Privacy Policy

Effective October 27, 2026

This Privacy Policy explains how AwardWhiz LLC ("AwardWhiz", "we", "us" or "our") collects, uses, shares and protects personal information when you use the awardwhiz.com website, the AwardWhiz API, the AwardWhiz connector for AI assistants (our MCP server), our emails, and any other service that links to this policy (together, the "Service"). It also explains the choices and rights you have. Capitalized terms not defined here have the meaning given in our Terms of Service.

The short version: we collect what we need to run award searches, keep your account secure and improve AwardWhiz. We do not sell your personal information.

1. Information we collect

Information you give us

• Account information: your name, email address and password. We store passwords only as one-way hashes.
• Searches: the origins, destinations, dates, cabins, number of passengers, airlines and programs you search, the results returned, and your search history.
• API keys and connected apps: the names you give API keys and the AI assistants or other apps you authorize, along with the permissions you grant them. We store API keys only as one-way hashes plus a short prefix so you can recognize them.
• Communications: messages you send us, support requests, survey responses and feedback.
• Settings: choices you make in the Service.

Information collected automatically

• Device and connection data: IP address, browser and operating system, device type, user agent, referring page and the pages and features you use.
• Approximate location: the city and country we infer from your IP address. We do not collect precise GPS location.
• Account activity: sign-ins, sign-outs, password and email changes, API and connector use, and the time, endpoint and device for each.
• Diagnostics: error reports, logs and performance measurements, which may include your IP address, account identifier, browser details and the request that caused an error.
• Cookies and similar technologies: see Section 5.

Information from third parties

• Sign-in providers: if you sign in with a third-party account, we receive that account's identifier, your name, email address, whether your email is verified and your profile photo, plus tokens that keep the connection working. We do not receive your password for that account.
• Security services: bot-protection checks tell us whether a sign-in or sign-up looks automated.
• AI assistants and apps you connect: the app's name and website, the permissions you approve, and the requests it makes for you.
• Airlines and loyalty programs: award availability and pricing, which is about flights, not about you.
• Payment processors: if you buy a paid plan, our payment processor tells us your billing status, plan, billing country and postal code, and your card's brand, last four digits and expiry date. We never receive or store your full card number.

2. How we use information

• Provide the Service: run searches across airlines and programs, show and save results and history, and create booking links.
• Accounts and security: create and verify accounts, send password resets, keep you signed in, enforce rate limits and access controls, detect bots, fraud and abuse, and investigate suspicious activity. Authorized AwardWhiz personnel may review account activity, approximate sign-in locations and search history to provide support and protect the Service.
• Communicate with you: send account, security and service messages, answer support requests and, if you have not opted out, send product updates.
• Improve and develop: fix bugs, measure performance, understand which features and routes are used, and build new features. We may create aggregated or de-identified data, such as popular routes or typical award prices, that does not identify you, and use or share it for any purpose.
• Billing: process payments, renewals, refunds and taxes.
• Legal: comply with law, enforce our Terms, and protect the rights, safety and property of AwardWhiz, our users and others.

3. How we share information

We do not sell your personal information and do not share it for cross-context behavioral advertising. We share information only as follows:

• Service providers that process information for us under contracts that limit their use of it, including:
  • hosting, database, queue and infrastructure providers;
  • email delivery providers, for verification and password reset emails;
  • error monitoring, analytics and performance measurement providers;
  • bot protection and network security providers;
  • sign-in providers, to let you sign in with a third-party account;
  • an IP geolocation service, to estimate the city and country of an IP address;
  • payment processors, if you buy a paid plan.
• Airlines and loyalty programs: to run a search, our systems send the search details (such as route, dates, cabin and number of passengers) to airline and program websites. We do not send your name or email with these searches. When you follow a booking link, you leave AwardWhiz and the airline's privacy policy applies.
• Apps you connect: AI assistants and other apps you authorize receive the search results and account information covered by the permissions you approve. Their providers handle that information under their own privacy policies.
• Affiliate partners: if you follow an affiliate link, the partner may learn that you came from AwardWhiz.
• Legal and safety: to comply with law, legal process or lawful government requests, and to protect the rights, property or safety of AwardWhiz, our users or the public.
• Business transfers: as part of a merger, acquisition, financing, reorganization or sale of assets, in which case the recipient must honor this policy for the information transferred.
• With your consent or at your direction in other cases.

4. AI assistants and the API

When you connect an AI assistant to AwardWhiz, the assistant sends search requests to us and receives results through your account. Your conversations stay with that assistant's provider, and AwardWhiz receives only the requests the assistant makes to our Service. You can see and disconnect connected apps, and delete API keys, in your account settings at any time.

