Privacy Notice

Cloud Lounges is operated by Cloud Lounges LLC. For privacy questions and requests, contact privacy@cloudlounges.com. General support is available at hello@cloudlounges.com.

This notice explains how we handle information when you browse Cloud Lounges, create an account, look for lounges, or use the contribution features available to you. Features can differ between the website and app versions. A feature described here is not necessarily available in every version.

We use information about your card products, airline status, memberships and trip to help predict which airport lounges may admit you. The lounge makes the admission decision. If you report a visit, we keep your report and related information to assess that prediction and improve lounge information.

We do not ask for payment-card numbers or security codes. Optional proof can involve additional information, including a location reading, a boarding pass or a photo. Hosting, authentication, email and other service providers also process information to operate the service.

You can browse the public directory without creating an account. Your requests pass through hosting and security services. Technical information can include your IP address, approximate location inferred from that address, browser or device information, requested pages, request times, and diagnostic or security events.

We use cookies or browser and device storage for functions such as maintaining your sign-in session, remembering preferences and retaining trip information. Some information stays on your device; other information is sent to our services. Operational logging is separate from an optional website analytics product.

We collect your name, email address, password and account setup progress. Password authentication is handled by Supabase, which stores a password hash rather than a readable password.

New-account registration asks you to explicitly confirm that you are 18 or older. We record that confirmation and its version in account metadata. This is a self-declaration; it is not identity verification or verified proof of age. Registration does not ask for a date of birth.

Do not send passwords, payment-card numbers or other unnecessary sensitive information in a support message.

You can tell us which card products you hold, your airline programmes and status tiers, and your lounge memberships. You may record remaining visits and applicable status or membership validity dates so we can assess whether a benefit is available.

A membership or status validity date is different from the expiry date printed on a payment card. We use product and benefit information to assess lounge access; we do not need a payment-card number or security code to do this.

Trip information can include airports, terminals, airline, cabin, flight number, departure date and time, connections and travelling-party size. Some trip information is kept in your browser or app. Information associated with an airport visit or report may also be stored on our servers.

Flight searches send relevant search information to the flight-lookup service used by Cloud Lounges. The service returns information used to prepare your trip and lounge search.

When you report what happened at a lounge, we may keep your outcome, lounge, airport, time and a snapshot of the access prediction and rule associated with that report. Depending on the feature, a report may also concern hours, closure, fees, guest policies, amenities or crowding.

We may record when a report prompt was offered, answered or dismissed to manage reminders and avoid repeated requests. Reports can remain linked to your account inside the service. A report is evidence for review; submitting one does not itself authorize a change to published lounge facts.

Where proof features are available, you can choose whether to provide proof of a visit. Reporting a visit and proving a visit are separate actions. Choosing not to provide proof can affect whether a contribution qualifies for Points under the applicable programme rules.

If you choose a location check, your device sends latitude, longitude and an accuracy reading to our server. The proof flow uses them to assess presence at the relevant airport. Its stored evidence records the result, airport, time and coarse accuracy information rather than the raw coordinates. This is an action you initiate, not continuous background location tracking by that proof flow.

If you choose to scan a boarding pass, the image is sent to the server for decoding. The proof flow derives information such as airport, flight number, travel date and a fingerprint used to detect the same pass being used across accounts. The fingerprint remains associated with evidence; it is not anonymous merely because it is a fingerprint.

The application proof flow is designed to discard the original image, barcode text and unnecessary decoded details after processing, rather than retain them as proof records. Using a pass for more than one lounge on the same trip is different from using it across accounts.

Uploaded proof photos are stored privately for reviewing a contribution. They are not made public on lounge pages or used in marketing through the current proof-photo feature. Hosting and storage providers process them to operate that feature. The upload flow removes embedded camera metadata before storing the processed photo; this does not remove people or documents visible in the picture.

Please avoid including other people, identity documents, boarding passes or payment details in a lounge photo.

The proof-photo retention rule makes a photo due for removal at the earlier of 30 days after upload or 48 hours after a reviewer approves or rejects the evidence. Opening a photo does not start the 48-hour period. Removal depends on a successful cleanup run; a failed run can delay removal. Removing the photo file does not by itself remove the related evidence, review or audit records.

Authorized reviewers receive short-lived preview links. A link expiring after five minutes limits later retrieval using that link; it cannot remove a copy already downloaded.

Where Points earning is enabled, we keep the balance and the entries behind it, including qualifying contributions, awards, limits, reversals and adjustments. Adjustments can be recorded as additional entries rather than rewriting earlier entries.

Rules can assess proof, duplicate boarding-pass use, daily limits and contribution eligibility. Administrators may review evidence or apply authorized exclusions and adjustments. These processes concern contributions and rewards; they do not decide whether a lounge admits you.

The launch programme is intended for earning and holding Points, with no redemption, cash value, purchase or transfer functionality. Programme conditions belong in the applicable Points terms. Describing the feature here does not announce its activation or promise a future benefit.

If you enable notifications, the service may store a subscription or device token, delivery keys, platform information and relevant notification preferences. You can change available notification settings and device permissions. Turning off notifications is different from deleting your account or all related records.

Authentication email includes address confirmation and password recovery. Resend is the configured delivery provider for these messages through Supabase authentication. Support and privacy correspondence includes the information you send us and the information needed to handle your enquiry.

Our services use providers including:

• Supabase, for authentication, database services and file storage.
• Vercel, for website and server hosting and related operational and security processing.
• Resend, for configured authentication-email delivery.
• The flight-lookup service used by Cloud Lounges, for flight-search requests.
• Browser or device notification services, where notification delivery is enabled.

Cloud Lounges also uses OpenAI in a source-monitoring workflow that reads published lounge information and prepares proposals for review. The inspected workflow uses source material and published lounge facts, not traveller account or private proof information. This is separate from a traveller's lounge search.

Published lounge information can be provided to partners. The partner feed is designed to provide published lounge facts and optional crowding information, rather than account details or private proof. A report linked to an account and a photo containing a person can still be personal information even when they concern a lounge.

Cloud Lounges is a US company, but information is not processed only in the United States. The inspected Supabase project stores its regional service data in Singapore, and the inspected Vercel function configuration selects a US region. Provider operations, email, logs, support and network delivery can involve other countries.

Different categories of information have different retention needs. The proof-photo rule is described above. Account, trip, report, evidence, Points, support and audit information also require consideration of service operation, security, legal obligations and privacy requests.

An account deletion request does not necessarily result in immediate removal of every record or every provider copy. Any applicable retention exception must be assessed for the particular information and purpose. Backup, log and service-provider handling can differ from the primary application database.

You can edit or remove available wallet items and change available preferences through the service. For questions or requests concerning access, correction, a copy of information, deletion or a contribution decision, write to privacy@cloudlounges.com. General product support is available at hello@cloudlounges.com.

We may need to verify your identity and clarify the scope before disclosing information or acting on a request. Please do not email a password, a full payment-card number or an identity document unless a secure and necessary verification process has been arranged.

Available legal rights, exceptions and appeal procedures depend on the law that applies to your request. A request concerning your personal information is different from reporting an incorrect lounge fact. This notice does not promise an instant account-deletion button or instant export.

Cloud Lounges accounts are intended for people aged 18 and over. If you believe a child has provided personal information, contact privacy@cloudlounges.com so the concern can be assessed. An age confirmation does not establish a person's actual age.

The published notice will identify its version and effective date. Changes and any notice required for those changes must be handled under applicable law. Contact the Cloud Lounges Privacy Team at privacy@cloudlounges.com with questions about this notice or your information.