Privacy Policy

1. Introduction

This Privacy Policy explains how Liam Bell, trading as Empty Leg Scanner (‘we’, ‘us’, ‘our’), operating emptylegscanner.com (‘the Site’), collects, uses, stores, and protects your personal data. We are committed to handling your data lawfully, fairly, and transparently in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We are the data controller for personal data processed through the Site. If you have any questions about this policy or how we handle your data, please contact us at hello@emptylegscanner.com.

2. Who This Policy Applies To

This policy applies to three groups of people who interact with the Site:

• Passengers — individuals who browse the Site, including those who subscribe to flight alert notifications by email. Passengers do not need to create an account.
• Prospective operators — businesses or individuals who submit an expression of interest in listing flights via our partner sign-up page.
• Operators — private jet operators and charter companies who have registered for an account and been approved to list flights on the Site.

Wherever this policy refers to ‘you’, it applies to all groups unless a specific section states otherwise.

3. Data We Collect

3.1 Passengers

If you browse the Site without subscribing to alerts, we do not collect any personal data from you.

If you subscribe to flight alert emails, we collect:

• Your email address
• Your chosen departure or arrival airport (used to match you to relevant flight alerts)
• The date and time of your subscription

3.2 Prospective Operators

If you submit an expression of interest via our partner sign-up page, we collect whatever information you provide in that form, which may include your name, company name, email address, and a description of your operation. This data is used solely to assess your application and contact you about listing on the Site.

3.3 Registered Operators

When you register for an account and create a profile, we collect:

• Your name and the name of your company
• Your country and city of operation
• A company description and website URL
• Your enquiry email address (displayed to passengers on your listings)
• Your Air Operator Certificate (AOC) number and documentation (for eligibility verification)
• Your company registration number and insurance certificate (for compliance purposes)

When you list a flight, we also collect:

• Flight details including departure and arrival airports, date, time, aircraft type, passenger capacity, price, and any photos you upload

3.4 Usage and Analytics Data

We collect aggregated, non-personal usage data to improve the Site, including flight listing view counts and flight enquiry click counts. This data is not linked to individual users and does not identify you personally.

3.5 Data We Do Not Collect

We do not collect or process:

• Payment card or bank account details — the Site does not process payments
• Passenger identity or contact details beyond email addresses for alert subscriptions
• Sensitive personal data as defined under UK GDPR (e.g. health, biometric, or political data)

4. How We Use Your Data

4.1 Passengers

We use your email address and airport preference solely to send you flight alert emails when new matching flights are listed, and to provide a one-click unsubscribe link in every email.

4.2 Prospective Operators

We use the information you submit via the partner page to assess your expression of interest and to contact you about next steps. If your application does not proceed, we will delete your information within 6 months of submission unless you ask us to retain it.

4.3 Registered Operators

We use operator data to:

• Create and display your profile
• Verify your eligibility to list flights
• Display your listings to passengers
• Route passenger enquiries to your nominated email address
• Contact you regarding your account or our service

4.4 All Users

We may also use data to comply with legal obligations, prevent fraud or misuse of the Site, and improve the Site and our services.

5. Legal Basis for Processing

Under UK GDPR, we must identify a lawful basis for processing personal data. Our bases are:

• Consent: For passenger email alert subscriptions and for processing expressions of interest submitted via the partner page. You may withdraw consent at any time.
• Contract performance: For registered operators, once you have accepted our Operator Terms of Service, processing is necessary to perform that agreement.
• Legitimate interests: For aggregated usage analytics and improving the Site, provided this does not override your rights.
• Legal obligation: Where we are required by law to process or retain data.

6. Data Sharing and Third Parties

We do not sell, rent, or share your personal data with third parties for their own marketing purposes. We share data only in the following circumstances:

6.1 Service Providers

6.2 Operator Enquiry Emails

When a passenger clicks the enquiry link on a flight listing, they are directed to contact the operator directly via the operator’s nominated email address. The Site does not transmit passenger contact details to operators; the passenger initiates contact themselves.

6.3 Legal Requirements

We may disclose data where required by law, court order, or in connection with legal proceedings.

7. International Data Transfers

Some of our third-party service providers are based outside the United Kingdom. Where data is transferred outside the UK, we ensure appropriate safeguards are in place, including standard contractual clauses approved by the UK Information Commissioner’s Office. Details of the safeguards applicable to each provider are set out in the table in section 6.1 above.

8. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law:

• Passenger alert subscriptions: Retained until you unsubscribe. Deleted within 30 days of unsubscribing.
• Partner / prospective operator enquiries: Retained for 6 months from submission, then deleted, unless your application progresses to registration.
• Registered operator account data: Retained for the duration of your active account and for no longer than 12 months after account closure, unless a longer period is required by law.
• Flight listings: Retained for 24 months after the flight date, then permanently deleted.
• Terms acceptance records: Retained for 6 years from the date of acceptance.
• Aggregated analytics data: Retained indefinitely in anonymised, non-identifiable form.

9. Data Security and Breach Notification

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. Our site infrastructure is hosted on Cloudflare’s secure edge network, and operator authentication is handled by Clerk, a specialist identity provider.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office within 72 hours of becoming aware of the breach, as required by UK GDPR.

10. Your Rights Under UK GDPR

You have the following rights in relation to your personal data:

• Right of access — to request a copy of the personal data we hold about you
• Right to rectification — to ask us to correct inaccurate or incomplete data
• Right to erasure — to ask us to delete your data in certain circumstances
• Right to restriction — to ask us to restrict processing of your data
• Right to data portability — to receive your data in a structured, machine-readable format
• Right to object — to object to processing based on legitimate interests
• Right to withdraw consent — where we rely on consent, you may withdraw at any time

To exercise any of these rights, please contact us at hello@emptylegscanner.com. We will acknowledge your request within 5 business days and respond in full within one month.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113.

11. Cookies

The Site uses only essential technical cookies necessary for the Site to function correctly. We do not use tracking, advertising, analytics, or profiling cookies.

These cookies are set by Clerk, our authentication provider, and are used only to maintain the login session of registered Operators. Passengers who do not log in will not have these cookies set.

12. Children’s Privacy

The Site is not directed at children under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently received data from a child, please contact us at hello@emptylegscanner.com and we will delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements.

For registered operators, we will notify you of material changes by email at least 14 days before they take effect.

The ‘Last updated’ date at the top of this page will always reflect the current version.

14. Contact Us