Privacy Policy

Effective Date: October 7, 2026
Last Updated: October 7, 2026

SkyAccess, Inc. ("SkyAccess," "we," "us," or "our") respects your privacy and is committed to protecting the personal information you share with us. This Privacy Policy explains how we collect, use, disclose, transfer, and safeguard information when you visit skyaccess.com, use our platform, or otherwise interact with our services (collectively, the "Services").

SkyAccess offers Services to users in the United States and internationally, including the European Economic Area (EEA), the United Kingdom, Switzerland, Canada, Brazil, Australia, and other jurisdictions. This Policy is written to comply with applicable privacy laws in those regions, including the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection (FADP), the California Consumer Privacy Act/California Privacy Rights Act (CCPA/CPRA), Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Quebec Law 25, Brazil's Lei Geral de Proteção de Dados (LGPD), and the Australian Privacy Act.

By using the Services, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Services. Region-specific rights and disclosures are set out in Sections 7–11.

1. Who We Are and Data Controller

SkyAccess, Inc. is the controller of personal data collected through the Services for purposes of the GDPR, UK GDPR, FADP, LGPD, and similar laws.

Our Services are provided to two primary audiences:

• Travelers — individuals and businesses who browse, book, and pay for flights.
• Operators — FAA Part 135 (or equivalent foreign-certificated) charter operators and their authorized personnel who list available flights, manage inventory, and receive payment for completed bookings.

General Privacy Contact: privacy@skyaccess.com.

2. Information We Collect

2.1 Information You Provide Directly

• Account information — name, email, phone, password, company/operator name
• Operator profile — certificate number, fleet details, aircraft tail numbers, base airports, insurance information, authorized contacts
• Booking information — passenger names, dates of birth, nationality/passport details where required for international flights, travel itinerary, special requests, payment details, billing address
• Communications — messages sent through the platform, support tickets, survey responses, demo requests
• Marketing preferences and consent records

2.2 Information Collected Automatically

• Device and usage data — IP address, browser type, OS, device identifiers, referring URLs, pages viewed, time spent, clickstream
• Location data — approximate location from IP; precise location only with your permission
• Cookies, pixels, SDKs, and local storage — see Section 12

2.3 Information from Third Parties

• Payment processors (e.g., PayPal and Whop) — transaction confirmation, last four digits of payment cards, fraud signals
• Operators — flight completion data, passenger manifests
• Enrichment and CRM providers — business contact data used to verify operator records
• Government and regulatory sources — FAA Part 135 certificate status and equivalent foreign records, public airworthiness data
• Marketing and analytics partners — campaign performance, audience attributes

2.4 Sensitive / Special Category Data

In limited cases we may process data that GDPR/UK GDPR classifies as special categories (e.g., health information when a traveler requests medical accommodations on a flight) or sensitive personal information under the CCPA (e.g., precise geolocation, government ID for international travel). We process this data only with your explicit consent or where otherwise permitted by law, and only to the extent necessary to deliver the Service.

3. Legal Bases for Processing (EEA, UK, Switzerland, Brazil)

If you are located in the EEA, the UK, Switzerland, or Brazil, we rely on the following legal bases under the GDPR, UK GDPR, FADP, and LGPD:

• Performance of a contract — to create your account, process bookings, manage operator listings, and provide the Services you request.
• Legitimate interests — to operate, secure, and improve the Services; prevent fraud; conduct direct marketing to existing customers; and pursue commercial relationships with operators. We balance these interests against your rights and freedoms.
• Consent — for marketing communications to new prospects, optional cookies, processing of sensitive data, and where otherwise required by law. You can withdraw consent at any time without affecting prior lawful processing.
• Legal obligation — to comply with aviation, tax, anti-money-laundering, sanctions, and other regulatory requirements.
• Vital interests — in rare cases involving safety or medical emergencies during a flight.

For LGPD specifically, additional Brazilian legal bases (e.g., regular exercise of rights in legal proceedings, protection of credit) apply where relevant.