5. Cookies and similar technologies

We use these categories of cookies and similar technologies:

• Essential: keep you signed in, protect sign-in flows (for example, state cookies used during third-party sign-in) and run bot protection. The Service will not work without them.
• Preferences: remember choices such as your search settings.
• Analytics and performance: measure page views and performance. Our current analytics tools do not use cookies for this.
• Marketing: we do not currently use advertising or cross-site tracking cookies. If we start, we will update this policy and offer choices where the law requires them.

You can block or delete cookies in your browser settings, but parts of the Service may stop working. We treat a Global Privacy Control (GPC) signal as a request to opt out of any sale or sharing of personal information. Like most sites, we do not respond to legacy "Do Not Track" signals.

6. How long we keep information

We keep personal information for as long as your account is active and as needed to provide the Service, then for as long as needed to resolve disputes, prevent fraud and abuse, enforce our Terms and meet legal, tax and accounting obligations.

• When you delete your account, we delete your profile, sessions, activity log, API keys, connected apps and third-party sign-in connections. Searches you ran are kept only in a de-identified form that is no longer linked to you.
• When you disconnect an app, we revoke its access to your account.
• Deleted information may remain in encrypted backups for a limited time until they are overwritten.

7. Security

We use administrative, technical and physical safeguards designed to protect your information, including encryption in transit, hashed passwords and API keys, access controls and monitoring. No system is perfectly secure, so we cannot guarantee the security of your information. Use a strong, unique password, and tell us at [email protected] if you think your account has been compromised. If a breach affects your personal information, we will notify you as required by law.

8. Your choices

• Account information: change your email and password in your account settings, or email us to correct anything else.
• Connected apps and API keys: disconnect apps and delete API keys in your account settings.
• Emails: unsubscribe from marketing emails with the link in any marketing email. We will still send account and security messages.
• Deleting your account: email [email protected] from your account email address, or use an account deletion option if one is available in your settings.

9. Privacy rights for U.S. residents

Depending on where you live (for example California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and other states with privacy laws), you may have the right to:

• know what personal information we collect, use and disclose, and get a copy of it;
• correct inaccurate personal information;
• delete personal information;
• opt out of the sale or sharing of personal information, targeted advertising and profiling that produces legal or similarly significant effects (we do none of these today);
• limit the use of sensitive personal information, where applicable; and
• not be discriminated against for using these rights.

The table below shows the categories of personal information we collect, as defined by California law. We collect them from you, your devices, and the third parties described in Section 1, use them for the purposes in Section 2, and disclose them for business purposes to the recipients in Section 3. We have not sold or shared personal information in the past 12 months, and we do not knowingly sell or share personal information of consumers under 16.

We use sensitive personal information only to provide the Service, keep it secure and meet legal obligations, and not to infer characteristics about you.

To make a request, email [email protected] from your account email address. We will verify your identity before acting on a request, and we may ask for more information to do so. You may use an authorized agent, who must provide proof of your permission. We will respond within the time required by law (usually 45 days). If we deny your request, you may appeal by replying to our decision, and if you are not satisfied with the result of the appeal, you may contact your state attorney general. California residents may also ask, once a year, for information about any disclosure of personal information to third parties for their direct marketing purposes; we make no such disclosures.

10. Users outside the United States

AwardWhiz is based in Washington State in the United States, and we and our service providers process information in the United States and other countries whose data protection laws may differ from yours. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses for international transfers.

If you are in the European Economic Area, the United Kingdom or Switzerland, AwardWhiz LLC is the controller of your personal information. We process it to perform our contract with you (providing the Service), for our legitimate interests (securing, improving and promoting the Service, where those interests are not overridden by your rights), with your consent (for example for marketing where required), and to meet legal obligations. You may have the right to access, correct, delete, restrict or object to processing of your information, to data portability, and to withdraw consent at any time. To exercise these rights, email us. You may also complain to your local data protection authority.

11. Children

The Service is intended for adults 18 and older and is not directed to children. We do not knowingly collect personal information from children under 16. If you believe a child has given us personal information, contact us and we will delete it.

12. Third-party sites and services

The Service links to airline, loyalty program and other third-party websites, and works with third-party apps you connect. Their privacy practices are governed by their own policies, not this one, and we are not responsible for them.

13. Changes to this policy

We may update this policy as AwardWhiz changes. We will post the new version here and update the effective date.

14. Contact us

Questions or requests about privacy? Email [email protected].