Privacy Policy

This Privacy Policy describes how Pointiful (“we”, “us”, or “our”), a company registered in the Netherlands, collects, uses, and protects your personal data when you use the Empty Legs platform, available at emptylegs.pointiful.com and through our mobile application (together, the “Platform”).

Empty Legs is a marketplace that connects On Board Courier (OBC) brokers with freelance couriers for empty leg flights. We are committed to protecting your privacy and processing your personal data in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

1. Data Controller

The data controller responsible for your personal data is:

2. Data We Collect

We collect and process the following categories of personal data:

2.1 Account Information

• Full name
• Email address
• Phone number
• Password (stored in hashed form)
• Account type (broker or courier)
• Company name (for brokers)

2.2 Profile Information

• Profile picture
• Availability status (for couriers)
• Professional experience and qualifications
• Home city, frequent flyer memberships and optional profile notes

2.3 Travel Document Information (Couriers)

• Passport nationalities (country codes only, no passport numbers)
• Visa and travel authorization information (country, type, and expiry date)
• Vaccination records (type and expiry date, for travel-required vaccinations only)

This information is provided voluntarily by couriers to help brokers assess travel eligibility for international routes. We do not store passport numbers, visa numbers, or any government-issued identification numbers. Vaccination information is health data; providing it is optional, and you can remove it from your profile.

2.4 Location Data

• Real-time GPS location (couriers only, when location sharing is enabled)
• Background location data (couriers only, when background tracking is enabled via the mobile app)
• Location precision settings per broker

2.5 Flight Information

• Empty leg flight details (origin, destination, dates, airline, flight number)
• Flight route history

2.6 Technical Data

• IP address
• Browser type and version
• Device information
• Error and crash reports (via Sentry)

3. How We Use Your Data

We use your personal data for the following purposes:

• Providing the Platform: To create and manage your account, authenticate your identity, and deliver the core functionality of connecting brokers with couriers.
• Location Services: To display courier locations to authorized brokers on the real-time map, enabling coordination for empty leg flights.
• Empty Leg Management: To list, display, and manage empty leg flight information between brokers and couriers.
• Travel Eligibility: To display passport nationalities, visa/travel authorization information, and vaccination records to authorized brokers, enabling them to assess courier eligibility for international routes.
• Communication: To send you service-related notifications, including account verification emails, status updates, and important platform announcements.
• Security and Error Monitoring: To detect, prevent, and address technical issues, security incidents, and fraudulent activity.
• Platform Improvement: To understand how the Platform is used and to improve its features and functionality.

4. Legal Basis for Processing

We process your personal data based on the following legal grounds under the GDPR:

• Performance of a contract (Art. 6(1)(b)): Processing necessary to provide the Platform services you have registered for, including account management, flight listing, and broker-courier coordination.
• Consent (Art. 6(1)(a)): For location tracking, particularly background location tracking on mobile devices, and for providing travel document information (passports, visas, vaccinations). You can withdraw consent at any time by disabling location sharing or removing travel document data in the app settings.
• Legitimate interest (Art. 6(1)(f)): For security monitoring, error tracking, and platform improvements, where our interests do not override your fundamental rights.

5. Location Tracking

Location tracking is a core feature of the Empty Legs platform for couriers. It is important that you understand how it works:

5.1 How Location Tracking Works

When couriers enable location sharing, their real-time GPS position is transmitted to our servers and made visible to authorized brokers on the platform map. The mobile app can track location in the background, even when the app is not actively in use, if the courier has granted background location permission.

5.2 Courier Control

Couriers have full control over their location data:

• Location sharing can be turned on or off at any time.
• Location precision can be set per broker: exact location, approximate location (10km radius), or completely hidden.
• Couriers can revoke location permissions from the app or device settings at any time.

