Privacy policy
What we store, why, and for how long. Replace the operator details with your legal entity before launch.
What we collect
Account data (name, email, password hash, language, country), pilot profile data you choose to publish (bio, home airport, licenses, aircraft), listings, bookings, reviews, messages, airport subscriptions and follows, notification preferences and push subscriptions, and technical logs needed to run the service securely.
Special categories
Pilot verification documents are stored privately, are visible only to staff, are never shown to other users, and are automatically deleted 30 days after a decision. Passenger weight and baggage details are visible only to the pilot of a confirmed booking and are deleted 30 days after the flight. UK passenger declarations are stored encrypted and erased after six months.
What we never do
We do not sell your data. We do not show your email or phone number to other users. We process no payment data — the platform handles no money.
Messages and moderation
Private messages are private. A moderator may read a conversation only after one of its participants reports it, and every such access is recorded in an audit log.
Emails and notifications
We send notifications through the channels you enable (in-app, push, email). You can switch each category off in Settings, except essential account and safety messages.
Retention
Read notifications are deleted after 90 days. Verification documents: 30 days after decision. Weight/baggage data: 30 days after the flight. UK declarations: 6 months. When you delete your account, your profile is anonymized immediately; reviews and messages remain in anonymized form to keep other users’ histories intact.
Your rights (GDPR)
You can export a copy of your data and delete your account at any time from Settings. You additionally have the rights of access, rectification, erasure, restriction, portability, and objection under the GDPR, and the right to complain to your supervisory authority.
Contact
Data controller: [YOUR LEGAL ENTITY, ADDRESS]. Contact: [privacy@yourdomain]. Replace these placeholders before launch.
Template only — have your counsel finalize controller details, legal bases, and processor list before launch.