Cookie Policy

Gashtiq is operated by AllSaferAI OÜ, a company registered in Estonia under registry code 17591726, with its registered address at Tartu mnt 67/1-13b, Tallinn 10115, Estonia.

For the cookies described here, AllSaferAI OÜ is the data controller under the EU General Data Protection Regulation (GDPR). You can reach us about anything on this page at privacy@allsaferai.com.

A cookie is a small text file that a website asks your browser to store on your device. It lets the site recognise your browser on the next page or the next visit — for example to keep you signed in, or to count how many people used a page.

This policy also covers similar technologies that work the same way in law even though they are not technically cookies: local storage (used to remember your cookie choice), pixels and software development kits used by advertising providers.

• First-party cookies are set by Gashtiq itself.
• Third-party cookies are set by a provider we use, such as Google or Meta, and are readable by that provider.
• Session cookies disappear when you close your browser; persistent cookies stay until they expire or you delete them.

We rely on two different legal grounds, depending on the cookie:

• Strictly necessary cookies are used without your consent, under the exemption in Article 5(3) of the ePrivacy Directive (in Estonia, § 102¹ of the Electronic Communications Act). They are the cookies without which the site you asked for cannot be delivered — signing in, holding your seat, security. Where they involve personal data, our basis is our legitimate interest in running a secure, working booking service, and performance of the booking contract (GDPR Article 6(1)(f) and 6(1)(b)).
• Analytics and marketing cookies are used only on the basis of your consent (GDPR Article 6(1)(a) and Article 5(3) ePrivacy). We ask for that consent before any of them is set, we keep a record of what you chose and when, and you can withdraw it as easily as you gave it.

Refusing optional cookies does not limit your use of Gashtiq. You can search trips, choose seats and book tickets exactly the same way.

These are always active because the site cannot work without them. They are not used for advertising, and they are not shared with advertising providers.

Set only if you switch Analytics on. They help us understand which routes and pages people use, and where the booking flow is confusing or slow. We use Google Analytics 4 with IP anonymisation and Google Consent Mode, so no measurement request is sent until you consent.

Set only if you switch Marketing on. They let us see whether an advert led to a booking, and let the advertising platforms show our ads to people who are likely to be planning travel. These providers may combine this data with data they already hold about you as their own user.

You can change your mind at any time, and it takes the same single click as giving consent did.

• Open the dialog with the Cookie settings link in the footer of every page — or Cookie settings right here — then switch a category off and save.
• When you withdraw a category, we stop loading that provider's scripts immediately, signal the withdrawal to Google Consent Mode, and delete the cookies we are able to delete from our own domain.
• You can also delete cookies in your browser settings, or block them entirely. Blocking strictly necessary cookies will stop sign-in and booking from working.
• Your choice is stored for 6 months. After that we ask again. We also ask again if we add a new category.

Some of the providers above are part of groups based in the United States, so consenting to analytics or marketing cookies can mean your data is transferred outside the European Economic Area.

• Where the recipient is certified under the EU–US Data Privacy Framework, the transfer relies on the European Commission's adequacy decision of 10 July 2023.
• Otherwise the transfer relies on the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914), together with additional technical and organisational safeguards where a transfer impact assessment shows they are needed.
• Strictly necessary cookies do not involve transfers of this kind. If you do not consent to analytics or marketing cookies, no such transfer takes place through this website.

You can ask us for a copy of the safeguards used for any specific transfer at privacy@allsaferai.com.

Where cookies involve your personal data, the GDPR gives you the right to:

• access the data we hold about you and get a copy of it,
• have inaccurate data corrected,
• have data erased, and to have processing restricted,
• object to processing based on our legitimate interests,
• receive your data in a portable, machine-readable format,
• withdraw your consent at any time, without affecting the lawfulness of what happened before you withdrew it.

Write to privacy@allsaferai.com to exercise any of these. We answer within one month.

We update this policy when we add, remove or change a cookie, or when the law changes. The date at the top always shows the current version.

If a change introduces a new purpose or a new category of cookie, we ask for your consent again before that cookie is used — an update to this page is never treated as consent on its own.

Related: Cancellation & refund policy.