Privacy Policy
What data we collect, why we collect it, and what control you have over it — for both the website and the app.
1. Who we are
We are the "data controller" for the personal data described here.
- Service: WhatFBO (www.whatfbo.com)
- Legal entity: Avia Index Limited (trading as WhatFBO), a company registered in England & Wales, company number 16783750
- Registered address: The Maltings, Rosemary Lane, Halstead, Essex, CO9 1HZ, United Kingdom
- Privacy contact: fly@whatfbo.com
- ICO registration: Registered with the ICO — application reference C1967268 (data protection fee paid 24 June 2026). Registration number: C1967268 (interim — formal ZA number to follow once issued).
We are registered with, and regulated by, the UK Information Commissioner's Office (ICO).
2. What this policy covers
This policy applies to everyone who interacts with WhatFBO — pilots and aviation professionals who browse or review, FBOs who claim and manage profiles, and visitors to our website. It does not cover third-party websites we link to.
3. The data we collect
We collect only what we need to run the platform.
| Category | Examples | Where it comes from |
|---|---|---|
| Account data | Name, email address, password (hashed), user type (pilot / operator) | You, when you register |
| Profile data (FBOs) | Business name, location, services, opening hours, contact details, photos, compliance/audit credentials | You / your organisation |
| Reviews & content | Ratings, written reviews, photos, replies — and the identity attached to them | You, when you post |
| Usage & device data | IP address, device/browser type, pages viewed, referring site, cookie identifiers | Automatically, via cookies/analytics |
| Communications | Emails, support messages, survey responses | You |
| Payment data | Billing name, transaction records (card details are handled by our payment processor, not stored by us) | You, via Stripe |
We do not deliberately collect special category data (e.g. health, race, political views). Please don't include such data in reviews.
4. How we use your data — and our lawful basis
Every use has a lawful basis under UK GDPR.
| Purpose | Lawful basis |
|---|---|
| Create and manage your account | Contract (Art. 6(1)(b)) |
| Publish your reviews and FBO profiles | Legitimate interests — operating a transparent review platform (Art. 6(1)(f)) |
| Provide, secure and improve the service | Legitimate interests |
| Process Sponsored / membership payments | Contract |
| Send service and transactional emails | Contract / legitimate interests |
| Send marketing (where you've opted in) | Consent (Art. 6(1)(a)) and PECR |
| Comply with legal obligations | Legal obligation (Art. 6(1)(c)) |
Where we rely on legitimate interests, we've balanced those against your rights and you can object at any time (see Section 9).
5. Reviews and user-generated content
Reviews are public — that's the point of the platform. When you post a review it is visible to other users alongside the name or username on your account.
- We moderate content under our Review & Acceptable Use Policy and may remove content that is unlawful, defamatory, abusive or fake.
- FBOs have a right of reply to reviews about them.
- If you believe a review about your business is inaccurate or unlawful, you can ask us to review it via fly@whatfbo.com.
6. Cookies and analytics
We use essential cookies to run the site, and analytics cookies only with your consent. The website uses Google Analytics to count visits and see which pages are used. It is set only after you accept it in the panel shown on your first visit, and the Google tag is not placed on the page at all until you do — so declining means no analytics data is collected, not merely that it is discarded. You can change your answer at any time via the Cookie settings link at the foot of every page. See our Cookie Policy for the full list.
This applies to the website. What the app collects is unchanged and is covered in section 7.
7. Who we share data with
We never sell your personal data. We share it only with:
- Service providers (processors) acting on our instructions. Each is bound by a written data-processing agreement:
- Amazon Web Services — the servers and database the platform runs on.
- Stripe — payment processing. Card details go to Stripe directly and are never held by us.
- Google — maps and place lookups on the website, in the app and in the FBO admin; push notifications and performance monitoring in the app (Firebase); the web fonts the website uses; and, only if you accept analytics cookies, Google Analytics on the website. Analytics is off until you accept it, and rejecting it stops the data being collected at all.
- Authorities or advisers where required by law, or to establish, exercise or defend legal claims.
8. International transfers
If data leaves the UK, we protect it. Where a provider processes data outside the UK, we rely on UK "adequacy" regulations or appropriate safeguards such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.
9. How long we keep it
| Data | Retention |
|---|---|
| Account data | While your account is active, then 12 months after closure |
| Reviews & content | Retained while published; may remain after account closure in anonymised form |
| Usage/analytics | 14–26 months |
| Payment/transaction records | 6 years (tax/accounting law) |
| Support communications | 24 months |
10. Your rights
Under UK GDPR you can:
- access a copy of your data;
- have inaccurate data corrected;
- have your data erased ("right to be forgotten");
- restrict or object to processing;
- request data portability;
- withdraw consent at any time; and
- object to direct marketing.
To exercise any right, email fly@whatfbo.com. We'll respond within one month. You can also complain to the ICO (ico.org.uk, 0303 123 1113), though we'd appreciate the chance to help first.
11. Children
WhatFBO is not intended for children. It is aimed at aviation professionals and is not directed at anyone under 16.
12. Changes to this policy
We'll keep this current. Material changes will be posted here with an updated date and, where appropriate, notified to you.
13. Contact us
Questions about this policy or your data? Email fly@whatfbo.com.
The other policies