Who we are and what this covers
This service is run by Astral Pic ("we"). The operator's legal name and postal address will be published here before the first booking. Astral Pic books an independent, licensed drone pilot for a property or an event in Dallas-Fort Worth, collects the payment, and passes the pilot's share on after the customer approves the files.
This policy covers astralpic.com and the accounts, bookings, pilot applications and dashboards on it. It applies to customers, pilots, course learners and visitors. Stripe, Google and the other companies named below have their own policies for what they do with data they receive directly.
What we collect
Everyone with an account
- Your name if you gave one, your email address, and the kind of account: customer, pilot, or learner (an account made when you open a sign-in link for the free drone license course). Passwords are handled by Google Firebase Authentication; we never see or store your password. Learner accounts start without a password: you sign in with a link we email you.
- For customer and pilot accounts, the version of the terms you accepted and when.
Customers
- The job: the property or venue address, its coordinates, the property type, the package or the description of the job you want quoted, the window of days, notes for the pilot and any access notes you give us (gate codes, dogs, who to call).
- A phone number for the pilot to reach you on the day.
- The attestations you tick at booking (your authority over the property and your role, consent to filming, the weather acknowledgement and the terms), with the time you ticked them.
- For event and wedding quotes: the event date and hours, the venue name, the day-of coordinator's name and phone, whether the flying is indoors or outdoors, whether a crowd is expected, and your notes.
- Payment status for each job (unpaid, reported, confirmed, refunded) and the Stripe session id. Not your card.
- Messages you send your pilot on a job, your approval or change request, your review of the pilot, and whether you ticked the sample consent box.
Pilots
- Your legal name as printed on your Part 107 certificate (kept private), a public first name and last initial, a photo and a short bio.
- Your base address and its coordinates (kept private), a coarse version of that location (the center of a roughly one-kilometer cell), your radius and your metro.
- Your phone number (shared with a customer only after you accept their job).
- The packages you take, whether you take event work, and the over-people category of the aircraft you would fly at events.
- Each aircraft: make, model, FAA registration number, registration expiry, Remote ID method and serial.
- The documents in Pilot documents below, the dates and limits typed from them, and the attestations you tick at submit.
- Your payout account status (set up, invited or ready) and the Stripe account id. Tax identity, bank details and W-9 information are collected by Stripe during its onboarding; Astral Pic never stores them.
- Job history: accepts, declines and their reasons, releases, the flight checklist entries including any airspace authorization reference, uploads, deliveries, and reviews customers leave about you.
Visitors who join a waitlist
- Your email address, whether you are a customer or pilot, the metro, city and state you entered, and which page the form was on.
People who sign up for the free drone license course
- Each time you ask for a sign-in link: your email address, your first name if you give it, whether you ticked the box to hear about pilot work, the page you asked from, whether the email was sent, and the campaign or referrer that first brought you to the site.
- Once you open the link, or open the course page while signed in: a course record tied to your account. It holds your email address and first name, whether your email address is verified, when you enrolled and when you last visited, the campaign or page that first brought you to the site, which of the five parts you started and finished, how far into each part you got and where you stopped, and when you clicked to apply as a pilot.
- We use this to send the link, to remember your progress, to see which pages and campaigns bring people to the course, and, if you ticked the box and then opened the link, to tell you about pilot work with Astral Pic. Astral Pic staff can see it.
- Anyone can type an email address into the form, so you may get a link you did not ask for. If someone else asked for a link with your address, ignore the email. We delete requests nobody confirmed by opening the link after 90 days, or sooner if you ask.
Analytics and your privacy choices
We use Google Analytics 4 on every page. When it is turned on in our configuration we also use PostHog, a product analytics tool. At the time of this policy PostHog is not turned on.
What these tools receive:
- The pages you view and product events such as "booking started", "job booked", "job accepted", "delivery approved" and "course part finished", with properties like the package, the metro, the first three digits of the ZIP code and the price.
- A pseudonymous user id when you are signed in. It is the random id of your account, not your name or email. We also set a few account properties: your role (customer, pilot or learner), your metro, whether a pilot is verified, the month you signed up, and the campaign or referrer that first brought you here.
- Coarse location (city or region) and device type, which the tools derive from your connection.
- Page speed measurements (Core Web Vitals) so we can see when a page is slow.
What these tools never receive from us: your name, email address, phone number or any street address. We do not use advertising features, Google Signals or remarketing, and we do not sell data.
Your choices:
- The Your privacy choices link in the footer of every page opens a sheet with one switch, "Allow analytics". Turning it off stops Google Analytics and PostHog from setting cookies or storing identifiers in your browser, and your choice is remembered in your browser. Google may still receive cookieless pings that are not tied to you (Consent Mode), and PostHog, when it is turned on, may do the same in its cookieless mode.
- If your browser sends the Global Privacy Control signal, we treat it exactly like turning the switch off, and no banner is shown.
- If your device's time zone is in Europe, analytics starts off and a banner asks before anything is stored.
- In the United States and elsewhere analytics is on by default until you turn it off.
Separately from analytics, the campaign or referrer that first brought you to the site is kept in your browser and copied onto any job or quote you book, so we can tell which pages lead to bookings.
Payments
Customers pay through a Stripe payment page or, for quoted jobs and when a payment page is not set up for a package, a Stripe invoice sent by email. Stripe receives your email address and your card details directly. We never see or store the card number. We store only the Stripe session id, the payment method (payment page or invoice) and the status of the payment.