4. How We Use Information

• Operate, maintain, and improve the Services
• Process bookings, payments, and operator payouts
• Verify operator identity, certification, and insurance status
• Communicate with you about bookings, account activity, platform updates, and security alerts
• Send marketing communications (with the ability to opt out at any time)
• Personalize content, search results, and recommendations
• Detect, prevent, and respond to fraud, security incidents, and prohibited activity
• Comply with legal and regulatory obligations, including aviation, tax, sanctions, and AML rules
• Enforce our Terms of Service and other agreements

Automated decision-making. We do not make decisions producing legal or similarly significant effects about you based solely on automated processing. Fraud-detection systems may use automated signals, but a human reviews any consequential outcome.

5. How We Share Information

With Operators. When you book a flight, we share information the operator needs to fulfill the booking — passenger names, contact details, itinerary, special requests, and (for international flights) any required travel-document information. Operators act as independent controllers for their use of this data.

With Travelers. Operator company name, fleet, service area, and other public profile information are visible to travelers browsing the marketplace.

With Service Providers (Processors). We share information with vendors who operate as our processors under written data-processing agreements, including payment processors (PayPal and Whop), hosting/infrastructure (Amazon Web Services and Vercel), customer support, analytics (PostHog and Vercel Analytics), error monitoring (Sentry), email delivery (Mailchimp Transactional), business email (Google Workspace), CRM systems (HubSpot), and identity/fraud verification.

For Legal Reasons. We may disclose information to comply with law, legal process, or government requests; to protect rights, property, or safety; or to investigate fraud or violations.

In Business Transfers. We may transfer information in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to confidentiality protections and notice where required by law.

With Your Consent. For any other purpose with your consent.

No sale of personal information. We do not sell personal information as defined under the CCPA/CPRA or comparable U.S. state laws, and we do not engage in cross-context behavioral advertising without honoring opt-out signals.

6. International Data Transfers

SkyAccess is headquartered in the United States, and personal data we collect is processed in the U.S. and in other countries where our service providers operate. These countries may have data protection laws different from your country of residence.

Transfers from the EEA, UK, and Switzerland. Where we transfer personal data out of the EEA, UK, or Switzerland to a country not deemed to provide an adequate level of protection, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, and the Swiss Addendum to the SCCs. Where applicable, we also rely on the EU-U.S. Data Privacy Framework, UK Extension, and Swiss-U.S. DPF if and when SkyAccess certifies; we will update this section upon certification. You may request a copy of the safeguards we use by emailing privacy@skyaccess.com.

Transfers from Brazil (LGPD). We transfer data outside Brazil only under mechanisms permitted by Article 33 of the LGPD, including specific consent, standard contractual clauses approved by the ANPD, or contractual safeguards.

Transfers from Canada. We comply with PIPEDA and Quebec Law 25 requirements for cross-border transfers, including conducting privacy impact assessments and using contractual measures with our service providers.

Transfers from Australia. Under Australian Privacy Principle 8, we take reasonable steps to ensure overseas recipients handle personal information consistently with the Australian Privacy Principles.

7. Your Rights

7.1 General Rights

Subject to applicable law, you may have the right to:

• Access — request a copy of personal information we hold about you.
• Rectification — correct inaccurate or incomplete information.
• Erasure — request deletion of your data ("right to be forgotten").
• Restriction — limit how we process your data in specific circumstances.
• Portability — receive your data in a structured, machine-readable format and transmit it to another controller.
• Objection — object to processing based on legitimate interests, including direct marketing and profiling.
• Withdraw consent — at any time, without affecting prior lawful processing.
• Not be subject to solely automated decision-making that produces legal or similarly significant effects.
• Lodge a complaint with a supervisory or data protection authority (see Sections 7.2–7.7).

To exercise these rights, email privacy@skyaccess.com. We may verify your identity before responding. We respond within timeframes required by applicable law (e.g., 30 days under GDPR, 45 days under CCPA, 15 days under LGPD).

7.2 EEA, UK, and Swiss Residents (GDPR / UK GDPR / FADP)

You have the rights above. You also have the right to lodge a complaint with your local supervisory authority — for example, the Irish Data Protection Commission, the UK Information Commissioner's Office (ICO), the Swiss Federal Data Protection and Information Commissioner (FDPIC), or the authority in your country of residence. We would, however, appreciate the chance to address your concerns first.