5.3 Who Sees Your Location

Your location visibility setting determines whether all brokers or only brokers with an individual grant may see your location. Connected couriers may see it according to your courier-sharing permissions. Your precision settings determine whether an exact or approximate position is shown. Platform administrators may access this data for support.

6. Data Sharing and Third Parties

We do not sell your personal data. We share your data only in the following circumstances:

• Between Brokers and Couriers: Your profile information, availability status, location data, and empty leg information are shared with authorized brokers and couriers as necessary for the Platform to function. The extent of this sharing is controlled by your visibility and permission settings.
• Error Monitoring (Sentry): We use Sentry for error tracking and crash reporting. This may involve sharing technical data and anonymized usage information to diagnose and fix platform issues.
• Android Maps (Google): Android maps use the Google Maps SDK. Google collects IP addresses, device and SDK metadata, a pseudonymous Maps identifier, crash diagnostics and map interactions to operate and improve its services. See Google's Privacy Policy and Maps data disclosure. This technical collection is separate from optional courier GPS sharing.
• Hosting and Infrastructure: Your data is stored on servers located in Europe. Our infrastructure providers process data on our behalf under data processing agreements.
• Legal Requirements: We may disclose your data if required by law, regulation, legal process, or governmental request.

7. Cookies and Tracking Technologies

We do not use cookies for advertising or third-party tracking purposes. The Platform uses only essential authentication tokens stored in your browser to keep you signed in. No third-party analytics cookies are used.

8. Data Security

We take appropriate technical and organizational measures to protect your personal data, including:

• Encrypted data transmission (HTTPS/TLS)
• Hashed password storage
• Access controls and authentication for all platform services
• Server infrastructure located in Europe
• Regular security reviews and updates

While we strive to protect your data, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security.

9. Data Retention

We retain your personal data for as long as your account is active or as needed to provide you with the Platform services. When you delete your account, we will delete or anonymize your personal data within 30 days, unless we are required by law to retain certain information for a longer period.

Location data is retained for the duration of your account. Historical location data that is no longer needed for active services is periodically purged.

Flight data associated with expired empty legs may be retained in anonymized form for platform analytics.

Delete your Empty Legs account or data

In the courier app, open Settings, choose Delete Account and follow the confirmation steps. This removes your account, profile, location history, empty legs and connections. You can also request deletion without the app by emailing message@pointiful.com from your registered email address. Tell us whether you want your entire account deleted or only specific data removed. We verify account ownership before acting. The retention period and any legal exceptions are described above.

10. Your Rights Under GDPR

As a data subject under the GDPR, you have the following rights:

• Right of Access (Art. 15): You have the right to request a copy of the personal data we hold about you.
• Right to Rectification (Art. 16): You have the right to request correction of inaccurate or incomplete personal data. You can update most of your information directly through your account settings.
• Right to Erasure (Art. 17): You have the right to request deletion of your personal data. You can delete your account at any time, which will trigger removal of your data.
• Right to Restriction (Art. 18): You have the right to request that we restrict the processing of your personal data in certain circumstances.
• Right to Data Portability (Art. 20): You have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object (Art. 21): You have the right to object to the processing of your personal data based on legitimate interests.
• Right to Withdraw Consent (Art. 7(3)): Where processing is based on consent (such as location tracking), you can withdraw your consent at any time without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, please contact us at message@pointiful.com. We will respond to your request within 30 days.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or your local supervisory authority.

11. International Data Transfers

Your data is stored on servers located in Europe. We do not routinely transfer personal data outside of the European Economic Area (EEA). In the event that a transfer outside the EEA is necessary (for example, through a third-party service provider), we will ensure appropriate safeguards are in place in accordance with the GDPR, such as Standard Contractual Clauses.

12. Children's Privacy

The Platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will take steps to delete that information promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will notify registered users by email and update the effective date at the top of this page. We encourage you to review this policy periodically.

14. Contact Us

If you have questions about this Privacy Policy, your personal data, or wish to exercise your rights, please contact us: