Privacy.

What we collect

When you submit a trip request, we collect: your contact email, the origin and destination of your trip, your travel dates and party size, your cabin preference, and any notes you provide. We collect equivalent information when an operator reaches out. We log standard request metadata (IP address, user agent, timestamp) at the submission endpoint for abuse prevention.

Developer accounts

For email sign-in, we store your email as a login identifier, a salted password hash, and hashes of your recovery code and session tokens. We use these to authenticate you and protect your account. We also retain API-key names, permissions, expiry and revocation records, and daily usage counts. Rate limits use hashed identifiers to reduce sign-in abuse. Email sign-in does not enroll you in marketing emails.

What we do with it

We use your trip request to route your trip: to contact you about it and to share the relevant details with operators we are sourcing quotes from. If you are open to compatible group routing, we may use your request to align it with a separate flight on similar routing — routing alignment only, never seat-sharing.

What we do not do

We do not sell your information. We share it with the operators sourcing quotes for your trip and service providers processing it for BasiFly. We retain trip requests and their consent records for follow-up and request history. You can ask us to delete your request using the contact address below.

Optional estimate emails

If you separately opt in, we save your consent text, version and time, and use your email for your estimate, operator-quote updates and trip-planning follow-ups. Each message includes unsubscribe. We keep a suppression record to honor that choice. Email delivery is paused while our sending domain is configured. Our email and CRM service providers process this information for BasiFly.

Operators

When an operator is sourcing your trip, they see the information necessary to quote it: origin, destination, dates, party size and notes. If you consent when submitting a request, we may also share your contact information with appropriate operators to obtain quotes. This is separate from marketing consent.

Public operator profiles

Operator introductions, declared bases and uploaded photographs are public when published by an authorized representative. We retain claim verification, access changes and publication history to protect business accounts and explain changes. Image uploads are resized and re-encoded without embedded metadata. Private aircraft research and inferred home-base candidates are available only to authorized staff.

When you request an external rating, BasiFly asks the relevant provider for the matched business listing. We do not send your BasiFly account identity to the ratings provider. Following a provider link opens its own service. Google Maps content is subject to the Google Privacy Policy; Yelp links are subject to Yelp’s Privacy Policy.

Your rights

You can request deletion of your data at any time by emailing [email protected]. We respond within 7 days. California residents have CCPA rights; EU residents have GDPR rights; we honor both.

Cookies

The public marketing site does not require a login or a preview-access cookie. The flight planner uses your browser tab’s session storage to retain a private request receipt and safely retry an interrupted submission. Keep downloaded receipts private: they grant access to your request status. Developer sign-in uses essential secure session cookies for the method you choose: BasiFly email and password or Angel Ink. BasiFly email sessions expire after seven days; signing out invalidates the current session. We do not use analytics or advertising cookies.

Optional planning activity

If you enable “Help improve the planner,” we count steps such as location or manual discovery, airport selection, use of the basic map and request review. We do not put coordinates, search text, airport codes, travel dates, contact information, private receipts or full URLs in these activity records. We use a random identifier kept only in memory for that page visit, and store only its hash on the server. Leaving the page resets the choice. Do Not Track, Global Privacy Control and recognized automated or account browsers disable collection.

With a submitted request, we retain a small set of source and campaign labels. If planning activity is enabled, the request can be linked to that measured visit. Activity records and these join identifiers expire after 90 days and are removed by an hourly cleanup. Bounded source labels remain with the operational request. Staff see aggregate reports and can classify requests as internal, test or customer activity and record qualification reviews. Turning measurement off stops subsequent events; it does not delete activity already received. This choice is separate from trip-contact and marketing consent.

Operator page activity

We count operator page views and contact-link actions to help businesses understand their public profiles. These records store daily totals by business, action and broad BasiFly source category, without retaining IP addresses, full referrer URLs or a persistent visitor identifier. Random event identifiers expire after 48 hours; daily totals are retained for up to 400 days. Counts are approximate and do not represent unique visitors, completed calls or bookings.

Collection honors Do Not Track and Global Privacy Control. Known automated browsers and recognized account browsers are excluded. Activity reports are available only to authorized business representatives. Google Search reporting is not currently connected.