7.3 California Residents (CCPA / CPRA)

You have the right to:

• Know what personal information we collect, use, disclose, and share
• Request a portable copy of your personal information
• Request deletion of your personal information, subject to legal exceptions
• Correct inaccurate personal information
• Limit the use and disclosure of sensitive personal information
• Opt out of "sharing" for cross-context behavioral advertising
• Not be discriminated against for exercising these rights

7.4 Other U.S. State Residents

Residents of Colorado, Connecticut, Virginia, Utah, Oregon, Texas, Montana, and other states with comprehensive privacy laws may have similar rights. Contact us to exercise them.

7.5 Canadian Residents (PIPEDA / Quebec Law 25)

You have rights of access, correction, and withdrawal of consent. Quebec residents additionally have rights to data portability, de-indexation, and information about automated decisions. You may complain to the Office of the Privacy Commissioner of Canada or the Commission d'accès à l'information du Québec.

7.6 Brazilian Residents (LGPD)

You have rights to confirmation of processing, access, correction, anonymization or deletion of unnecessary data, portability, information about sharing, withdrawal of consent, and to file complaints with the Autoridade Nacional de Proteção de Dados (ANPD).

7.7 Australian Residents (Privacy Act)

You have rights of access and correction under the Australian Privacy Principles. You may complain to the Office of the Australian Information Commissioner (OAIC).

8. Payment Information

Payments are processed by third-party payment processors. SkyAccess does not store full payment card numbers. Operators are paid the full asking price for booked flights pre-departure through our payout systems; payout banking information is collected and stored by our payment partners under their own security and compliance programs (including PCI DSS).

9. Data Retention

We retain personal information only for as long as necessary for the purposes set out in this Policy and to comply with our legal, accounting, and reporting obligations. Indicative retention periods:

• Account data — for the life of your account plus up to 6 years after closure to defend legal claims and meet aviation/tax recordkeeping requirements.
• Booking and flight records — up to 7 years to meet aviation, tax, and AML obligations.
• Marketing data — until you withdraw consent or 3 years of inactivity, whichever is sooner.
• Support and communications — 3 years from the date of last interaction.
• Server and security logs — up to 90 days, then deleted.

When we no longer need information, we delete or anonymize it. Where deletion is not technically possible, we securely isolate the data and prevent further processing.

10. Security

We use administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, loss, misuse, and alteration, including encryption in transit, access controls, and vendor due-diligence. No system is fully secure, and we cannot guarantee absolute security.

In the event of a personal data breach affecting you, we will notify you and applicable supervisory authorities as required by law (e.g., within 72 hours under GDPR/UK GDPR, without undue delay under LGPD and other laws). If you believe your account has been compromised, contact us at contact@skyaccess.com.

11. Children's Privacy

The Services are not directed to children under 16, and we do not knowingly collect personal information from children under 16. The U.S. COPPA threshold is 13; the GDPR age of consent ranges from 13 to 16 depending on EU/EEA member state. We apply the higher 16 threshold by default. If you believe a child has provided us with personal information, contact us and we will delete it.

When a traveler books a flight that includes a minor as a passenger, the booking adult is responsible for providing the minor's information and confirming they have authority to do so.

12. Cookies and Tracking Technologies

We and our service providers use cookies, pixels, SDKs, local storage, and similar technologies to operate the Services, remember preferences, measure performance, and support marketing.

You can control and delete cookies through your browser settings; disabling cookies may affect some features. For questions about our use of cookies, email privacy@skyaccess.com.

13. Third-Party Links and Services

The Services may contain links to third-party websites, plugins, or applications, including operator websites and payment portals. SkyAccess is not responsible for the privacy practices of third parties. Please review their privacy policies before providing information.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date and, where appropriate, notify you by email or through the Services. Where required by law, we will obtain renewed consent.

15. Contact Us

If you have questions, concerns, or requests, contact us at:

SkyAccess, Inc.
Attn: Privacy
131 Continental Dr, Suite 305
Newark, DE 19713, USA
Email: privacy@skyaccess.com
Security: contact@skyaccess.com
Website: https://skyaccess.com