AIRCELEO
Get the app
Airceleo respects your privacy. This policy explains what we collect, how we use it, where it goes, and the rights you have over it.
Airceleo ("we," "us," or "our") is committed to protecting the personal information entrusted to us. This Privacy Policy describes how we collect, use, process, disclose, and safeguard information when you access or use the Airceleo platform, including our website, mobile applications, and related services (collectively, the "Platform").
By accessing or using the Platform, you acknowledge and consent to the practices described in this Policy, as permitted under applicable laws, including the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023, and the rules framed thereunder.
If you do not agree with any part of this Policy, please discontinue use of the Platform.
Airceleo operates a technology platform that enables independent users to coordinate the movement of personal items. Airceleo is not a courier, logistics, or transportation provider. We do not take possession, custody, or control of any item at any point in the coordination process.
Airceleo uses Persona Identities, Inc. ("Persona") as our independent identity-verification processor. When you complete KYC, Persona collects and processes the following on Airceleo's behalf:
Where the data lives. Airceleo never sees, stores, or has access to your raw selfie video, raw biometric template, or unredacted identity-document image. Persona stores those artefacts on its own infrastructure (primarily United States data centres) and shares only a verification outcome with us (approved, rejected, or needs-review) together with the redacted fields necessary to populate your account (full name, date of birth, country of issuance).
Retention. Persona retains your KYC submission for the period required to comply with anti-money-laundering, fraud-prevention, and tax laws applicable to Airceleo and to Persona, typically up to seven (7) years after your account is closed. You may request deletion before that statutory period expires, and Persona will delete data not subject to a legal retention obligation. To exercise this right, write to support@airceleo.com or use the in-app deletion control at Settings → Privacy Rights.
Airceleo does not conduct independent criminal background checks. Raw identity documents are not retained on Airceleo's systems beyond what is needed to display your KYC status to you in the app.
We collect information generated through your use of the Platform, including:
Airceleo provides in-app messaging between Senders and Travelers to coordinate their arrangement.
Airceleo does not actively monitor or read user messages in the ordinary course of operating the Platform.
We retain message metadata, including timestamps, sender and recipient identifiers, and delivery status.
You acknowledge that:
We may automatically collect:
Airceleo does not perform real-time tracking of users or items. Limited location information, such as a city or route endpoint, may be voluntarily provided by users to facilitate coordination.
When you list a flight as a traveler, we require you to upload your boarding pass or e-ticket. This is collected solely for our security and compliance check (to confirm the flight is genuine and that you are actually travelling the route you have listed) and to auto-fill your itinerary (route, dates, airline, and flight number) so you do not have to re-type it.
Your boarding pass is transmitted over an encrypted connection and stored in a private, access-controlled bucket. It is never shown to other users, never sold, and never shared with third parties except where strictly required to verify your trip or comply with the law. A boarding pass on its own cannot be used to travel or impersonate you. Airlines match the pass against government-issued photo ID and your passport at the gate, so a copy held by us carries no boarding privilege.
We extract only the structured itinerary fields needed for your listing. You may replace the document at any time before submitting, and it is deleted in accordance with our retention schedule (Section 7) once it is no longer needed for the security check or any related dispute window.
To protect your account against unauthorised access, our systems monitor failed sign-in attempts. Where a number of failed attempts are made against your account within a short period, we temporarily lock the account and send a security-alert email to the address on file, informing you of the attempts and providing a link to reset your password.
So that you can assess whether the activity was your own, that email states the time of the attempts and an approximate location (typically a city, region, and country) derived from the Internet Protocol (IP) address from which the attempts originated. To obtain this approximate location, we transmit only the IP address to an independent IP-geolocation service (ipwho.is); we do not transmit your name, email address, account identifier, or any other personal information, and the lookup is performed solely in connection with such a security event. The location returned is approximate and is provided to you for informational purposes only.
