Privacy Policy

Last updated 13 October 2026.

The Aviation Hub is run by James Field, trading as The Aviation Hub, from the United Kingdom. We are the data controller for the personal information described here. You can reach us at james.field@theaviationhub.co.uk.

This policy explains what we collect when you read the site, buy something, post a job, buy or sell photos, or write to us; why we collect it; who we share it with; how long we keep it; and the rights you have under the UK GDPR and the Data Protection Act 2018.

1. Reading the site

Server logs. Our hosting provider, Fasthosts, records the IP address, browser type, pages requested and time of each visit in its web server logs. We use these to keep the site running and secure and to investigate abuse. Logs are kept for up to 90 days. Lawful basis: our legitimate interest in running a secure website.

Analytics. We use Google Analytics, through Google Site Kit, to understand which pages are read and how people arrive. Google sets cookies for this and processes the data in the United States under its standard contractual clauses. We do not use analytics data to identify you. Lawful basis: your consent, given through the cookie banner; you can withdraw it there at any time.

Advertising. We show adverts through Google AdSense. With your consent, Google and its certified advertising partners use cookies and similar technologies to show adverts based on your interests and to measure them; without consent, adverts are shown without personalisation. Google’s use of advertising data is described at policies.google.com/technologies/ads, and you can control personalised advertising at adssettings.google.com. Lawful basis: consent.

Comments. If you leave a comment we store the name, email address and website you give, the comment, and your IP address, which helps us detect spam. Your name and comment are shown publicly; the email address is not. If you tick “save my details”, a cookie remembers them for a year. Lawful basis: our legitimate interest in running a comment section and preventing spam.

Embedded content. Articles may embed content from other sites, such as flight tracking maps, videos or social media posts. Those sites may collect data about you and set their own cookies, exactly as if you had visited them directly.

2. The newsletter

Our newsletter is published on Substack. When you subscribe, your email address is held by Substack under its own privacy policy, and you can unsubscribe from any issue with one click. We see the list of subscriber addresses and use it only to send the newsletter.

3. Buying from the shop

When you buy a digital product from our shop, payment is taken by Stripe. Stripe collects your card details directly; we never see them. Stripe sends us your name, email address, the product bought, the amount, and the last four digits of the card, and we keep an order record with those details so that we can deliver the file, send a receipt, answer questions about the order and meet our accounting obligations. Download links are sent to the email address you give and recorded against the order, including the time and IP address of each download, which lets us help if a link fails and protects against sharing. Stripe’s own use of your data is described at stripe.com/gb/privacy. Lawful basis: performance of the contract with you, and our legal obligation to keep accounting records.

Ad-free membership is paid through PayPal Subscriptions. PayPal handles your payment details under its own privacy statement; we keep your name, email address and subscription status so that we can switch adverts off for you and tell you about the membership.

4. The jobs board

If you post a job, we collect the company name, contact name and email address, the listing text and payment through Stripe as above. The listing itself is public for the period paid for. We keep the contact details for the life of the listing and for our accounting records afterwards. Lawful basis: performance of the contract and our legal obligations.

5. The photo library: buyers

When you buy a photo licence, a pack of credits or a plan, Stripe handles payment as in section 3 and tells us your name, email address and what you bought. We keep a record of every licence sold, every credit used and every download (photo, date, your account) because the photographers are paid from those records and a licence may need to be verified later. We issue an invoice for each purchase and keep it for our accounting records.

Sign-in to the library is by a link we email to you; we do not store a password. When you use the link we set a cookie called ahp_session that keeps you signed in on that browser for 30 days. It holds only an account number and a signature, not your email address. We also record the time of your last sign-in.

If you add colleagues to a Newsroom plan, we store their email addresses and send them a sign-in link. If you leave an email address to be told when a photo of something arrives, we store the address and the search term, send one confirmation email, and then at most one message when a matching photo goes on sale; every message carries a one-click removal link.

