Privacy Policy

Last updated: July 2026 (version 2026-07)

1. Data Controller

The controller of your personal data is LetsFly, operated by:

Lets Fly Jan Rawwo
ul. Jaworowa 9B, 82-300 Elbląg, Poland
NIP (tax ID): 5783157699
Email: kontakt@letsfly.pl

For any matter concerning the protection of your personal data, you can reach us at the email address above.

2. What Data We Collect

The scope of collected data depends on how you use the platform:

a) Pilot account registration

  • First and last name
  • Email address
  • Password (stored only in encrypted form by Supabase Auth; we have no access to it)
  • Profile name (slug)
  • A record of the consents you gave: consent type, date, and the version of the terms and privacy policy in force at the time

b) Pilot profile (provided voluntarily)

  • Bio and profile photo
  • Operating areas: base town and operating radius. We publish only the coverage circle on the map; base coordinates are rounded to town level and the exact point is never shown
  • Website, Instagram profile, YouTube channel
  • Equipment list and service categories
  • Portfolio photos and videos

c) Inquiry form and message threads (people sending inquiries)

  • Name
  • Email address (required)
  • Phone number (optional)
  • Content of the messages in your thread with the pilot

Inquiries are handled as message threads hosted on the platform. After sending an inquiry you receive an access link to your thread at the email address you provided; using it does not require an account. Our database stores only a cryptographic hash of the access token, never the link itself. Email notifications about new messages are informational only and do not contain message content. The consent you give when sending an inquiry is recorded together with the privacy-policy version in force at that moment.

d) Notifications

  • In-app notifications (e.g. about a new message) together with their read status
  • Email notifications sent through our email service provider (see section 4)

e) Profile statistics

For pilot profiles we count daily profile views and contact-button clicks. These are purely anonymous event counters: we store no IP addresses, no browser identifiers, no cookies, and we do not distinguish individual visitors.

f) Technical data

  • IP address (server logs, abuse prevention)
  • Browser and operating system type
  • Cookies essential for the service to work (see section 8)
  • Public forms are protected by the Cloudflare Turnstile anti-bot mechanism, which analyzes technical browser signals to distinguish humans from bots (see section 4)

g) Content reports

When you report content that violates our rules (the report form on a pilot profile), you provide the reason for the report, its description and - optionally - your email address. If you provide an address, we use it solely to inform you of the outcome of your report together with a statement of reasons (in line with the Digital Services Act - DSA). Reports without an email address remain anonymous.

3. Purposes and Legal Basis for Processing

We process your data for the following purposes:

  • Performance of a contract (Art. 6(1)(b) GDPR): maintaining your account, displaying your pilot profile, handling inquiries and message threads, sending notifications about account activity.
  • Consent(Art. 6(1)(a) GDPR): sending marketing communications (only if you opted in; you can withdraw consent at any time in your account settings) and sharing the inquiry sender's contact details with the selected pilot.
  • Legitimate interest of the controller (Art. 6(1)(f) GDPR): platform security, abuse prevention (rate limits, anti-bot protection), anonymous traffic statistics and profile statistics.
  • Legal obligation (Art. 6(1)(c) GDPR): retaining data required by law, including the consent record.

4. Data Recipients (Sub-processors)

We entrust your data only to trusted processors bound by Data Processing Agreements (DPAs). Instead of enumerating their sub-processors, we link to the current lists maintained by the vendors themselves:

Maps on the platform use tiles served by OpenFreeMap; your browser fetches them directly from that provider's servers, which therefore sees your IP address. Town search uses the Photon geocoder, but queries pass through our server, so your IP address is not forwarded to that provider.

The contact details of a person sending an inquiry (name, email, optionally phone number, and the message content) are shared with the selected pilot to enable a response. The sender is informed of this and gives consent before submitting the form.

5. Data Transfers Outside the EEA

Platform data is stored in data centers located in the European Union. Where the use of one of the providers listed above (e.g. Cloudflare) involves a transfer outside the European Economic Area, it takes place solely under mechanisms provided for by the GDPR: adequacy decisions (including the EU-U.S. Data Privacy Framework) or standard contractual clauses.

6. Data Retention

  • Account data: retained for the lifetime of your account. Upon account deletion, the data is permanently removed.
  • Unconfirmed accounts: accounts whose email address has not been confirmed are automatically deleted after 7 days.
  • Inquiries and message threads: retained for the lifetime of the account of the pilot they were sent to. The pilot can delete individual threads at any time in the pilot dashboard. Deleting the pilot's account permanently removes all their threads together with the senders' contact details.
  • Server logs: retained for a maximum of 30 days for security purposes.
  • Consent records: retained for the period required by law, to demonstrate GDPR compliance.

7. Your Rights

Under the GDPR you have the following rights:

  • Right of access: you can request information about what personal data we process about you.
  • Right to rectification: you can correct your data in the pilot dashboard or by contacting us.
  • Right to erasure (“right to be forgotten”): you can delete your account with all associated data in the pilot dashboard. Deletion covers your profile, portfolio (photos and videos), equipment, operating areas, message threads, notifications, and profile statistics. Anonymous submissions sent through the feedback form are not linked to an account and are not covered by this deletion.
  • Right to data portability: you can download a complete copy of your data in JSON format in the pilot dashboard.
  • Right to restriction of processing: you can request restriction of processing in certain circumstances.
  • Right to object: you can object to processing based on the controller's legitimate interest.
  • Right to withdraw consent: you can withdraw any consent (e.g. marketing) at any time, without affecting the lawfulness of processing carried out before the withdrawal.

If you sent an inquiry to a pilot and do not have an account, you can exercise the rights above by contacting us at the email address in section 1.

You also have the right to lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland.

8. Cookies and Analytics

LetsFly uses only cookies that are strictly necessary for the platform to function:

  • Login session cookies: required to maintain a logged-in user session (first-party, set by Supabase Auth). They do not require consent because they are essential to provide the service.
  • Preference cookies: remember the selected interface language and the dismissal of the cookie notice.

We measure site traffic with Umami in its cookieless mode, running on our own infrastructure in the EU. Umami sets no cookies, builds no visitor profiles, and does not track you across sites; only aggregated, anonymous traffic data is collected. We do not use tools such as Google Analytics or Facebook Pixel, nor any third-party advertising or tracking scripts.

9. Changes to This Privacy Policy

We reserve the right to update this privacy policy. We will inform users about significant changes through a notification on the platform or by email. The current version is always available at this address.

10. Contact

For personal data protection matters, write to us:

Email: kontakt@letsfly.pl