Effective date: September 8, 2026
1. Who We Are
PenguFly.com (the “Site”) is a personal, non-commercial travel information project about flights, destinations and travel tips, operated by a private individual (the “Operator”, “we”). We do not sell air tickets or any other services — all bookings are made on partner websites (see Section 5). For any privacy-related questions, contact us at info@pengufly.com.
This Privacy Policy explains what personal data we collect, why, and what rights you have. It is designed to comply with the EU General Data Protection Regulation (GDPR), the UK GDPR, and applicable US state privacy laws, including the California Consumer Privacy Act (CCPA/CPRA).
2. What Data We Collect
2.1. Account registration and comments
Commenting requires an account. When you register, we collect your username and email address. When you comment, we store the comment text, the date, and your IP address and browser user-agent string (for spam and abuse protection). Your email address is never published and is not used for marketing.
Profile picture. Your avatar is drawn by the Site itself: an animal on a coloured background, assigned at random when you register and changeable at any time in your account. Nothing is uploaded, and nothing derived from your email address leaves the Site for this purpose — the Gravatar service is not used here. Your avatar and your username are visible to the public next to your comments.
Automated moderation. To keep the comment section usable without holding every comment for manual approval, the text of your comment is checked automatically against our comment rules (no insults, threats, hate speech, advertising, explicit content, disclosure of other people’s personal data, impersonation, off-topic flooding). For this check the comment text and the title of the article are sent to an external language-model service, DeepSeek (see Section 4). We do not send your name, email address, IP address or any account identifier with it — the service receives the text alone and returns only a verdict.
If the check finds a rule violation, the comment is not published. It stays visible to you, and to you only, on the article page together with the reason, so that you can rewrite it and post again. Nobody else sees it. If you believe the decision is wrong, write to info@pengufly.com and a human being will look at it — see Section 7.4.
2.2. Email inquiries
If you email us, we process your email address, name (if provided) and the content of your message — solely to reply to you.
2.3. Cookies and analytics
The Site uses Google Analytics 4 (via the Google Site Kit plugin) to collect aggregated statistics: pages viewed, approximate location (city level), device and browser type, and traffic source. We use this data only to understand what content is useful and to improve the Site.
Visitors from the EEA, the UK and Switzerland: Google Consent Mode is enabled with a “denied” default for these regions — analytics cookies are not set on your device unless you give consent. How Google uses data: policies.google.com/technologies/partner-sites. You can additionally install the Google Analytics opt-out browser add-on or block cookies in your browser settings — the Site will remain fully accessible.
2.4. What we do NOT collect
We do not collect or process payment card data, government ID data, precise geolocation, or any special categories of personal data. Ticket and hotel bookings happen entirely on partner websites — those transactions are governed by the partners’ own privacy policies, not ours.
3. Purposes and Legal Bases (GDPR Art. 6)
- Consent (Art. 6(1)(a)) — publishing your comments, analytics cookies where consent is required;
- Legitimate interests (Art. 6(1)(f)) — site security, spam prevention, automated moderation of comments, aggregated usage statistics;
- Contract-like necessity (Art. 6(1)(b)) — maintaining your account at your request.
4. Data Sharing and International Transfers
We do not sell personal data and do not share it with third parties for their marketing. Data is disclosed only to technical service providers necessary to run the Site:
- Hosting — the Site is hosted on servers located in the Russian Federation. By using the Site you acknowledge that the data listed above is processed on those servers.
- Google LLC (analytics) — data may be processed in the United States. Google is certified under the EU-U.S. Data Privacy Framework.
- DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd.) — automated comment moderation. The comment text is processed on the provider’s servers in China, without your name, email or IP address. This is a transfer to a country without an EU adequacy decision; we keep it to the minimum necessary — the text of a message you have chosen to publish, and nothing else. If you do not want your text processed this way, please do not post a comment; you can still email us instead.
5. Partner Booking Services
The Site contains links and search widgets of partner booking services (flight and hotel search services operating on the Travelpayouts affiliate platform). When you follow such a link and make a booking, you provide your data directly to the respective service; its own privacy policy applies. We never receive your payment details, passport data or booking documents — at most, we receive anonymous statistics that a booking was made.
6. Data Retention
A comment that automated moderation did not publish is kept for 14 days — so that you can read the reason and rewrite it — and is then moved to the trash and deleted. Published comments and account data are kept until you delete your account or ask us to remove them. Email correspondence is kept only as long as needed to handle your inquiry. Analytics data is retained according to Google Analytics settings (14 months) in aggregated form.
7. Your Rights
7.1. If you are in the EEA, UK or Switzerland (GDPR)
You have the right to: access your personal data (Art. 15); rectify it (Art. 16); have it erased (“right to be forgotten”, Art. 17); restrict processing (Art. 18); data portability (Art. 20); object to processing (Art. 21); and withdraw consent at any time without affecting prior processing. You also have the right to lodge a complaint with your local data protection supervisory authority.
7.2. If you are a California resident (CCPA/CPRA)
In the preceding 12 months we have collected only these categories of personal information: identifiers (username, email, IP address) and internet activity (pages visited, via analytics). We do not sell and do not share personal information as defined by the CCPA, and we do not use sensitive personal information. You have the right to know, correct and delete your personal information, and the right not to be discriminated against for exercising these rights.
7.3. How to exercise your rights
Email info@pengufly.com from the address associated with your account or comment. We will respond within 30 days. We may ask you to confirm control of that email address — nothing more is needed for verification.
7.4. Automated decisions about your comments
Whether a comment is published is decided automatically, as described in Section 2.1. This decision concerns the publication of a message on this Site only: it has no legal or similarly significant effect on you, it does not affect your account, and it never involves profiling. You always have the right to a human review — email info@pengufly.com, quote the comment, and a person will read it and decide.
8. Security
The Site is served over HTTPS. Access to data is limited to the persons maintaining the Site. Administrative access is protected with two-factor authentication, and the Site undergoes regular automated security checks.
9. Children’s Privacy
The Site is not directed to children under 13 (or under 16 in the EEA), and we do not knowingly collect their data. If you believe a child has provided us personal data, contact us and we will delete it.
10. Do Not Track and Global Privacy Control
Since we do not sell or share personal data and do not run cross-site tracking of our own, there is nothing additional to opt out of; for visitors from consent-mode regions analytics cookies are off by default (see Section 2.3).
11. Changes to This Policy
We may update this Policy from time to time. The new version takes effect when published on this page. The current version is always available at pengufly.com/privacy-policy.