Privacy policy
Last updated 14 October 2026
This explains what Nextleg does with your information. We’ve written it from what the software actually does, not from a template, so it is more specific than most — including about the parts that involve sending your data to someone else.
The controller of your personal data is Dismal Training Ltd, a company registered in England and Wales under company number 15097427, whose registered office is at 2 Sorrel Way, Oldham, England, OL4 2QW. Contact us at privacy@getnextleg.com.
What we hold
Your account
When you sign in we store an identifier for you, your display name, your email address, which provider you signed in with, your timezone and your preferences. We never see or store your password — sign-in is handled by Microsoft Entra External ID, and if you sign in with Google or a Microsoft account, by them.
Your trips
Everything you put on a trip: its name, dates and destination, your notes, and the flights, hotels, trains and events on it — including confirmation numbers, addresses, and the times and gates we look up for you. Files you attach, such as boarding passes, are stored alongside the trip.
Email you forward
Each account gets its own forwarding address. When you send a booking confirmation to it, we store the full message and its attachments, not just the details we pull out of them. We need the original so we can re-read it if the first pass got something wrong, and so you can go back to the source.
Your forwarding address contains your account identifier. Anyone you hand it to can see that string, and anyone who learns it can send mail into your account — which is why mail from an address you haven’t trusted is held rather than acted on.
Your devices
If you turn on notifications we store a push token for that device, its platform and app version, and which notifications you want.
Links you share
A shared trip link is a secret URL with no sign-in behind it. Anyone holding it can see the sections you chose. We store the link, what it exposes, who made it and when it expires. You can revoke one at any time.
Why we’re allowed to hold it
Under UK and EU data protection law we rely on:
- Performing our contract with you — for everything that is just the app working: storing your trips, reading a confirmation you forwarded, tracking a flight, sending you the alert you asked for.
- Our legitimate interests — keeping the service secure, working out why something broke, and preventing abuse.
- Your consent — for push notifications, which you can withdraw in the app or in your device settings.
Automated reading of your data, and where it goes
This is the part worth reading twice.
When you forward a booking confirmation from a sender you’ve trusted, or share a file into the app from another app, the entire message or file — sender, subject and full body, and the full content of attachments, including the text and images in them — is sent to a large language model to have the booking details pulled out of it. If a file you attach to a trip turns out to be a boarding pass, its image goes to a model that reads the printed boarding and gate-close times off it, and that model sees the passenger’s name on the pass. Importing a TripIt calendar feed sends the full text of its entries to the same kind of model, to classify and group them into trips.
A model also sees your flight’s airports, scheduled departure, aircraft registration and inbound leg, to assess its delay risk. Hotel bookings are enriched the same way: web search results about the stay go to a model to fill in what the confirmation left out, and so does the hotel or venue name you type when searching for one. Searching for events, whether or not it’s tied to a trip, sends the title, city, country and dates you’re searching with — a trip’s own name, destination and dates by default, or whatever you typed instead — to a model that looks for matches; that same text is also turned into a search embedding by a model on the same account. When we pick a candidate cover photo for a trip or event we send that photo to a model to check it’s a real photograph rather than a promotional graphic. These models run on Microsoft Foundry, in Microsoft’s East US 2 region. This data therefore leaves the UK and the EU. We don’t use your data to train AI models.
We rely on performing our contract with you to do this, not your consent — it’s a condition of using Nextleg, the same basis as the rest of the app, and the terms of use explain it in those words.
Mail from a sender you have not trusted is held and shown to you first. Nothing in a held message reaches the model until you approve it. Trusting is per exact sender address, never per domain.
The model gets things wrong, and it can’t un-see a message or file you forwarded or shared by mistake. Forward and share only what you mean to.
