Privacy Policy

PilotWise (“PilotWise”, “we”, “us”) operates an aviation talent marketplace connecting pilots with recruiters and operators. This policy explains what personal data we collect, why, and what rights you have over it. It is drafted to reflect UK GDPR and Data Protection Act 2018 principles and is written to match how the platform actually works, section by section. It has not yet been reviewed by a qualified solicitor or checked against ICO registration requirements. That review must happen before this policy is relied on in production.

We are the data controller for the personal data described in this policy. Every account holder, whether pilot, recruiter or administrator, is covered by Section 1. Section 2 sets out what applies specifically if you hold a pilot account, and Section 3 sets out what applies specifically if you hold a recruiter account.

Section 1: General (applies to everyone)

1.1 Data we collect from all users

• Account data: name, email address, phone number (optional), password (stored only as a salted hash by our authentication provider, never in plain text), and account role.
• Sign-in and session data: timestamps of sign-in, and a session cookie that keeps you logged in (see 1.3).
• Contact form submissions: if you use our contact page, we collect the name, email, subject and message you provide.
• Communications: emails we send you (account security, notifications you've opted into) and any replies you send back.

We do not currently use analytics, advertising or third-party tracking cookies of any kind. If that changes, we will update this policy and this section first, and ask for consent where the law requires it.

1.2 Why we process this data, and our legal basis

• Providing the service: creating your account, letting you sign in, and showing you the right screens for your role. Necessary to perform our contract with you.
• Keeping the platform secure: detecting abuse and enforcing access rules. Our legitimate interest in running a safe, reliable service.
• Responding to enquiries you send via the contact form. Necessary to perform our contract with you, or our legitimate interest in dealing with your query if you're not yet a user.
• Sending you notification emails you've chosen to receive (job matches, expiry reminders, airline updates), based on your consent, which you control via toggles in Account Settings and can withdraw at any time.

1.3 Cookies and similar technologies

We use one strictly necessary cookie set to keep you signed in and to secure your session. It is required for the platform to function and cannot be switched off while using the service. The “Remember me” option at login controls how long this cookie persists on your device. Full detail is in our separate Cookie Notice.

1.4 Who we share your data with

We use a small number of trusted service providers (“processors”) to run the platform. They only process your data on our instructions, to provide their specific service, and are not permitted to use it for their own purposes:

• Supabase: our database, authentication and file storage provider. Supabase hosts all account, profile and document data in the EU (Ireland).
• Resend: our transactional email provider, used to deliver account security emails and the notification emails you've opted into. Resend's infrastructure runs on AWS, primarily in the United States.
• Vercel: hosts the application itself. Our server-side compute is configured to run in Europe; static assets are additionally served from Vercel's global content delivery network regardless of region.
• IONOS: our domain registrar and DNS provider, and host of our general enquiries inbox (hello @ pilotwise.co, remove the spaces). IONOS is a German company; its infrastructure is primarily EU-based.

We do not sell personal data, and we do not share it with third parties for their own marketing purposes. Where a provider processes data outside the UK/EEA (currently Resend), we rely on their standard contractual clauses or equivalent safeguards as the legal basis for that transfer. We will confirm the specific safeguard documentation in place as part of the pre-launch legal review.

If PilotWise is involved in a merger, acquisition or sale of all or part of its business, personal data may be transferred to the party involved as part of that transaction. We will require any new owner to handle your data in a way that is at least as protective as this policy.

1.5 How long we keep your data

We keep your account and profile data for as long as your account is active. Contact form submissions are kept only as long as needed to resolve your enquiry and for a reasonable period afterwards for our records. You can delete your account at any time from Account Settings, which permanently removes your profile and associated data from our systems (subject to any residual copies in backups, which are purged on a rolling cycle).

1.6 Keeping your data secure

Access to data is enforced at the database level through row-level security policies, not just in the application UI, so a bug in a screen can't accidentally expose data it shouldn't. Uploaded documents are stored in a private file store with no public access. Traffic to the platform is encrypted in transit. No system is perfectly secure, but we take reasonable, proportionate technical and organisational measures to protect your data against loss, misuse and unauthorised access. If a breach occurs that poses a risk to your rights and freedoms, we will notify you and the ICO without undue delay, as required by law.

1.7 Your rights

Under UK GDPR, you have the right to:

• be told how your data is used (this policy);
• access a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased (“the right to be forgotten”), which you can do yourself via Account Settings, or by asking us;
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent at any time, where we rely on consent (e.g. notification emails);
• complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk, or your local supervisory authority, if you think we’ve mishandled your data.