We carry out this processing in reliance on our legitimate interest in safeguarding the security of your account and the Platform (Article 6(1)(f) of the General Data Protection Regulation and equivalent provisions of other applicable data-protection laws, including Section 7 of the Digital Personal Data Protection Act, 2023). Because the geolocation service receives a single, transient technical data point and no account identifiers, it is not provided with information that would enable it to identify you.
We use the information we collect to:
We use cookies and similar technologies to:
You may manage cookies through your browser or device settings.
Airceleo does not sell or rent personal information. We share information only in the following circumstances:
Named third-party processors. The following providers receive personal information from Airceleo for the limited purposes described, and operate from the indicated regions:
Limited security disclosure (IP geolocation). Separately from the processors listed above, and solely to generate the approximate-location information described in Section 2.8, we transmit the Internet Protocol (IP) address associated with anomalous login activity to an independent IP-geolocation service (ipwho.is). This disclosure is confined to the IP address: no name, email address, account identifier, or other personal information is shared, and the service is not given any information that would allow it to associate the IP address with you. Given that only a single, non-identifying technical data point is shared, for a security purpose, this disclosure is made in reliance on the data-minimisation and legitimate-interest principles described in this Policy rather than under a dedicated data-processing agreement.
Cross-border transfers. Where personal data of EEA / UK / Swiss residents, or of Indian Data Principals, is transferred outside their region of residence, Airceleo and the relevant processor rely on Standard Contractual Clauses or other lawful transfer mechanisms permitted under the applicable law.
We implement reasonable technical, physical, and organizational safeguards designed to protect personal information against unauthorized access, disclosure, alteration, or destruction.
No system can be guaranteed fully secure. You are responsible for maintaining the confidentiality of your account credentials and for promptly notifying us of any suspected unauthorized access to your account.
Data breach notification. In the event of a personal data breach that is likely to result in risk to your rights, Airceleo will notify the Data Protection Board of India and affected Indian Data Principals without undue delay, as required under the Digital Personal Data Protection Act, 2023. Where US state law requires notification to affected residents, Airceleo will provide notice in accordance with the statutory timeline applicable to your state of residence.
We retain personal information for as long as:
Certain information may be retained after account closure where required by applicable law or regulation.
Approximate retention periods by data category:
Account deletion and the 30-day recovery window. When you request deletion, we lock your account immediately, sign you out on every device, and stop showing your profile and listings to other members. For the following 30 days we keep your information intact so that you can change your mind: signing back in and choosing “Restore my account” cancels the deletion and returns your account exactly as it was, including your profile, verification status and history. This window exists to protect you against an accidental deletion, and against someone deleting your account without your permission. During those 30 days your email address and handle remain reserved for you, which means they cannot be used to open a new account until the window closes. If you take no action, your personal information is permanently erased at the end of the 30 days and that step cannot be reversed by you or by us.
Erasure sooner than 30 days. The recovery window is offered for your benefit, not as a condition of exercising your rights. If you want your personal information erased without waiting for it, write to support@airceleo.com and we will action the erasure directly, subject only to the categories we are legally required to retain (for example financial transaction records, and identity-verification data held by Persona under anti-money-laundering law).
Third-party processor retention. When you delete your account, we erase or anonymise the personal information under our control. However, certain third-party processors retain personal information under their own legal, regulatory, and anti-money-laundering obligations, independently of our deletion process: (i) Persona retains your identity-verification (KYC) data as described in Section 2; (ii) Stripe and Razorpay retain payment and payout transaction records as required by financial and AML regulations; and (iii) Resend may retain transactional-email delivery records. Deleting your Airceleo account does not force these providers to delete data they are legally required to keep. You may contact each provider directly to request deletion of their retained records, which they may decline where a legal-retention obligation applies.
Subject to applicable law, you have the following rights with respect to your personal information. You can exercise most rights directly in the app at Settings → Privacy Rights, or by contacting us at the address in Section 14.
