Privacy Policy

Last updated: May 2026

Amelia Aerospace Company (Business ID 3300539-3, Finland) operates AvioBase and is the data controller for personal data collected through the platform. This policy explains what data we collect, why, and how we protect it.

1. Data We Collect

We collect the following categories of personal data:

  • Identity data: name, email address, phone number, passport or national ID document.
  • Aviation credentials: pilot licence, ratings, medical certificate, and flight hours declarations.
  • Aircraft data (owners): aircraft registration, maintenance records, airworthiness documentation, and insurance certificates.
  • Insurance data: insurance certificates submitted by owners and pilots.
  • Booking and transaction data: booking history, payment history, and rental records.
  • Communications: messages sent between users on the platform.
  • Location and map data: location data processed when using map features, including approximate location where enabled.
  • Technical data: IP addresses, device type, browser type, and session data collected for security and platform integrity purposes.

2. How We Use Your Data

We use your personal data for the following purposes:

  • To provide the marketplace service, including matching owners and pilots, processing bookings, and handling payments.
  • To verify identity and aviation qualifications as part of platform access requirements.
  • To comply with legal and regulatory obligations, including tax, accounting, and aviation safety requirements.
  • To send booking confirmations, notifications, and reminders.
  • To resolve disputes between users.
  • For safety and incident investigation purposes, including retaining records relevant to any reported aviation incident or accident.
  • To maintain platform security and prevent fraud.

3. Data Sharing

We share personal data only with the following data processors, each acting under a data processing agreement (DPA) and only processing data on our documented instructions:

  • Stripe — payment processing and identity verification (KYC). Data may be processed in the United States under Standard Contractual Clauses.
  • Supabase — database and infrastructure hosting.
  • Resend — transactional email delivery.
  • Twilio — SMS notifications.
  • OneSignal — push notifications.
  • Mapbox — map rendering and location features.

We do not sell personal data to third parties. We may disclose data to competent authorities where required by law or in connection with an aviation safety investigation.

4. Document Storage

Identity documents, aviation licences, medical certificates, and insurance documents are stored in encrypted object storage. Access is restricted to authorised personnel and controlled via signed URLs with limited validity periods. Documents are not publicly accessible.

5. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

  • Right of access — to obtain a copy of the personal data we hold about you.
  • Right to rectification — to correct inaccurate or incomplete data.
  • Right to erasure — to request deletion of your data, subject to legal retention obligations.
  • Right to data portability — to receive your data in a structured, machine-readable format.
  • Right to object — to object to processing based on our legitimate interests, including profiling.
  • Right to restrict processing — to request that we limit how we use your data in certain circumstances.

EU and EEA residents have these rights under the General Data Protection Regulation (GDPR) and may also lodge a complaint with a supervisory authority (see Section 9). To exercise your rights, email privacy@aviobase.com.

6. Data Retention

We retain personal data for the following periods:

  • Booking and transaction records: 7 years from the date of the transaction, for accounting and legal compliance purposes.
  • Identity and aviation documents: for the duration of your active account plus 2 years following account closure.
  • Incident and accident-related records: retained for as long as necessary for safety investigation, insurance, or legal proceedings, which may exceed standard retention periods.

Where you request deletion but a legal retention obligation applies, we will retain only the minimum data required for that purpose and delete or anonymise it as soon as the retention period expires.

7. Cookies

We use only essential session cookies required for authentication and platform security. These cookies are strictly necessary for the platform to function and do not require your consent. We do not use analytics, functional, or marketing cookies.

8. International Transfers

Your data may be processed in the EU, the United States, and other countries where our service providers operate. Where data is transferred outside the European Economic Area (EEA), we rely on Standard Contractual Clauses (SCCs) approved by the European Commission as the legal transfer mechanism. In particular, Stripe processes payment and identity verification data in the United States under SCCs. We have assessed that these transfers provide an equivalent level of protection to that required under GDPR.

9. Contact

Data controller: Amelia Aerospace Company (Business ID 3300539-3, Finland)
Privacy enquiries: privacy@aviobase.com
GDPR supervisory authority: Tietosuojavaltuutetun toimisto (Office of the Data Protection Ombudsman), Finland — tietosuoja.fi

You have the right to lodge a complaint with the supervisory authority at any time, including if you believe your data has been processed unlawfully or your rights have not been respected.

AvioBase is operated by Amelia Aerospace Company · Business ID 3300539-3 · Finland · ameliaaerospace.eu · support@aviobase.com