To exercise any of these rights, use our contact page or email hello @ pilotwise.co (remove the spaces before sending).

1.8 Children

PilotWise is intended for working-age aviation professionals and recruiters. It is not directed at, and we do not knowingly collect data from, children under 18.

1.9 Automated decision-making

We do not use automated decision-making or profiling that produces legal or similarly significant effects about you. Match percentages and search results are informational only; every hiring, shortlisting and account-approval decision is made by a human.

1.10 Changes to this policy

We may update this policy as the platform changes. We will update the “last updated” date above, and where changes are material we will make reasonable efforts to notify you.

Section 2: Additional information for pilots

This section applies in addition to Section 1 if you hold a pilot account.

2.1 Additional data we collect from pilots

• Identity & eligibility: nationality, right-to-work regions, ICAO English language level.
• Professional experience: base airport, total/PIC/IFR/sim/dual flying hours, sectors you work in, languages spoken, employment history (employer, position, dates), a free-text summary, and whether you're actively looking for work.
• Licences & qualifications: licence type and issuing authority; type ratings, with hours on type and instructor/examiner qualification and expiry date where applicable.
• Medical information: medical certificate class and its expiry date. This is health data, a “special category” of data under UK GDPR that requires a higher standard of protection. We only collect it with your explicit consent at signup, and only to display a validity status (valid / expiring / expired) to recruiters. The underlying medical certificate details are never shared beyond that status.
• Uploaded documents: licence, medical certificate, passport, visa, crew ID, logbook and similar files you choose to upload, stored in a private file store.
• Platform activity: jobs you save, airlines you follow, your notification preferences, and reviews you post about airlines.

2.2 Why we ask for medical and identity data

Airlines and operators need to know whether a pilot holds a valid medical certificate and the right to work in a given region before considering them for a role. We collect this so recruiters can filter for eligible candidates without us having to share your underlying documents. Our legal basis for processing your medical class/expiry (special category health data) is your explicit consent, given when you complete your pilot profile; you can withdraw this by removing the information from your profile or deleting your account.

2.3 Who can see your pilot data

Your profile is private by default and only visible to recruiters we have approved, and only while your profile is set to “published” (a toggle you control). Even then, recruiters see your professional profile and a validity status for each credential; they never see the uploaded documents themselves, your passport/visa files, or full identity document contents. Administrators can access full profile data, including uploaded documents, to operate, verify and moderate the service.

2.4 Reviews you post

If you submit a review of an airline, your review content (ratings, comments, employment status) is shown publicly against that airline’s profile once approved. We do not display your name alongside a review.

2.5 Retention and deletion for pilots

Deleting your account removes your profile, licences, type ratings, credentials, uploaded documents, employment history and saved/follow activity. Reviews you’ve posted may be retained in de-identified form as they are not displayed with your name.

Section 3: Additional information for recruiters

This section applies in addition to Section 1 if you hold a recruiter account.

3.1 Additional data we collect from recruiters

• Company details: company name, website, country, your job title, and a free-text description of what you recruit for.
• Contact details: a contact name, email and phone number, which may be shown to pilots you shortlist or contact so they can identify who is reaching out.
• Vetting records: your account’s approval status, and the identity and timestamp of the administrator who reviewed it.
• Search and engagement activity: pilots you shortlist, and contact-request records showing which pilots you’ve indicated interest in contacting.

3.2 Vetting and approval

Every recruiter account is manually reviewed before it can search for or contact pilots. We process your company and contact details for this vetting on the basis of our legitimate interest in protecting pilots’ data from unverified access, and to perform our contract with you as a recruiter.

3.3 Your interactions with pilot profiles

When you shortlist a pilot or register interest in contacting them, we record that action and may show the affected pilot that an agency has engaged with their profile (without necessarily naming your company, depending on the pilot’s view). This is necessary to perform our contract with you and with the pilot, giving both sides visibility into the marketplace.

3.4 Retention and account status for recruiters

We retain your recruiter account and activity data for as long as your account is active or approved. If your access is revoked or your account is deleted, your shortlist and contact records are removed; historical aggregate records (e.g. that a pilot was contacted) may be retained by the pilot’s own account for their reference.

Contact

For any privacy questions, to exercise your rights, or to make a complaint, use our contact pageor email hello @ pilotwise.co (remove the spaces before sending). You also have the right to lodge a complaint directly with the Information Commissioner’s Office at ico.org.uk.