This Privacy Policy explains how Villiers Jets Limited ("we", "us", "our") collects, uses, and protects your personal data when you use our website at villiers.ai and our services. Your privacy is important to us, and we are committed to protecting any personal data you provide.

This policy should be read alongside our Terms of Service.

"Personal data" means information relating to you as an identifiable individual. For example, your name or contact details, as well as information that may not on its own identify you, but which we store alongside such identifiers, such as how you are using our services or the country you are in when you do so.

We only use your information where you've given us your consent, where it's necessary to deliver the services you've requested, where it's necessary to exercise or comply with legal rights or obligations, or for normal business purposes of the kind set out in this policy.

See subsections below for specific scenarios.

When you request or book a flight or additional services, we will require certain information, including your name and contact details, passport details (when required for booking confirmation), payment information (processed securely through Stripe), flight preferences, and any special requests or requirements.

We will use your information to follow up on bookings, enquiries, or further assistance with your flight. You can opt-out of marketing communications at any time.

If you book a flight or additional services for other people, we will require personal data such as their name, date of birth, and passport information. It is your responsibility to ensure that anyone whose data you provide is aware of and consents to our use of their data as described in this policy.

Even if you don't make an enquiry, we may collect information such as your browser fingerprint (user agent, screen resolution, timezone, language), session data (session ID, visit duration, page views), device type, referrer URL, and interaction data (searches, scroll depth, clicks on tracked elements).

Important: Our analytics system is privacy-first and built in-house. We do not use third-party tracking services like Google Analytics. All analytics data is fully anonymised and stored on our own servers. We do not use cookies for tracking purposes.

We collect your email address, name, and requested information. You can unsubscribe at any time using the Unsubscribe link in any email.

Your personal data will be used for:

• Processing flight enquiries and bookings
• Communicating with you about your flight or enquiry
• Sharing necessary details with aircraft operators to complete your booking
• Processing payments (via Stripe)
• Improving our website and services
• Complying with legal obligations
• Fraud prevention and security

We do not sell or rent your personal data. We share data only in the following circumstances:

Aircraft Operators: When you confirm a booking, we share your name and passport details with the aircraft operator. In some cases (particularly for US operators requiring digital contract signatures), we may share your email address with explicit approval to enable operators to send contracts directly for e-signature.

Service Providers: Stripe (payment processing), AWS SES (transactional emails), and Vercel (website hosting and infrastructure).

Legal Requirements: We may disclose your data if required to comply with applicable laws, regulations, legal processes, or government requests.

We retain your personal data for as long as necessary to fulfil the purposes outlined in this policy. Specifically:

• Enquiry data: Retained for 24 months from date of enquiry for customer service and business analysis purposes
• Booking data: Retained for 7 years to comply with financial record-keeping obligations
• Analytics data: Fully anonymised, retained indefinitely for service improvement
• Authentication data: Retained while your account is active; deleted upon account closure

You may request deletion of your data at any time, subject to our legal obligations (see Your Rights below).

Under UK data protection law, you have the following rights:

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate or incomplete data
• Erasure: Request deletion of your personal data (subject to legal obligations)
• Restriction: Request that we restrict processing of your data
• Portability: Request a copy of your data in a machine-readable format
• Objection: Object to processing of your data for certain purposes
• Withdraw Consent: Withdraw consent for marketing or other optional processing

To exercise any of these rights, please contact us at support@mail.villiers.ai with the subject line "Subject Access Request" and provide your enquiry reference number if applicable.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. These include:

• Encryption of data in transit (HTTPS/TLS)
• Secure storage of data on encrypted servers
• Access controls limiting who can view personal data
• Regular security audits and updates
• Nostr-based authentication (no password storage)

While we take all reasonable precautions, no internet-based service can be 100% secure. You are responsible for keeping your authentication credentials safe.

We do not use cookies for analytics or tracking purposes. The only cookies we use are:

• Authentication cookie: Essential for maintaining your logged-in session
• Session storage: Temporary browser storage for affiliate tracking (if you arrive via an affiliate link) and analytics session ID

Our analytics system uses browser fingerprinting (user agent, screen resolution, timezone) to track aggregate usage patterns without cookies. This data is fully anonymised and cannot be used to identify you personally.

Your data is primarily stored in the UK and EU. Some service providers (such as Stripe and AWS) may process data outside the EEA, but only with appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.

Our services are not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If you are under 18, you must have parental consent to use our services.

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last updated" date. We encourage you to review this policy periodically.

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:

Email: support@mail.villiers.ai

Telephone: +44 (0)20 8163 6578

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):

Helpline: 0303 123 1113

Website: ico.org.uk