Privacy policy

You have the right to make a complaint at any time to the ICO (www.ico.org.uk). We would appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.

Personal data means any information about an individual from which that person can be identified. Because our Platform facilitates aircraft rentals for hour building and training purposes, we collect, use, store, and transfer various kinds of personal data.

• Identity Data: First name, last name, date of birth, and copies of government-issued identification such as a passport or driving licence to verify aircraft owners and pilots.
• Aviation & Licensing Data: Pilot licences, ratings, total logged hours, and pilot logbook histories.
• Contact Data: Operational base address, billing address, email address, and telephone numbers.
• Aircraft Data for Owners: Aircraft registration numbers and performance or specification data, including MTOW and usable fuel.
• Financial Data: We do not store or view your full credit card or bank account details. Payment processing is securely managed by our third-party payment processor, Stripe. We only retain tokenised transaction representations and basic billing data.
• Transaction Data: Details about payments to and from you, aircraft rentals, bookings, and hours logged through our Platform.
• Technical and Usage Data: IP address, login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and details of how you interact with our website and booking system.

We will only use your personal data when the law allows us to. Most commonly, we use your personal data in the circumstances below.

To facilitate aircraft rentals safely and transparently, we share certain information under strict compliance conditions.

Our primary cloud database infrastructure via Supabase is configured to host data within compliant UK/EU regions, such as UK/EU AWS data centres managed by Supabase. However, because Supabase, Inc. and certain payment processors are headquartered in the United States, processing technical logs, system metadata, or background authentication may occasionally involve data transfers outside the United Kingdom.

Whenever your personal data is transferred out of the UK, we ensure a similar degree of protection is afforded to it by enforcing the following safeguards:

• We enter into a formal Data Processing Addendum (DPA) with our infrastructure providers.
• Where data is transferred to entities outside the UK without an adequacy decision, we use the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses (SCCs).

We have put in place appropriate technical and organisational security measures to prevent your personal data from being accidentally lost, used, accessed in an unauthorised way, altered, or disclosed.

Our core application infrastructure relies on Supabase, using industry-standard database environments. Security measures natively covering your data include:

• Encryption in transit: Connections between your browser, our website, and our Supabase database enforce Transport Layer Security (TLS) encryption.
• Encryption at rest: User records, identifying documentation, and database backups are encrypted at rest using Advanced Encryption Standard (AES-256) keys.
• Row-Level Security: We implement strict database Row-Level Security policies within Supabase, isolating data so pilots and aircraft owners can only access or modify records they are authorised to interact with.
• Access control: We limit access to your personal data to employees, agents, contractors, and third parties who have a strict business need to know and operate under duties of confidentiality.

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including satisfying legal, regulatory, tax, accounting, or reporting requirements. All active data is dynamically held in our production cloud databases.

• Active accounts: We retain your data in our live databases for the duration of your active membership or registration on our Platform.
• Inactive accounts: We execute automated routines that flag and delete user profile, licensing, and flight contract data from our primary Supabase tables 1 year after your account becomes completely inactive. This temporary retention window safeguards against retroactive insurance claims, regulatory audits, or contract disputes.
• Database backups: When data is deleted from our live databases upon your request or account closure, residual copies may persist in encrypted point-in-time database backups for a limited cyclical retention cycle of up to 30 days before being overwritten.
• Financial and transaction data: We retain basic transactional records for up to 6 years after the tax year in which the transaction took place to comply with UK tax and accounting laws.

Under UK data protection laws, you have rights in relation to your personal data:

• Request access to your personal data, commonly known as a data subject access request.
• Request correction of the personal data that we hold about you.
• Request erasure of your personal data, subject to operational or regulatory retention requirements.
• Object to processing of your personal data where we are relying on a legitimate interest.
• Request restriction of processing of your personal data.
• Request the transfer of your personal data to you or to a third party.
• Withdraw consent at any time where we are relying on consent to process your personal data.

If you wish to exercise any of these rights, please contact us at support@flywinger.com. We aim to respond to all legitimate requests within one month.

We keep our Privacy Policy under regular review. Any changes we make in the future will be posted on this page and, where appropriate, notified to you by email.