Who else sees your data
We don’t sell your data and we don’t share it for advertising. We use these providers to run the service:
| Provider | What it gets | Where |
|---|---|---|
| Microsoft Azure | Hosting, databases and file storage — all of the above | UK, EU and US |
| Microsoft Entra External ID | Sign-in; your email address and name | EU |
| Microsoft Foundry | Full text of email you forward and files you share into the app, including attachments; boarding pass images, including the passenger’s name; TripIt import contents; your flight’s airports, departure time, registration and inbound leg for delay risk; hotel details and hotel or venue searches; event search text and its embedding; cover photos for screening | US |
| Resend | Email in and out — the messages you forward, and alerts we send you | EU and US |
| FlightAware and AviationStack | Flight number, airline, date and airports. Not your name | US |
| Google Maps | Addresses of hotels and venues, to place them on a map. Your browser also contacts Google directly to draw it | US |
| Tavily | Search terms for hotels, venues and events — built from your trips and bookings: destinations and dates, hotel names and their cities, the airport cities of your flights, and the names of events on your trip — or typed by you. Never your name | US |
| Unsplash | A destination name, to find a cover photo | US |
| Google Firebase | Push notifications on Android, sent through Azure Notification Hubs: your device token and the alert text. The Android app also takes its installation id from Firebase — see below | US |
| Apple Push Notification service | Push notifications on iPhone, sent through Azure Notification Hubs: your device token and the alert text | US |
| Honeycomb | Diagnostic records of what the software did — see below | US |
| Cloudflare | Our DNS. No user data | Global |
| Google Fonts | Your IP address and browser, whenever you load a page on this website | US |
We’ll also hand over data where the law requires it, and if Nextleg is ever sold or transferred, we’ll tell you before your data moves.
Diagnostics
We record what the software did — which requests ran, what failed, how long things took — and send it to Honeycomb so we can find and fix problems. Today these records include the content of email you forward and details of the trips built from it, because the diagnostics for the email-reading step capture the text that was sent to the model. They are retained by Honeycomb on a rolling window and are used only to operate and debug the service.
The iPhone and Android apps send the same kind of records, and each one carries:
- Your account id, once you’re signed in, so a problem can be traced to the account it happened to.
- An installation id — a random identifier for this copy of the app on this device, made on first launch and gone when you uninstall it. On Android it is the Firebase installation id. It is never your phone’s serial number, IMEI or any other hardware identifier.
- Your device’s manufacturer and model, and the name and version of its operating system.
- When the app crashes, the type of error, its message and the top of the stack trace.
We use these only to find and fix problems, not to profile you or for marketing. We have no advertising, no tracking pixels and no third-party scripts on the website, and no advertising in the apps. We don’t send marketing email — the only mail we send you is about your own trips.
One third party does see you visit this site, and we’d rather say so than let you find it in the page source: the website’s fonts are loaded from Google Fonts, so your browser fetches them from Google on every page — including this one. That request tells Google your IP address, your browser and which page you were on. We don’t receive any of it, and Google states it does not use Google Fonts requests to build advertising profiles. It is still a request to Google that you did not ask for, and we intend to self-host the fonts so it stops happening.
International transfers
Your trips, your account and your stored email sit in the UK and the EU. But as the tables above show, several parts of the service — most importantly the reading of forwarded email, and our diagnostics — run in the United States. Where a provider is outside the UK or EEA we rely on the UK International Data Transfer Addendum and the EU Standard Contractual Clauses.
If you are in the United States
We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those terms are used in California law. We have no advertising relationships at all. The rights described under “Your rights” below — access, correction, deletion, portability — we will honour for any user who asks, wherever you live, and we won’t treat you differently for asking.
How long we keep it
- Held email awaiting your review — 7 days, then deleted.
- Device registrations — 180 days after last use.
- Cached flight and place lookups — up to 30 days.
- Your account, trips, files and processed email — kept until you ask us to delete them. We don’t currently expire old trips.
Cookies
The web app sets one cookie, to keep you signed in. It lasts about eight hours and it is ours, not a third party’s. It is strictly necessary for the app to work, so we don’t ask for consent to set it — there is nothing else to consent to. Your theme choice is remembered in your browser’s local storage and never leaves it.
Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict or object to what we do with it, or hand it to another provider. Some of this you can do yourself in the app — you can delete a flight, hotel, event, file, device or share link, and remove a processed email along with its attachments.
To close your account and have everything erased, email privacy@getnextleg.com. There is no self-service button for it yet, so we do it by hand. We’ll confirm within 30 days. Deleting your account has what goes and what is kept.
If you think we’ve got this wrong, please tell us first — but you can complain to the Information Commissioner’s Office at ico.org.uk.
Security
Data is encrypted in transit and at rest. Access to production is limited and authenticated. Files are never publicly readable. Review tokens and sign-in codes are stored hashed, not in the clear.
Two limits worth being straight about: a shared trip link is a secret URL with no password, so anyone it reaches can open it — revoke it if it goes astray. And your forwarding address is a valid inbox: treat it as semi-public and leave sender trust switched on.
Children
Nextleg isn’t for under-16s and we don’t knowingly collect their data. If you think a child has an account, tell us and we’ll remove it.
Changes
If we change this policy we’ll update the date at the top, and we’ll tell you in the app before anything material takes effect.
Getting in touch
privacy@getnextleg.com for anything on this page. hello@getnextleg.com for everything else.