This is a translation provided for convenience. The Spanish text is the governing version.
FlyIn Guatemala ("FlyIn", "we") is operated by Offset Works, based in Guatemala. This Privacy Policy describes how we collect, use, share and protect your personal information when you use our website, app and helicopter flight services. By using our services you accept the practices described here and our Terms and Conditions.
1. Information we collect
Account data
Full name, email address and phone number, provided when you register or make a booking.
Booking and flight data
Body weight, dietary preferences, emergency contact (name and phone), DPI (Guatemalan national identity document) or other identity document, booking history, flight records and route GPS data.
Payment data
Bank transfer references and payment status (deposit and balance). We do not store credit card numbers or complete financial details.
Technical data
IP address, browser type, operating system and pages visited, collected automatically to maintain security and improve the service.
2. How we use your information
- To process, confirm and manage your flight bookings.
- To contact you by email or WhatsApp about your flights.
- To prepare flight manifests and the documentation the aviation authorities require (see section 3).
- To meet legal and regulatory obligations.
- To improve our services, operational safety and user experience.
- To manage your account balance and empty leg credits.
3. Disclosure to aviation authorities (DGAC)
Guatemalan aviation regulation requires air operators to file flight manifests with the Dirección General de Aeronáutica Civil (DGAC) for every operation. This includes passenger names, weight, identity documents and emergency contacts. This disclosure is a mandatory legal requirement and does not require additional consent. Data contained in flight manifests is retained in accordance with DGAC regulations (minimum 5 years).
4. Third parties and external services
We use the following providers to run our services. We do not sell your personal data to third parties.
| Provider | Purpose | Data processed |
|---|---|---|
| MongoDB Atlas | Database | All account and booking data |
| Vercel | Hosting and CDN | Technical browsing data |
| Resend | Transactional email | Email, name, message content |
| Stash / Aeter (Arweave) | Permanent document storage | Uploaded documents (invoices, receipts, flight photos) |
Note: documents stored on Arweave through Stash/Aeter are permanent and immutable by design of the network. They cannot be deleted once uploaded.
5. Cookies and local storage
We use only essential cookies and local storage, for the service to work:
- Session JWT token: an httpOnly cookie that authenticates your session. It expires when you sign out or after a period of inactivity.
- Consent preferences: local storage that remembers your acceptance of this cookie policy.
We do not use tracking cookies, third-party analytics or personalised advertising.
6. Data retention
| Type of data | Retention period |
|---|---|
| Account data (email, name, phone) | While the account is active + 90 days after deletion |
| Flight records and manifests (DGAC) | Minimum 5 years, per Guatemalan aviation regulation |
| Documents on Arweave (Stash/Aeter) | Permanent (immutable by design of the network) |
| Payment data (bank references) | 5 years, per tax and accounting obligations |
7. Your rights
You can exercise the following rights by emailing us at privacy@offsetworks.xyz:
- Access: request a copy of your personal data.
- Rectification: correct inaccurate or incomplete data.
- Erasure: request deletion of your account and associated data, subject to the legal retention obligations described in section 6.
- Portability: receive your data in a structured, machine-readable format.
We will respond to your request within a maximum of 30 calendar days.
8. Minimum age
Our services are intended exclusively for people over 18, in line with aviation regulatory requirements. We do not knowingly collect data from anyone under 18. If we discover that we have collected a minor’s data, we will delete it immediately.
9. Security
We put technical and organisational security measures in place to protect your data, including:
- HTTPS (TLS) encryption on all communications.
- Passwords stored as cryptographic hashes (never in plain text).
- Role-based access control for administrative data.
- JWT tokens with automatic expiry for user sessions.
No system is 100% secure. If we detect a security breach affecting your data, we will notify you as soon as possible.
10. Changes to this policy
We may update this Privacy Policy from time to time. We will publish the updated version on this page with the date it was last updated. For material changes, we will notify you by email or through a notice on the platform.
11. Contact
For any question about this Privacy Policy or how your personal data is handled:
This Privacy Policy complements our Terms and Conditions, whose version in effect you can consult at any time. Where the two documents conflict on personal data, this Privacy Policy prevails.