If you are located in the EEA, the United Kingdom, or Switzerland, you also have the right to:
Lawful bases on which we process your data include: performance of the contract between you and Airceleo (Article 6(1)(b)); compliance with legal obligations such as anti-money-laundering and identity verification laws (Article 6(1)(c)); your consent for optional processing such as analytics (Article 6(1)(a)); and our legitimate interests in operating, securing, and improving the Platform (Article 6(1)(f)). Where we process special-category data such as identity-document images during KYC, we rely on your explicit consent (Article 9(2)(a)).
Cross-border transfers: where personal data of EEA / UK / Swiss residents is transferred outside those regions, we rely on Standard Contractual Clauses or other lawful transfer mechanisms with our processors.
California residents have the following rights under the CCPA/CPRA. Residents of other US states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Texas, and Utah) have substantively equivalent rights under applicable state law, which Airceleo will honour upon request:
You may designate an authorized agent to make a request on your behalf. We may verify the agent's authority before responding.
As a Data Principal under the Digital Personal Data Protection Act, 2023, you have the right to:
The Airceleo Platform facilitates real-money transactions between Senders and Travelers. Airceleo itself is not a bank, money transmitter, payment system operator, or escrow agent.
All payment processing, fund custody, and payout settlement is performed by licensed third-party payment service providers:
Airceleo does not collect, store, or have access to your full payment-card number, CVV, or banking credentials. Card data is captured directly by the payment processor through their PCI-DSS compliant tokenization environment. Airceleo retains only a transaction reference and the last four digits of the instrument used.
Funds collected from Senders are held by the payment processor and released to Travelers in accordance with the Refund Policy and Terms and Conditions, after delivery confirmation. Airceleo never takes possession of user funds in its own bank account.
The Platform may contain links to websites or services operated by third parties, including Persona Identities Inc. (identity verification), Stripe, Inc., Razorpay Software Private Limited, Supabase, Inc. (cloud infrastructure), PostHog Inc. (analytics, where consented), and Functional Software, Inc. d/b/a Sentry (crash reporting). Airceleo is not responsible for the privacy practices of such third parties. We encourage you to review their privacy policies before providing any personal information.
Airceleo uses Sentry to capture application crashes and unhandled errors. This is a non-marketing, security-and-reliability use of personal data and Airceleo relies on its legitimate interest under the General Data Protection Regulation (GDPR) Article 6(1)(f), the Digital Personal Data Protection Act, 2023 (Section 7(b), for Indian Data Principals where applicable), and equivalent provisions of other regional data-protection laws. We do not sell, rent, or share crash data for advertising.
Right to object. You may object to crash and error reporting at any time. To exercise this right, write to support@airceleo.com from the email associated with your account; we will disable crash reporting for your installation within five (5) business days. California residents may make the same request under the CCPA right to limit the use of personal information.
Analytics. Where Airceleo enables product analytics, processing relies on consent collected at first launch and is revocable at any time by writing to support@airceleo.com from the email associated with your account. Analytics are never used for cross-app tracking, and Airceleo does not request the iOS App Tracking Transparency permission.
We may update this Privacy Policy from time to time. Material changes will be communicated through the Platform. Your continued use of the Platform after the effective date of an update constitutes acceptance of the revised Policy.
The Platform is not intended for, and may not be used by, persons under the age of 18. We require date-of-birth at signup and a Government-issued ID at KYC. Accounts identified as belonging to a minor will be terminated and any associated personal information will be deleted, except where retention is required by law.
Airceleo (operated as a sole proprietorship pending company registration)
General privacy inquiries: support@airceleo.com
To exercise the rights described in Section 8, write to support@airceleo.com or use Settings → Privacy Rights in the app. We acknowledge requests within 48 hours and aim to resolve them within 15 days; in any event we will respond no later than 30 days, or such shorter period as required by applicable law.
Grievance Officer (in accordance with Rule 5(9) of the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011, and Section 8 of the Digital Personal Data Protection Act, 2023):
For users in the European Economic Area: until Airceleo appoints a representative under Article 27 GDPR, EEA users may direct GDPR-related inquiries to the email addresses above and we will respond within applicable statutory timelines.
End of Privacy Policy
Access, correction, deletion, or anything else, our support team is one email away.