Privacy Policy

Last updated: August 2026

Amelia Aerospace Company (Business ID 3300539-3, Finland) operates Aviobase and is the data controller for personal data collected through the platform. This policy explains what data we collect, why, and how we protect it.

1. Data We Collect

We collect the following categories of personal data:

Identity data: name, email address, phone number, passport or national ID document.
Aviation credentials: pilot licence, ratings, medical certificate, and flight hours declarations.
Aircraft data (owners): aircraft registration, maintenance records, airworthiness documentation, and insurance certificates.
Insurance data: insurance certificates submitted by owners and pilots.
Booking and transaction data: booking history, payment history, and rental records.
Communications: messages sent between users on the platform.
Location and map data: location data processed when using map features, including approximate location where enabled.
Technical data: IP addresses, device type, browser type, and session data collected for security and platform integrity purposes.

2. How We Use Your Data

We use your personal data for the following purposes:

To provide the marketplace service, including matching owners and pilots, processing bookings, and handling payments.
To verify identity and aviation qualifications as part of platform access requirements.
To comply with legal and regulatory obligations, including tax, accounting, and aviation safety requirements.
To send booking confirmations, notifications, and reminders.
To resolve disputes between users.
For safety and incident investigation purposes, including retaining records relevant to any reported aviation incident or accident.
To maintain platform security and prevent fraud.

3. Data Sharing

We share personal data only with the following data processors, each acting under a data processing agreement (DPA) and only processing data on our documented instructions:

Stripe — payment processing and identity verification (KYC). Data may be processed in the United States under Standard Contractual Clauses.
Supabase — database and infrastructure hosting.
Resend — transactional email delivery.
Twilio — SMS notifications.
OneSignal — push notifications.
Mapbox — map rendering and location features.
Microsoft Clarity — website analytics (heatmaps and aggregated usage), loaded only with your consent. Data may be processed in the United States under Standard Contractual Clauses.

We do not sell personal data to third parties. We may disclose data to competent authorities where required by law or in connection with an aviation safety investigation.

4. Document Storage

Identity documents, aviation licences, medical certificates, and insurance documents are stored in encrypted object storage. Access is restricted to authorised personnel and controlled via signed URLs with limited validity periods. Documents are not publicly accessible.

5. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

Right of access — to obtain a copy of the personal data we hold about you.
Right to rectification — to correct inaccurate or incomplete data.
Right to erasure — to request deletion of your data, subject to legal retention obligations.
Right to data portability — to receive your data in a structured, machine-readable format.
Right to object — to object to processing based on our legitimate interests, including profiling.
Right to restrict processing — to request that we limit how we use your data in certain circumstances.

EU and EEA residents have these rights under the General Data Protection Regulation (GDPR) and may also lodge a complaint with a supervisory authority (see Section 9). To exercise your rights, email privacy@aviobase.com.

6. Data Retention

We retain personal data for the following periods:

Booking and transaction records: 7 years from the date of the transaction, for accounting and legal compliance purposes.
Identity and aviation documents: for the duration of your active account plus 2 years following account closure.
Incident and accident-related records: retained for as long as necessary for safety investigation, insurance, or legal proceedings, which may exceed standard retention periods.

Where you request deletion but a legal retention obligation applies, we will retain only the minimum data required for that purpose and delete or anonymise it as soon as the retention period expires.

7. Cookies and Analytics

Essential cookies. We use strictly necessary cookies for authentication and platform security. These are required for the platform to function and do not require your consent.

Analytics cookies (consent-based). With your consent, we use Microsoft Clarity to understand how the site is used — for example which pages are viewed and how visitors interact with them — so we can improve it. Clarity sets its own cookies and may capture usage interactions (such as clicks and scrolling) in an aggregated, pseudonymised form. These analytics cookies are only set after you accept them in our cookie banner, and are not loaded at all if you decline. You can change or withdraw your choice at any time via the “Cookie preferences” link in the site footer.

Microsoft Ireland Operations Limited acts as our processor for Clarity, and may process data in the United States under Standard Contractual Clauses (see Section 8). We do not use cookies for advertising or to sell your data.

8. International Transfers

Your data may be processed in the EU, the United States, and other countries where our service providers operate. Where data is transferred outside the European Economic Area (EEA), we rely on Standard Contractual Clauses (SCCs) approved by the European Commission as the legal transfer mechanism. In particular, Stripe processes payment and identity verification data in the United States under SCCs. Microsoft Clarity analytics data (when you consent) may likewise be processed in the United States under SCCs. We have assessed that these transfers provide an equivalent level of protection to that required under GDPR.

9. Contact

Data controller: Amelia Aerospace Company (Business ID 3300539-3, Finland)
Privacy enquiries: privacy@aviobase.com
GDPR supervisory authority: Tietosuojavaltuutetun toimisto (Office of the Data Protection Ombudsman), Finland — tietosuoja.fi

You have the right to lodge a complaint with the supervisory authority at any time, including if you believe your data has been processed unlawfully or your rights have not been respected.

Aviobase is operated by Amelia Aerospace Company · Business ID 3300539-3 · Finland · ameliaaerospace.eu · support@aviobase.com