Contents
The short version
- We collect what we need to run the marketplace: your account, trip requests, offers, messages and reviews, and operators' verification documents.
- Operators see your trip details, but only your first name and last initial, until you accept one of their offers. Other operators never learn who you are.
- We don't sell your personal information, and we don't use advertising or analytics trackers.
- We use one cookie, and its only job is keeping you signed in.
- You can ask us for a copy of your information, or to correct or delete it, at any time.
1.Information we collect
1.1 Information you give us
- Account. Your name, email address, password, whether you're a traveler or an operator, and your settings. We store your password only as a salted hash, never in readable form.
- Trip requests. Airports, dates and times, number of passengers, aircraft categories, budget, flexibility, add-ons such as catering or ground transport, notes, and special needs you flag, such as pets, extra baggage, medical equipment or wheelchair access.
- Offers, trips and messages. Offers you send or receive, trips you accept, messages in Chartavia's chat, and charter agreements an operator uploads for your trip.
- Reviews. The star rating and comments you leave after a completed trip.
- Operator information. Company name, FAA certificate number, home base, team members, aircraft tail numbers and models, aircraft photos, empty-leg listings, and the documents you upload, such as your air carrier certificate, D085 aircraft listing and safety audit certificates.
- Contact requests. The name, email address, phone number and message you send through our contact page.
- Plans. Whether you're on a paid plan, such as Chartavia Plus or Operator Pro.
Some special needs, such as medical equipment or wheelchair access, can reveal information about your health. Share only what an operator needs to plan your flight. We use it only to arrange your trip, and we show it only to operators who can quote it.
1.2 Information collected automatically
- Sign-in cookie. Keeps you signed in. See section 5.
- IP address. We use it to limit repeated attempts, such as sign-in and sign-up attempts, and to protect Chartavia from abuse. These counters are kept only briefly and are deleted automatically.
- Server logs. Our hosting provider, Cloudflare, records technical details of requests, such as IP address, browser type, the page requested and the time, to deliver and protect the service.
- Email records. We record which notification emails we've sent you so we don't send duplicates. When an email can't be delivered, we may keep a copy so our team can follow up.
- App files. Our web app stores a few files, such as icons, on your device so it can be installed and load faster. These files contain no personal information.
1.3 Information from other sources
- Public FAA records. The FAA's list of Part 135 certificate holders and their aircraft, and the FAA aircraft registry, which we use to check operators and aircraft.
- Other users. Travelers review operators, and operator administrators invite team members.
- Our team. Notes and decisions made while reviewing operators, confirming safety ratings and answering contact requests.
2.How we use information
- To run Chartavia: creating and securing accounts, delivering requests to operators, showing offers, revealing names when an offer is accepted, carrying messages and keeping trip records.
- To check operators and keep the marketplace fair: verifying certificates, aircraft and safety ratings, hiding contact details before an offer is accepted, and preventing abuse.
- To communicate with you: emails about your account and trips, such as password resets, new offers and messages, trip updates, verification results and rating renewal reminders, and replies to your contact requests. We don't send marketing emails.
- To show figures about the marketplace, such as the number of verified operators, quotes per request and response times. These figures don't identify travelers.
- To meet legal duties and protect rights, such as broker disclosure and record-keeping duties, tax and accounting, responding to lawful requests and enforcing our Terms.
- To improve Chartavia, using our own records to understand how features are used. We don't use third-party analytics.
4.How long we keep information
- Accounts and marketplace records are kept while your account is open. After you close your account, we delete or de-identify your personal information within 30 days, except records we must keep for legal, tax, accounting, dispute or broker purposes, such as trip, offer and deposit records. We keep those only as long as those purposes require.
- Sign-in sessions expire after 7 days, and password reset links after 30 minutes.
- Abuse-prevention counters are deleted automatically soon after they're created.
- Server logs are kept by Cloudflare for a short period.
- Backups may hold copies of deleted information for a limited time before they're overwritten.
6.Security
- Every page and request uses an encrypted HTTPS connection.
- Passwords are stored only as salted hashes, made with PBKDF2 and 100,000 iterations.
- The sign-in cookie is marked Secure and HttpOnly.
- Operators' documents are stored privately. Only that operator's team and authorized Chartavia staff can open them. A charter agreement can be opened only by the traveler and the operator on that trip, and by authorized staff.
- Repeated sign-in attempts are limited, and contact details are hidden in operator messages until an offer is accepted.
No system is perfectly secure. If a security breach affects your personal information, we'll notify you as the law requires.
7.Your choices and rights
- Access and correction. You can change your name and password in the account menu. For anything else, contact us.
- Deletion. You can ask us to close your account and delete your personal information through our contact page. We'll confirm the request came from you before acting on it. Some records may be kept as section 4 explains.
- A copy of your information. Ask us, and we'll send you a copy in a common format.
- Emails. Our emails are about your account and your trips, so they continue while your account is open.
Depending on where you live, you may have rights to know, access, correct, delete or get a copy of your personal information, and to opt out of its sale, sharing or use for targeted advertising. We honor these requests for everyone, wherever they live, and we won't treat you differently for making one. We'll respond within 45 days. If we decline your request, you can appeal by replying to our decision. If we deny the appeal, you can contact your state attorney general.
8.Children
Chartavia is for adults. You must be 18 or older to create an account, and we don't knowingly collect personal information from children under 13. Trip requests include only the number of passengers, not their names or ages. If you believe a child has given us personal information, contact us and we'll delete it.
9.Using Chartavia outside the United States
Chartavia is run from the United States. If you use it from another country, your information will be processed in the United States and wherever our service providers operate, where privacy laws may differ from those where you live. We process your information to provide the service you ask for, for our legitimate interest in running a safe and fair marketplace, to meet legal duties, and with your consent where the law requires it.
10.The interactive demo
Our interactive demo uses fictional sample accounts that any visitor can switch between. Anything you type there can be seen by other visitors, and demo data is reset from time to time. Don't enter real personal information in the demo.
11.Changes to this policy
We'll update this policy as Chartavia changes and post the new version with a new date. For material changes, we'll tell you by email or in the app before they take effect.
12.Contact us
Questions, or want to use your privacy rights? Reach us through our contact page and choose “Asking something else.” Chartavia is operated by Sapphire Productions, LLC, a Florida limited liability company.