Privacy

Last updated 29 September 2026.

The short version: your SAS login, your searches and your results never reach Dotflight. The extension works in your own browser and talks to SAS. If you buy Pro, the payment company Lemon Squeezy handles the payment, and the extension checks your licence key with it. The website sets no cookies and runs no analytics.

Who is responsible

Dotflight is run by its developer and can be reached at dotflights@gmail.com. The name, address and registration of the business selling Dotflight Pro will be published here before Pro goes on sale.

The business above is the controller for the processing described here, except where another company is named as responsible for its own part. Write to dotflights@gmail.com with any question or request about your data.

The Dotflight extension

The scanner runs on SAS's website, in your browser, while you are logged in to EuroBonus. It asks SAS's award booking about the dates you choose, exactly as SAS's own booking page does. To do that it uses the login cookie SAS's page itself uses and sends it only to SAS.

• Your SAS login, searches and results go to nobody but SAS. Not to Dotflight's server, not to Lemon Squeezy, not to anyone else.
• Stored on your device only, and deleted when you remove the extension:
  • your last scan's settings;
  • how many free scans you have used this month;
  • your seat alerts and what each one last found;
  • if you have Pro, your licence key and its last known status.
• Seat alerts (Pro) re-run your saved searches on the schedule you pick, while your browser is open, in a SAS tab. When no SAS tab is open, the extension opens one in the background and closes it afterwards. Notifications are shown by your browser on your device.
• Licence check (Pro only). When you enter a licence key, and about once a day after that, the extension sends the key and the label "Dotflight" for your browser to Lemon Squeezy's licence service. Lemon Squeezy answers whether the licence is valid. Nothing else is sent, and Dotflight's server is not involved.
• The extension's permissions: run on SAS's sites (flysas.com, sas.se, sas.no, sas.dk); only if you enter a licence key and allow it, reach Lemon Squeezy's licence service (api.lemonsqueezy.com) - removing the licence gives that permission back; scripting to open the scanner on SAS's page; storage, alarms and notifications for seat alerts and the free-scan count. It cannot see other sites, your browsing history or other tabs.

Buying Dotflight Pro

• Lemon Squeezy sells Pro as our reseller and merchant of record. It collects what it needs to take the payment and charge VAT - such as your name, email, billing country and card details - and is responsible for that itself, under its own privacy policy. Lemon Squeezy is based in the United States. We never see your card details.
• From Lemon Squeezy we receive the order: your name, email, country, the plan, the amount, the order number and the licence status. We use it to provide Pro, answer you, handle cancellations, withdrawals and refunds, and keep our accounts. Legal basis: performing our contract with you (GDPR article 6(1)(b)) and our bookkeeping duties (article 6(1)(c)). Kept: while you are a customer and then as long as Swedish bookkeeping law requires, currently 7 years for accounting records.

Withdrawals and emails to us

• If you use Withdraw from contract here, we process what you enter - name, email, order number or licence key, and any note - to handle the withdrawal and send you the acknowledgement the law requires. It is sent by email to you and to us. Legal basis: our legal duty under consumer law (article 6(1)(c)). Kept: until the matter is settled and then for up to 3 years, while claims about it can be made.
• If you email us, we keep the conversation as long as needed to help you, and no longer than 3 years after it ends unless bookkeeping law requires more.

The website

• No cookies, analytics, advertising or tracking. The pages' security policy lets only their own code run.
• Your IP address, briefly. The server holds it in memory for at most 15 minutes to limit how many requests one visitor can make, and never writes it to disk. The hosting provider (Render) and the DNS provider (Cloudflare) keep their own technical logs under their own terms. Legal basis: our legitimate interest in keeping the service secure and working (article 6(1)(f)).

Your rights

You can ask for a copy of the data we hold about you, have it corrected or deleted, restrict or object to its use, and receive it in a portable format - write to dotflights@gmail.com. We answer within a month. Some data we must keep for the bookkeeping period even if you ask us to delete it.

You can also complain to the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten (IMY), or the data protection authority where you live.

Dotflight makes no automated decisions about you and does not profile you.

Changes

Material changes are announced on this page, with a new date at the top, and emailed to Pro customers before they take effect.