Privacy Policy

DroneOD ("we", "us") operates an online marketplace that connects customers with licensed drone operators in the United Kingdom. We are the data controller for the personal data described in this policy. For any privacy question, or to use any of the rights set out below, contact us at privacy@droneod.com.

• Account details: your name, email address and phone number.
• Booking details: the service requested, location, date and any notes you provide.
• Operator details: business name, service area, equipment and CAA licence or certificate information used for verification. If an operator chooses "use my location" during sign-up, we also collect their device coordinates to place their listing on the map.
• Operator identity documents: images of a government-issued ID (front and back) and a selfie, which operators submit so we can confirm who they are before approval (see the dedicated section below).
• Payment information: handled by our payment processor, Stripe. We do not store full card numbers.
• Usage data: pages you visit and actions you take, used to run and improve the service.

Under UK GDPR we must have a lawful basis for everything we do with your data. Here is what we do and why:

• Create and manage your account, and let customers and operators complete a booking together. Lawful basis: performance of our contract with you.
• Process payments and pay operators through Stripe. Lawful basis: performance of our contract with you.
• Verify that an operator is who they say they are and holds the right CAA authorisation before we approve them. Lawful basis: our legitimate interest in running a safe and trustworthy marketplace.
• Keep payment and tax records. Lawful basis: compliance with our legal obligations.
• Prevent fraud and keep the marketplace secure. Lawful basis: our legitimate interest in protecting users and the service.
• Send you service messages you have asked for, or marketing where that is optional. Lawful basis: consent, which you can withdraw at any time.

When an operator applies, we ask them to submit images of a government-issued identity document (front and back) and a selfie, so we can confirm their identity and match their face to the document before we approve their account. Depending on the document, this may include special-category data, so we treat it with extra care.

• They are stored in a private, access-controlled storage bucket. They are never public and are not shown on any listing.
• They are used for one purpose only: making the approval decision on that operator's account.
• Once the decision is made, we delete the ID images and the selfie straight away, whether the application is approved or declined. The licence or certificate number and the operator's address are kept as part of the operator's record; the images are not.

We do not use these images for any other purpose, and we do not share them except where the law requires it.

We keep personal data only for as long as we need it, then delete or anonymise it. As a guide:

• Account data: while your account is active. If you close your account, we remove or anonymise it after a short wind-down period, unless we must keep some of it for the reasons below.
• Operator ID images and selfie: deleted when the approval decision is made, as set out above.
• Payment and tax records: kept for around 6 years to meet UK accounting and tax law.

We share the booking details a customer and operator need to complete a job. We never sell your personal data. We use a small number of trusted providers who process data on our instructions:

• Stripe, for processing payments.
• Supabase, for authentication, our database and file storage.
• Vercel, for hosting the website.
• Brevo, for sending account and service emails.
• CARTO and OpenStreetMap, whose servers deliver the map tiles shown in the app (they receive your IP address when the map loads). Address look-ups are sent through our own server, not from your device.

We may also disclose data where the law requires it.

Some of our providers may process data outside the United Kingdom. Where that happens, we rely on an appropriate safeguard so your data keeps the same protection, such as the UK International Data Transfer Agreement (IDTA) or Standard Contractual Clauses.

We only use essential cookies and browser storage, set by Supabase to keep you signed in and hold your session. These are strictly necessary to provide the service you asked for, so under the Privacy and Electronic Communications Regulations (PECR) they fall within the essential-cookie exemption and do not need a consent banner. We do not use advertising or analytics trackers. If we ever add any non-essential technology, we will put a consent banner in place first and ask for your consent before it runs.

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted in certain cases;
• restrict or object to how we use your data;
• receive your data in a portable format;
• withdraw your consent at any time, where we relied on consent. Withdrawing it does not affect anything we did beforehand.

To use any of these, email privacy@droneod.com. If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office (ICO) at https://ico.org.uk/make-a-complaint/. We would appreciate the chance to put things right first.

We use industry-standard measures, including encryption in transit and access controls, to protect your data. No system is perfectly secure, so we cannot guarantee absolute security.

We may update this policy from time to time. We will post the new version here and update the date above.

Questions about this policy? Email privacy@droneod.com.