Lawful basis: performance of the contract, our legal obligation to keep accounting records, and our legitimate interest in paying photographers accurately and preventing misuse of licences.

6. The photo library: contributors

If you send us photos, we collect your name, email address, the name you want to be credited under, where each photo was taken from, and the photo files with their details. When you accept the Photo Contributor Agreement we record the date and time, your IP address, your browser identifier and the version of the agreement you accepted, because that record is the evidence of the agreement.

Photo files are stored in a private folder on our server that is not reachable from the web. Before any copy leaves that folder we remove embedded GPS location data from the file; other camera data such as the date and camera model is kept. A watermarked, reduced copy is shown publicly with your credit name.

To help us review submissions we may send a reduced copy of a photo, together with the details you gave, to Anthropic’s Claude AI service, which returns a suggested caption and a note of anything a reviewer should check. Anthropic processes that request under its privacy policy and does not use it to train its models. Every decision to publish or decline a photo is made by a person.

Bank details you enter in the contributor portal are stored encrypted and are visible only to the owner of The Aviation Hub, for the purpose of paying you. We email you whenever they are added or changed. Your monthly statements and payment history are kept for six years for tax purposes.

If a photo is declined, the file is deleted; the record of the submission and the agreement acceptance is kept. If you withdraw from the library, your photos come off sale, licences already sold stand, and the sales records that support payments to you are kept for six years.

Lawful basis: performance of the contributor agreement, our legal obligation to keep accounting and tax records, and our legitimate interest in proving what was agreed and in keeping the library free of infringing material.

7. Writing to us

If you email us or use a contact form, we keep the message and your details for as long as we need them to deal with your enquiry and for up to two years afterwards in case it comes up again. Lawful basis: our legitimate interest in answering you.

8. Who we share data with

We share personal data only with the companies that help us run the site, and only as far as their job needs: Fasthosts (hosting and email), Stripe and PayPal (payments), Google (analytics and advertising, with your consent), Substack (newsletter), Anthropic (photo review suggestions, as above), and our accountant for tax records. Each acts under a contract or published terms that restrict what they may do with the data. We do not sell personal data to anyone.

Some of these providers process data outside the UK, chiefly in the United States. Where they do, transfers rely on the UK’s International Data Transfer Agreement or the UK extension to the EU–US Data Privacy Framework, as set out in each provider’s terms.

We will disclose personal data where the law requires it, for example to HMRC or in response to a court order, and to pursue or defend a legal claim, including a claim about the rights in a photo.

9. How long we keep things

Order, invoice, licence, download and payment records: six years after the transaction, as HMRC requires. Contributor agreement records: six years after the contributor’s last photo leaves the library. Photo files: for as long as the photo is in the library, then deleted unless a licence dispute is open. Comments: until you ask us to remove them. Server logs: up to 90 days. Photo alert addresses: until the alert is sent or you remove it. Contact emails: up to two years.

10. Your rights

You can ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, object to our processing of it, ask us to restrict processing, and ask for a copy in a portable form. Where we rely on consent you can withdraw it at any time. Email james.field@theaviationhub.co.uk; we reply within one month. Some records, such as invoices and licence records, we have to keep even if you ask for deletion, and we will tell you which.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

11. Cookies

Cookies we set ourselves: WordPress sign-in and comment cookies (only if you log in or comment); ahp_session for the photo library (only if you sign in there); and a cookie that remembers your cookie choices. Cookies set with your consent by Google for analytics and advertising are listed and controllable in the cookie banner, which you can reopen from the link in the footer. You can also block cookies in your browser; the site works without them, except that you cannot stay signed in.

12. Children

The site is for adults. We do not knowingly collect data from anyone under 16, and photo contributors must be 18 or over. If you believe a child has given us data, email us and we will delete it.

13. Changes

We update this policy when the site changes. The date at the top shows the current version; material changes are announced on the site.