PRIVACY
POLICY

Aerodeo Ltd ("Aerodeo", "we", "us", "our") operates the Aerodeo mobile application and the website aerodeo.com. We are registered in England and Wales. Our registered address is 1 Airport Business Park, London, EC1A 1BB. We are the data controller for personal information collected through our services. If you have any questions about this policy, please contact us at privacy@aerodeo.com.

We collect information you provide directly to us, including: Account information: Name, email address, phone number and password when you register. Travel information: Flight details, passport information (stored encrypted), frequent flyer numbers, seat preferences and travel history — used solely to deliver the Aerodeo service. Payment information: Billing details for paid subscriptions, processed securely by our payment provider Stripe. We do not store full card numbers. Device and usage data: IP address, device type, browser, operating system and in-app usage patterns to improve our service and detect abuse. Location data: With your permission, approximate location to time taxis and calculate journey durations. You can disable location at any time in device settings. AirTag and tracker data: Bag location data from connected trackers. This data is processed in real time and not retained beyond your journey.

We use your information to: — Deliver the Aerodeo service: book taxis and transfers, track bags, manage check-ins, surface boarding passes and coordinate hotel arrivals. — Send you journey alerts, delay notifications and service updates directly relevant to your active travel. — Process payments and manage your subscription. — Provide customer support and respond to your enquiries. — Improve and develop our product based on usage patterns (always anonymised in aggregate). — Comply with legal obligations, including fraud prevention and tax reporting. We do not sell your personal data to third parties. We do not share your data with advertisers.

We share data only where necessary to operate the service: Service providers: Taxi and transfer operators receive your name, pickup address and flight details to fulfil your booking. Restaurant partners receive your order and gate number. Lounge operators receive your name and booking reference. Payment processors: Stripe processes all payments under their own privacy policy and PCI-DSS compliance. Technology partners: Cloud infrastructure (AWS), analytics (anonymised only) and customer support tooling operate under strict data processing agreements. Legal requirements: We may disclose data if required by law, court order or to protect the safety of our users. We require all third parties to maintain appropriate security and to use data only for the specified purpose.

Aerodeo operates globally. Your data may be transferred to and processed in countries outside the UK and European Economic Area (EEA). Where this occurs, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the UK Information Commissioner's Office (ICO) or the European Commission.

We retain your personal data for as long as your account is active or as needed to provide the service. Journey data (bag tracking, taxi records, food orders) is retained for 12 months for reference and dispute resolution, after which it is deleted or anonymised. You can request deletion of your account and associated data at any time by contacting privacy@aerodeo.com. We will complete this within 30 days.

Under UK GDPR and the Data Protection Act 2018, you have the right to: — Access a copy of the personal data we hold about you. — Correct inaccurate or incomplete information. — Request deletion of your personal data ("right to be forgotten"). — Object to processing based on legitimate interests. — Restrict how we use your data in certain circumstances. — Data portability: receive your data in a machine-readable format. — Withdraw consent at any time (where processing is based on consent). To exercise any of these rights, contact us at privacy@aerodeo.com. We will respond within 30 days. You also have the right to lodge a complaint with the ICO at ico.org.uk.

We take data security seriously. We use TLS encryption in transit, AES-256 encryption at rest for sensitive data (passport details, payment tokens), regular penetration testing and access controls that limit employee access to personal data to only those who need it. No system is completely secure. If you suspect your account has been compromised, contact us immediately at security@aerodeo.com.

Our website uses cookies to remember your preferences, analyse traffic (using anonymised data) and maintain your session. You can manage cookie preferences through our cookie banner or your browser settings. Rejecting non-essential cookies will not affect the core Aerodeo service.

Aerodeo is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with data, please contact us at privacy@aerodeo.com and we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or in-app notification at least 14 days before they take effect. The current version is always available at aerodeo.com/privacy.

For any privacy-related questions or to exercise your rights: Email: privacy@aerodeo.com Post: Data Protection Officer, Aerodeo Ltd, 1 Airport Business Park, London, EC1A 1BB We aim to respond to all privacy enquiries within 5 working days.