Privacy Policy

Last updated 16 October 2026

This policy explains how OMOX Ltd(“flyWilco”, “we”, “us”) collects and uses personal data when you use our website, the flyWilco booking application and the flyWilco mobile app for iPhone, iPad and Android (together, the “Service”). We are the data controller for the personal data described below, in accordance with the UK GDPR and the Data Protection Act 2018.

1. The data we collect

• Account & organisation data: your name, email, phone number, the name of your school or group, and your home aerodrome.
• Member & booking data you enter: details of your members, aircraft and bookings. Where you add other people’s information, you are responsible for having a lawful basis to do so.
• Payment data: handled by Stripe. We do not store card numbers; we hold a Stripe customer/subscription identifier and your plan status.
• Technical & usage data: IP address, device/browser information and basic interaction data, used to keep the Service secure and working.
• Mobile app data: if you use the flyWilco app, a notification token for your device (only if you turn notifications on), so we can send you booking updates. Your sign-in is kept encrypted on your device, and your display settings (such as dark or light appearance) are stored only on your device.
• Pilot records. If you choose to keep one (or a school keeps one for you), your licence type, issuing authority and number; the class and expiry date of your medical certificate; your ratings and their expiry dates; and up to two emergency contacts (name, relationship and phone). We do not store any medical conditions, limitations or other health information.

2. How and why we use it

We use pilot records to remind you before your medical certificate or ratings expire, to show the owners, admins and instructors of the schools that can see your record whether they are current, and to let those schools reach your emergency contacts if something goes wrong. We do this on the basis of your school’s legitimate interest in confirming that you are legally able to fly and that its insurance is valid, in sending you expiry reminders, and in being able to contact someone for you in an emergency. This applies both to details you enter yourself and to details a school enters for you.

Your record is visible only to you and to the schools you choose to share it with (when you first save it, it is shared with the school you are using at the time), plus a school that set up your account and created the record for you. You can stop sharing it with any school at any time.

• To provide the Service and your account (legal basis: performance of a contract).
• To take payment for paid plans (contract; legal obligation for tax records).
• To send transactional emails: confirmations, invitations, password resets, booking and renewal notices (contract / legitimate interests).
• To send push notifications to the mobile app about your bookings (approved, declined, changed or cancelled) and expiry reminders, only if you turn notifications on. You can turn them off at any time in the app or in your device settings (contract / legitimate interests).
• To keep the Service secure, prevent abuse and improve it (legitimate interests).
• With your consent, to measure website usage via analytics (Google Analytics) and to measure our adverts via the Meta (Facebook) pixel.

3. Sub-processors we share data with

We use a small number of trusted providers to run the Service:

• Supabase: database, authentication and hosting (UK, London region).
• Stripe: payment processing.
• Mailgun: sending transactional email.
• Cloudflare: security, DNS and content delivery.
• Expo (650 Industries, Inc.): builds and updates the mobile app and delivers its push notifications. Notifications are passed to Apple (Apple Push Notification service) or Google (Firebase Cloud Messaging) for delivery to your device.
• NOAA / Aviation Weather Center: weather data (no personal data is sent).

On our website only, and only if you accept cookies: Google (Tag Manager and Analytics) receives information about how you use the site, and Meta Platforms Ireland Ltd receives information that you visited it, through the Meta pixel. Meta uses this as a separate controller under its own privacy policy.

The mobile app contains no advertising, no analytics and no tracking. It does not use your device’s advertising identifier or share your data with data brokers.

We do not sell your personal data.

4. Where your data is stored

Your application data is stored in the UK (London region). Some providers (e.g. Stripe, Mailgun, Cloudflare) may process limited data outside the UK, for example in the EU or US, under appropriate safeguards such as the UK International Data Transfer Agreement or Standard Contractual Clauses with the UK Addendum.

5. Cookies

We use strictly necessary cookies to keep you signed in and secure. If you consent, we also use analytics and the Meta pixel (via a tag manager) to understand how the site is used and to measure our adverts. You can change your choice any time from the cookie settings link in the footer, or control cookies through your browser.

6. Retention

We keep your data for as long as your account is active. You can delete members (and their data) at any time, and we delete or anonymise account data within a reasonable period after you close your account, except where we must keep records (e.g. for tax).

Your pilot record is kept while you have an account or remain a member of a school. It is deleted when your account is deleted, or, for a record your school created before you had a login, when you are removed from every school.

7. Deleting your account

You can delete your flyWilco account yourself at any time:

• In the mobile app: Account → Delete my account.
• On the web: sign in at app.flywilco.app/account and choose Delete my account.
• By email: write to support@flywilco.app from the address on your account and we will do it for you.

For your security you confirm with your password. Deletion takes effect straight away and cannot be undone:

• Your login, your pilot record (including emergency contacts) and your devices’ notification tokens are deleted.
• Your name, email and phone number are removed from every school you belong to, and your upcoming bookings and trips are cancelled.
• Your schools keep their record of your past flights for their own operating and safety records, shown as “Former member” with no contact details.

If you own a school on flyWilco, transfer ownership to someone else first, or contact us, before deleting your account.

8. Your rights

Under UK GDPR you have the right to access, correct, delete, restrict or object to the processing of your personal data, and to data portability. To exercise any of these, contact us at support@flywilco.app. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk).

You can view and correct your pilot record, and change which schools can see it, at any time from your account page or the mobile app. Deleting your account deletes your pilot record (see Deleting your account); to have only a record your school created removed, ask your school or contact us.

9. Children

The Service is not directed at children under 16, and we do not knowingly collect their data.

10. Changes

We may update this policy from time to time; the “last updated” date above shows when. Material changes will be notified in the app or by email.

11. Contact

Questions or data requests: support@flywilco.app · OMOX Ltd, 124 City Road, London, EC1V 2NX.