Privacy Policy

Version 2026-09, in force from 25 September 2026. Until that dateversion 2026-08 applies.

1. Data Controller

The controller of your personal data is LetsFly, operated by:

Lets Fly Jan Rawwo
ul. Jaworowa 9B, 82-300 Elbląg, Poland
NIP (tax ID): 5783157699
Email: kontakt@letsfly.pl

For any matter concerning the protection of your personal data, you can reach us at the email address above.

2. What Data We Collect

The scope of collected data depends on how you use the platform:

a) Pilot account registration

  • First and last name
  • Email address
  • Password (stored only in encrypted form by Supabase Auth; we have no access to it)
  • Profile name (slug)
  • A record of the consents you gave: consent type, date, and the version of the terms and privacy policy in force at the time

b) Pilot profile (provided voluntarily)

  • Bio and profile photo
  • Operating areas: base town and operating radius. We publish only the coverage circle on the map; base coordinates are rounded to town level and the exact point is never shown
  • Website, Instagram profile, YouTube channel
  • Your remote pilot number (in the POL-RP-... format), if you want the “Verified” badge (see section 2e)
  • Equipment list and service categories
  • Portfolio photos and videos

c) Inquiry form and message threads (people sending inquiries)

  • Name
  • Email address (required)
  • Phone number (optional)
  • Content of the messages in your thread with the pilot

Inquiries are handled as message threads hosted on the platform. After sending an inquiry you receive an access link to your thread at the email address you provided; using it does not require an account. Our database stores only a cryptographic hash of the access token, never the link itself. Email notifications about new messages are informational only and do not contain message content. The consent you give when sending an inquiry is recorded together with the privacy-policy version in force at that moment.

d) Notifications

  • In-app notifications (e.g. about a new message) together with their read status
  • Email notifications sent through our email service provider (see section 4)

e) Profile statistics

For pilot profiles we count daily profile views and contact-button clicks. These are purely anonymous event counters: we store no IP addresses, no browser identifiers, no cookies, and we do not distinguish individual visitors.

f) Technical data

  • IP address (server logs, abuse prevention)
  • Browser and operating system type
  • Cookies essential for the service to work (see section 8)
  • Public forms are protected by the Cloudflare Turnstile anti-bot mechanism, which analyzes technical browser signals to distinguish humans from bots (see section 4)

g) Content reports

When you report content that violates our rules (the report form on a pilot profile), you provide the reason for the report, its description and - optionally - your email address. If you provide an address, we use it solely to inform you of the outcome of your report together with a statement of reasons (in line with the Digital Services Act - DSA). Reports without an email address remain anonymous.

h) Pilot reviews

Once a pilot marks a job as completed, they may send the person who made the original inquiry a one-time invitation to leave a review. The invitation leads to a form behind a unique link, so only someone who actually contacted that pilot can review them. We store:

  • A rating from 1 to 5
  • An optional comment (up to 1000 characters)
  • The reviewer’s first name, carried over from the inquiry

The rating, comment and first name are public - visible on the pilot’s profile to every visitor. We never publish the reviewer’s email address. Reviews cannot be edited once submitted; if one breaches the community guidelines it can be reported, and an administrator decides on removal and states the reasons.

i) Pilot verification against the PANSA register

If you want the “Verified” badge, you give us your remote pilot number. We check that number against the publicly available search tool run as part of the PANSA system (drony.gov.pl) to confirm the entry exists and is active; the result is stored on your profile and shown publicly. PANSA is a separate controller for that register - we only read from it.

Because part of this data comes from a register rather than from you, article 14 GDPR requires us to tell you the following:

  • Source: the public pilot and operator search in the National Drone Information System, run by the Polish Air Navigation Services Agency. We query it only by the number you supplied yourself.
  • Categories of data: the pilot number, the status of the register entry, and for each competency its category, designation (for example A2, STS-01) and expiry date. We do not retrieve or store a name from the register.
  • Legal basis: article 6(1)(f) GDPR - keeping the directory trustworthy for people looking for a pilot. Verification is optional: without a number the account works normally, just without the badge.
  • How often: we check the number when you provide it, then once more on the day a stored competency expires. We do not poll the register on a schedule.
  • Retention: for as long as you hold the account. Removing the number in settings also deletes the retrieved competencies and the badge.
  • Objection: you may object to this processing at any time (article 21 GDPR) by removing the pilot number in your account settings or writing to kontakt@letsfly.pl.

The register does not disclose the personal data of the entry’s holder, in particular their name. This means we can confirm only that an entry exists and its status - we cannot check whether the number belongs to the person using the account. Attributing a number to an account rests on your declaration (see the Terms, section 7). A single number can be attributed to only one account.

j) People appearing in portfolio material

Portfolio photos and videos are uploaded by pilots. Sometimes people, vehicles or private property are visible in them. The community guidelines forbid publishing material in which a person is recognisable without their consent, but we do not screen uploads before publication - we act on reports. Since this data reaches us from the pilot rather than from the people filmed, article 14 GDPR requires us to state:

  • Source: the pilot who uploaded the material. They decide what goes in their portfolio and they are responsible for holding the consents needed to publish someone’s likeness (article 81 of the Polish Copyright Act).
  • Categories of data: a likeness captured in a photo or video, and anything else identifiable in frame, such as vehicle registration plates.
  • Legal basis and the limits of our role: article 6(1)(f) GDPR. We host and serve the material on the pilot’s behalf - we do not index people, run face recognition, or link a likeness to any profile.
  • Retention: until the pilot deletes the material, deletes their account, or a report against it is upheld.
  • Removal and objection: if you recognise yourself or your property in someone’s portfolio, use the “Report profile” form on that profile or write to kontakt@letsfly.pl. We handle such reports under section 9 of the Terms and tell you the outcome with reasons.

3. Purposes and Legal Basis for Processing

We process your data for the following purposes:

  • Performance of a contract (Art. 6(1)(b) GDPR): maintaining your account, displaying your pilot profile, handling inquiries and message threads, sending notifications about account activity.
  • Consent (Art. 6(1)(a) GDPR): sending marketing communications (only if you opted in; you can withdraw consent at any time in your account settings) and sharing the inquiry sender's contact details with the selected pilot.
  • Legitimate interest of the controller (Art. 6(1)(f) GDPR): platform security, abuse prevention (rate limits, anti-bot protection), anonymous traffic statistics and profile statistics, application error monitoring, publishing pilot reviews, and verifying pilots against the PANSA register - all so the directory stays trustworthy and the platform runs reliably.
  • Legal obligation (Art. 6(1)(c) GDPR): retaining data required by law, including the consent record.

4. Data Recipients (Sub-processors)

We entrust your data only to trusted processors bound by Data Processing Agreements (DPAs). Instead of enumerating their sub-processors, we link to the current lists maintained by the vendors themselves:

  • Supabase, Inc.: database and authentication. Data stored in the EU region (Frankfurt, Germany). Supabase Data Processing Agreement
  • BunnyWay d.o.o. (Bunny.net): storage and delivery of photos and videos (CDN). Headquartered in Slovenia (EU). Bunny.net GDPR information
  • Hetzner Online GmbH: hosting of the platform servers, including our self-hosted instance of the Umami analytics tool. Headquarters and data centers in Germany (EU). Hetzner data protection information
  • Resend (Plus Five Five, Inc.): sending email messages (confirmations, notifications). Our emails are sent from the EU region. Resend Data Processing Agreement
  • Cloudflare, Inc.: anti-bot protection of forms (Turnstile). Cloudflare GDPR compliance information
  • Functional Software, Inc. (Sentry): application error monitoring. Reports are created on our server and in your browser: Sentry code runs on the page and sends the report straight to the provider, which then sees your IP address. IP address storage is switched off on Sentry's side. A report contains technical data - the page address, the error message, a stack trace, your browser and operating system type - which may indirectly point to the account the error concerned. We do not collect session replays or performance data this way. Sentry Data Processing Addendum

Maps on the platform use tiles served by OpenFreeMap; your browser fetches them directly from that provider's servers, which therefore sees your IP address. Town search uses the Photon geocoder, but queries pass through our server, so your IP address is not forwarded to that provider.

YouTube videos embedded on pilot profiles play in privacy-enhanced mode (the youtube-nocookie.com domain), and the player itself only loads once you click - until then Google sets no playback cookies in your browser. The video thumbnail, however, is fetched from Google's servers as soon as the profile opens, so that provider sees your IP address at that point. Playing a video means connecting to Google's servers (Google Ireland Limited) on the terms set out in the Google privacy policy. When a pilot adds videos to their profile, we check through the public YouTube Data API that the channel belongs to them, sending only the channel address and the video id for that purpose.

The contact details of a person sending an inquiry (name, email, optionally phone number, and the message content) are shared with the selected pilot to enable a response. The sender is informed of this and gives consent before submitting the form.

5. Data Transfers Outside the EEA

Platform data is stored in data centers located in the European Union. Where the use of one of the providers listed above (e.g. Cloudflare) involves a transfer outside the European Economic Area, it takes place solely under mechanisms provided for by the GDPR: adequacy decisions (including the EU-U.S. Data Privacy Framework) or standard contractual clauses.

6. Data Retention

  • Account data: retained for the lifetime of your account. Upon account deletion, the data is permanently removed.
  • Unconfirmed accounts: accounts whose email address has not been confirmed are automatically deleted after 7 days.
  • Inquiries and message threads: retained for the lifetime of the account of the pilot they were sent to. The pilot can delete individual threads at any time in the pilot dashboard. Deleting the pilot's account permanently removes all their threads together with the senders' contact details.
  • Reviews: retained for as long as the reviewed pilot keeps their account. Deleting a pilot's account permanently deletes the reviews left for them. Deleting a message thread does not delete a review - it is detached from the thread but still relates to the completed job.
  • Content reports: deleted 24 months after the case is closed. Until then they evidence the decision taken and let us recognise repeat offences.
  • Dashboard notifications: deleted after 12 months.
  • Profile statistics: daily view and click counters are deleted after 26 months, which allows a year-on-year comparison. They hold no IP addresses and no visitor identifiers.
  • Feedback and bug reports: once handled, deleted 24 months after they were submitted.
  • Server logs and application error reports: retained for a maximum of 30 days for security purposes.
  • Consent records: retained for the period required by law, to demonstrate GDPR compliance.

7. Your Rights

Under the GDPR you have the following rights:

  • Right of access: you can request information about what personal data we process about you.
  • Right to rectification: you can correct your data in the pilot dashboard or by contacting us.
  • Right to erasure (“right to be forgotten”): you can delete your account with all associated data in the pilot dashboard. Deletion covers your profile, portfolio (photos and videos), equipment, operating areas, message threads, notifications, and profile statistics. Anonymous submissions sent through the feedback form are not linked to an account and are not covered by this deletion.
  • Right to data portability: you can download a complete copy of your data in JSON format in the pilot dashboard.
  • Right to restriction of processing: you can request restriction of processing in certain circumstances.
  • Right to object: you can object to processing based on the controller's legitimate interest.
  • Right to withdraw consent: you can withdraw any consent (e.g. marketing) at any time, without affecting the lawfulness of processing carried out before the withdrawal.

If you sent an inquiry to a pilot and do not have an account, you can exercise the rights above by contacting us at the email address in section 1.

You also have the right to lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland.

8. Cookies and Analytics

LetsFly uses only cookies that are strictly necessary for the platform to function:

  • Login session cookies: required to maintain a logged-in user session (first-party, set by Supabase Auth). They do not require consent because they are essential to provide the service.
  • Preference cookies: remember the selected interface language and the dismissal of the cookie notice.

We measure site traffic with Umami in its cookieless mode, running on our own infrastructure in the EU. Umami sets no cookies, builds no visitor profiles, and does not track you across sites; what it collects is aggregated and anonymous. Besides page views we record named events for progress inside the pilot dashboard - completing a checklist step, for instance. Such an event carries only its own name and a step key from a fixed list; never a profile id, a profile address or an email address. We do not use tools such as Google Analytics or Facebook Pixel, nor any third-party advertising or tracking scripts.

9. Changes to This Privacy Policy

We reserve the right to update this privacy policy. We will inform users about significant changes through a notification on the platform or by email. The current version is always available at this address.

10. Contact

For personal data protection matters, write to us:

Email: kontakt@letsfly.pl