This policy explains how EMPTY LEGS (“we”, “us”) handles personal data on www.emptyleg.flights and related pages. It is written for visitors in the United Kingdom, the European Union, the United States and elsewhere. It is not legal advice. If we incorporate or appoint a data protection contact with a postal address, we will add those details here.
Who is responsible
The controller of personal data collected through this website is the operator of EMPTY LEGS. For privacy requests, use the contact form and mark the message as a privacy request. We reply by email.
What we collect
Depending on how you use the site, we may process:
- Enquiries. Name, email address and message if you use the contact form. Those submissions are sent to our server so we can reply. They may also appear in hosting logs.
- Search and booking clicks. Airports, dates, passenger counts and similar filters you enter, and which listing you open. Booking is completed on a partner site after a redirect from this site.
- Alerts. If you create a route alert we store your email address and the from/to you entered, send a confirmation email, and then send notices when a new matching empty leg appears. We keep that until you unsubscribe or we delete stale alerts.
- Technical data. IP address, browser type, device, pages viewed, referring URL and timestamps. Our host (Vercel) and, if you accept analytics cookies, Google Analytics collect some of this automatically.
We do not ask for payment card details. We do not create user accounts. We do not take booking payment on this site.
Why we use it
We use personal data to:
- reply to enquiries and partner or inventory questions;
- send empty-leg alerts you asked for, after you confirm the email;
- run search and send you to the partner who holds a listed empty leg;
- pass a live-quote request and contact details to Villiers when you use Ask;
- keep the site secure and diagnose faults;
- understand, in aggregate, how the site is used (analytics);
- comply with law if we are required to.
Under UK GDPR and EU GDPR, the usual bases are: taking steps at your request (an enquiry or a route alert); consent for those alert emails; our legitimate interests in operating a search site, preventing abuse and measuring traffic; and consent where the law requires it for non-essential cookies. In the United States we use the same information for those business purposes.
Cookies and similar technology
The site can work without optional analytics cookies. If you accept them, we use Google Analytics 4 (measurement ID G-W0QPZWN7YY) to see which pages are used. That service sets cookies and similar identifiers on your device and may collect IP address, device and usage data. We ask IP anonymisation to be enabled on that tag.
In the UK and EEA, analytics cookies need your consent before they are set. Use Accept or Reject on the banner. We store that choice in your browser (local storage) so we do not ask on every visit. You can also block third-party cookies in your browser. Clearing site data will show the banner again.
Strictly necessary storage may be used for security, hosting and remembering your cookie choice.
Who we share data with
- Hosting. The site is hosted on Vercel. Request data (including IP address) is processed in Vercel’s infrastructure, which may be in the United States and other regions.
- Analytics. Google Ireland Limited / Google LLC, if Analytics runs in your browser.
- Alerts infrastructure. Route alerts are stored in Neon (Postgres, United States) and emails are sent with Resend. Unsubscribe removes that alert.
- Inventory partners. Listings currently come from Villiers and Avi-Go. When you choose Book via Partner, you leave this site. That partner’s privacy notice then applies to anything you give them, including a booking.
- Professional advisers and authorities if the law requires it, or to protect our rights.
We do not sell your personal information for money. Redirects to partners and the use of Google Analytics can involve sharing or “sale/share” of identifiers under some US state laws (including California). If you are a California resident and want to opt out of that sharing, contact us as above and we will treat it as a request to limit analytics and partner tracking from our side as far as we reasonably can.
International transfers
We are oriented to the United Kingdom. Some processors (including Vercel, Neon, Resend and Google) are in, or can access data from, the United States and other countries. Where UK or EU law applies, those transfers rely on the provider’s published safeguards (such as standard contractual clauses) and their terms.
How long we keep it
Contact messages are kept only as long as needed to handle the enquiry and any follow-up, then deleted from our mailbox and logs when no longer required — typically within 24 months unless a dispute or legal duty needs a longer hold. Route alerts are kept until you unsubscribe. Hosting and analytics retention follows those providers’ settings. Search is not stored as a user profile.
Your rights
If UK GDPR or EU GDPR applies to you, you can ask us for access, correction, erasure, restriction, objection, or a copy of data you provided (portability), and you can withdraw consent where we rely on it. You can complain to the ICO in the UK (ico.org.uk) or your local EU supervisory authority.
If a US state privacy law applies (for example California, Virginia, Colorado, Connecticut, Utah and others), you may have rights to know, delete, correct, and opt out of sale or sharing of personal information and certain targeted advertising. We will not discriminate against you for exercising those rights. We do not knowingly sell the personal information of minors.
To use these rights, write via the contact form. We may need to confirm it is you before we act.
Children
This site is for adults arranging private aviation. We do not knowingly collect data from children. If you believe we have, contact us and we will delete it.
Android app
If you install the Android wrapper for this site, the same policy applies to browsing emptyleg.flights inside that app. App stores may show additional platform permissions. We do not use the app to collect extra categories of data beyond what the website already processes.
Changes
We will update this page when the product or the law changes. The date at the top is the latest version. Material changes will be reflected here; we do not email a mailing list today.
Related
How you may use the site is in our Terms of Use. Commercial relationships with partners are in our Affiliate Disclosure.