dedicated checkbox. You can withdraw this consent at any time without having to justify yourself.

Processing is automated: a script scans for new good deals each day and sends at most one e-mail per 24 hours to each subscriber.

4. Who we share with

No one. We do not sell, rent, pool, or share your personal data with any commercial third party, whoever they may be.

The only technical parties that access your data are:

  • Our hosting provider Web Hosting Canada (WHC), whose servers are located in Quebec, Canada, and which technically stores the PostgreSQL database
  • The mail server (local Exim at WHC) that technically relays the e-mails we send you

When you click a "View flight" link in an alert, you are redirected to the partner site Aviasales / Travelpayouts. No data identifying you is transmitted by us; only an anonymous partner identifier allowing FlyToMama to earn a commission if you book (see section 9).

5. Retention and location

Your data is stored on servers physically located in Montreal (Quebec, Canada), at our host WHC. No transfer outside of Canada is performed by FlyToMama.

  • If you are an active subscriber: your data is kept for as long as you don't unsubscribe.
  • If you unsubscribe: your address is immediately marked as inactive and is no longer used for any send. The row is still kept in this inactive form, so we can prove that your consent had been properly given at the time and the withdrawal properly recorded (legal traceability).
  • Full erasure: you can request at any time the physical deletion of your row by e-mail (see section 7).

6. Your rights

Under Quebec's Law 25 and, where applicable, the General Data Protection Regulation (GDPR, EU), you have the following rights over your data:

  • Access: obtain a copy of all data we hold about you
  • Rectification: correct any inaccurate data
  • Erasure ("right to be forgotten"): full physical deletion
  • Portability: receive your data in a structured, machine-readable format (JSON)
  • Objection: immediately stop any future processing
  • Withdrawal of consent: at any time, without having to justify
  • Restriction: temporarily freeze processing in case of dispute
  • Complaint: lodge a complaint with the Commission d'accès à l'information du Québec or, where applicable, with your national European supervisory authority

7. How to exercise your rights

Two paths:

  1. 1-click unsubscribe: every e-mail we send contains an unsubscribe link in the footer. One click is enough, no questions asked. You can also use the link you received at signup.
  2. For any other request (access, portability, full deletion, objection…): e-mail contact@flytomama.com specifying the nature of your request. We will reply within a maximum of 30 days (Law 25 legal deadline).

8. Cookies and trackers

We use only two strictly necessary cookies for the technical operation of the site. These cookies are set without your additional consent, since they are technically indispensable (explicit exemption under both Law 25 and GDPR for essential cookies):

  • flytomama_session: HTTP session cookie (CSRF protection). Duration: 24 hours. httpOnly, SameSite=Lax, Secure.
  • flytomama_lang: remembers your language preference so we don't ask again on every visit. Duration: 1 year.

We use no advertising cookie, no third-party tracking cookie, no Facebook pixel, no Google Analytics, or equivalent. No third-party analytics or behavioural-monetization script is loaded on the site.

9. Third-party services

The site loads or redirects to the following third-party services:

  • Google Fonts (fonts.gstatic.com): typeface downloads. Their policy: policies.google.com/privacy.
  • Aviasales / Travelpayouts (aviasales.com): when you click a "View flight" link in an alert e-mail, you are redirected to their site. No data identifying you is transmitted by us; we append an anonymous partner identifier to the URL so FlyToMama can earn a commission if you book. Their policy: aviasales.com/about/privacy_policy.

10. Security

  • HTTPS exclusively site-wide, with HSTS enabled (no unencrypted connection possible)
  • Strict security headers: CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy
  • Infrastructure passwords stored only in a server environment variable (chmod 600), never in source code, never versioned
  • Your e-mail is stored in plain text in PostgreSQL (required to send mail), but the database is only accessible from the server itself (no public exposure)
  • Anti-CSRF protection on the signup form and every POST submission

11. Changes to this policy

We may update this policy. Any substantial change will be notified to subscribers by e-mail at least 30 days before it takes effect, so you have time to review the changes and, if you wish, withdraw your consent before the new version applies.

The "last updated" date is shown at the top of this page.

12. Contact and responsible person

Under section 3.1 of Quebec's Law 25, the person responsible for the protection of personal information at FlyToMama is:

quiyai — founder
contact@flytomama.com

Postal address:
FlyToMama, Montreal, Quebec, Canada.