Key points
- We use your data to operate the marketplace: account, listings, conversations, quotes and deals. We do not sell personal data.
- Your email and phone number are not shown to other users. Charter operators only receive your contact details after you accept a quote.
- We measure site visits without cookies and without storing IP addresses, and you can opt out of this measurement in the cookie banner.
- You can download your data, correct it, withdraw consents and request deletion in your dashboard or through the privacy channel.
1. Who the controller is
AirbanX is the controller of the personal data processed on the airbanx.com Platform, under Brazil's General Data Protection Law (Lei 13.709/2018, "LGPD") and, where applicable, the European Union's General Data Protection Regulation (GDPR) and other privacy laws.
To contact the Data Protection Officer (DPO) or exercise your rights, use the privacy channel at airbanx.com/privacidade/direitos or, if you have an account, Dashboard → Privacy.
2. What data we process
| Context | Data |
|---|---|
| Registration and account | name, email, phone, person type (individual or company), company, country, state, city, password (stored only as a hash), business profiles |
| Advertiser verification | identity document, country tax identification, company registration, Air Operator Certificate (AOC) and uploaded files |
| Listings | aircraft, part or service details, photos, videos, price and location |
| Conversations and deals | messages, offers, acceptances, deal history and notifications |
| Charter quote request | name, email, phone, company and job title (optional), route, dates, passengers, notes and chosen notification channels |
| Acceptance records | document accepted, version, text hash, date and time, language, browser and hashed IP address |
| Site usage | pages viewed, visit source (website, search, ad or campaign), approximate country, region and city, device type and language |
| Security | access logs and logs of relevant actions, hashed IP address to limit abuse |
We do not request sensitive data (health, religion, biometrics, etc.). Please do not request or send such data through the chat.
3. Why we use it and on what legal basis
| Purpose | Legal basis (LGPD art. 7 / GDPR art. 6) |
|---|---|
| Create and maintain your account, publish listings, operate chat, offers, quotes and deals | performance of a contract |
| Verify advertisers and operators, prevent fraud and scams, mask contact details | legitimate interest and compliance with a legal obligation |
| Send notices about your requests and deals through the chosen channels | performance of a contract and consent |
| Keep records of access, acceptances and deals | legal obligation (e.g., Brazil's Internet Civil Rights Framework, Marco Civil da Internet, art. 15) and regular exercise of rights |
| Measure visits and traffic sources, without cookies, to improve the site and its promotion | legitimate interest, with an opt-out in the banner |
| Third-party marketing tools (ad pixels), if enabled | consent |
4. Who we share it with
- Other users: see your name, company, city, country, listings and the messages you send during negotiation. Email, phone and documents are not displayed.
- Charter operators: receive the request without email and phone; contact details are released only after you accept a quote.
- Technology providers that process data on our behalf, such as Cloudflare (hosting, database, file storage, security and approximate geolocation) and, when enabled, email and WhatsApp delivery providers.
- Authorities, when there is a legal obligation or court order, and for the defense of rights.
- Successors, in the event of a corporate reorganization, with this Policy remaining in force.
We do not sell or rent personal data.
5. International transfers
The Platform runs on Cloudflare's global infrastructure, and data may be processed outside your country, including in the United States. In such cases we use the safeguards provided for in the LGPD (art. 33) and the GDPR, such as standard contractual clauses and provider commitments.
6. Cookieless visit measurement
To learn where visits come from (countries, cities, search engines, social networks and campaigns) we use our own measurement, without cookies and without storing IP addresses:
- each visitor becomes a daily code calculated from the IP address, browser and a random daily key; the key is deleted after 2 days, after which not even AirbanX can link the code to an IP address;
- country, region and city are approximate, provided by the Cloudflare network;
- browsers with the "Global Privacy Control" (GPC) signal enabled are not measured;
- if you decline "Statistics" in the cookie banner, measurement stops;
- measurement data is kept for up to 13 months and used in aggregate form.
7. How long we keep it
- Account and listings: while the account is active; after deletion, we delete or anonymize the data, except what must be retained by law.
- Conversations, offers and deals: for as long as necessary to evidence the deal and defend rights (as a rule, up to 5 years after closing).
- Access logs: at least 6 months (Marco Civil da Internet).
- Acceptance and consent records: while the account exists and for the applicable limitation periods, as evidence.
- Charter quote requests without an account: up to 24 months after the request.
- Visit measurement: up to 13 months.
8. Your rights
Under the LGPD (art. 18) and, where applicable, the GDPR, you may request:
- confirmation that we process your data, and access to it;
- correction of incomplete, inaccurate or outdated data;
- anonymization, blocking or deletion of unnecessary data or data processed in breach of the law;
- portability (a copy of your data in a structured format);
- deletion of data processed on the basis of consent, and information about whom we share it with;
- withdrawal of consent and objection to processing based on legitimate interest.
If you have an account, you can download your data and view your acceptances in Dashboard → Privacy. For other requests, use airbanx.com/privacidade/direitos. We respond within 15 days. You may also lodge a complaint with Brazil's National Data Protection Authority (ANPD) or with the authority in your country.
9. Security
We use encrypted connections (HTTPS), passwords stored only as hashes, protected sessions, restricted access to verification documents, hashed IP addresses and audit logs. No system is 100% secure; if an incident poses a significant risk, we will notify you and the authority as required by law.
10. Minors
The Platform is not intended for persons under 18, and we do not knowingly collect data from minors.
11. Changes to this Policy
We may update this Policy. The version and date appear at the top. Material changes are announced on the Platform and, for users with an account, we ask for a new acceptance.