A person at Astral Pic confirms each payment by matching the session id or job id in the Stripe Dashboard. Refunds and cancellation fees are also applied by a person, in Stripe.
Pilots are paid through Stripe to a Stripe Express account that Astral Pic staff set up and invite you to by email. Stripe collects your tax identity and bank details during that onboarding. Astral Pic records only the account id, its status and the transfer reference for each payout.
Addresses and geocoding
When you type a property, venue or base address and press "Find this address", the text you typed is sent to the US Census Bureau Geocoder to find its coordinates. If the Census Geocoder cannot match it, the same text is sent once to OpenStreetMap Nominatim, run by the OpenStreetMap Foundation, together with our contact email as its usage terms require. Each service receives only the address text and your connection details, and each has its own privacy policy. No map tiles are loaded, and we do not send addresses anywhere else.
Pilot documents
To apply, a pilot uploads the front (and optionally the back) of their FAA Part 107 certificate, the completion certificate for the FAA recurrent training or the initial knowledge test report, a certificate of insurance showing the liability limit and expiry, and a photo of the FAA registration label on the aircraft.
These files are stored in Firebase Storage in the United States. They are visible only to the pilot who uploaded them and to Astral Pic staff, who look at them once to verify the application and may look again if something lapses or a question comes up. Staff also search the pilot's legal name in the FAA's public Airmen Inquiry as part of that check. The documents are never shown to customers; customers see only the resulting badges (the month the certificate was checked and the insurance limit and expiry month).
We keep pilot documents for three years after the account closes, then delete them.
Who sees what
Before a pilot accepts
Verified pilots in your metro see the job on their board: the package or job type, the city, state and first three digits of the ZIP code, an approximate location rounded to a roughly one-kilometer cell, the window of days, the property type, your notes for the pilot and the airspace flag. They do not see your exact address, your name or your phone number.
After a pilot accepts
- The customer sees the pilot's first name, last initial, photo, badges and phone number.
- The pilot sees the property address, your access notes, your first name and your phone number.
- Nobody else sees either side's details. Other pilots never see the address, and other customers never see your job.
Public
A verified pilot's card is public: first name and last initial, photo, bio, the area they fly from, their badges, the packages they take, the number of jobs completed, and the number of customer reviews with their average rating. The text of a customer's review is not shown on any page today, but it is stored as a public record, so write it as something anyone could see. A pilot's base address and legal name are never public. A pilot's review of a customer is private to Astral Pic staff.
Astral Pic staff
Staff can read job records, messages between the two parties, pilot documents and payment status in order to verify pilots, confirm payments, pay pilots and sort out problems. Staff do not read messages for any other reason.
Delivery files and sample footage
The photos and video a pilot delivers are uploaded to Firebase Storage and shown on a private delivery page that only the customer, the assigned pilot and Astral Pic staff can open, and only once payment is confirmed.
One caution. Large video files on that page are opened through a link that contains a long-lived access token. Anyone who has the complete link can open that one file without signing in. Do not forward delivery links; download the file and share the file instead. We plan to replace these links with short-lived signed links.
Astral Pic shows a delivery publicly as a sample only when the customer has ticked the consent box at approval. The box is unticked by default. A pilot may show the work in their own portfolio without the address, as the footage license in the customer terms says.
Cookies and browser storage
- Firebase Authentication keeps your sign-in session in your browser's local storage so you stay signed in between visits.
- Your approximate area, so pages can show local details: the site asks Google's servers to estimate your city from your IP address, and keeps only that estimate (rounded to about a kilometre) and the time, in local storage (ap.region), for 7 days. It is not sent to us or to anyone else.
- Google Analytics sets its usual cookies (named "_ga" and similar) only when analytics is allowed. PostHog, when turned on and allowed, stores its own identifier in the same way.
- Our own storage, in your browser only: your analytics choice, the campaign or referrer that first brought you here, a flag that says you have signed in before, your pilot board filter, and a copy of a booking draft while you sign up so you do not lose it.
- While you pay: the id of the job you are paying for, in session storage (ap.payingJob), so your dashboard can mark the payment as reported when Stripe sends you back. Removed when you return from Stripe, or when the tab closes.
- While you sign up: the role you chose, customer or pilot, in session storage (ap.pendingRole), so your account record gets the right role even if sign-up is interrupted. Removed once your account record exists, or when the tab closes.
- When you ask for a course sign-in link: the email address you typed and when (ap.courseEmail), the id of your request (ap.courseSignup) and your first name if you gave one (ap.courseName), in local storage, so this browser can finish signing you in without asking for your email again. The email is removed once you are signed in, and the other two once your course record exists. If the link is not opened in this browser within a day, all three are ignored and removed the next time the course page opens.
- On the course page: whether to play the next part automatically, in local storage (ap.courseAutoNext). Kept until you change it or clear your site data.
- On the pilot board: the ids of the jobs you have already seen, in session storage (ap.offerSeen), so each job is counted as viewed once in analytics. Cleared when the tab closes.
- On the pilot board: whether you turned on "Alert me in this tab when a job appears", in local storage (ap.boardAlert). Kept until you turn it off or clear your site data.
You can clear all of this with your browser's site data controls. Doing so signs you out and resets your analytics choice.
How long we keep data, and deletion
- Account and job records, including messages, reviews and payment status, are kept while your account is open and for as long as we need them to handle payments, refunds, disputes and tax records.
- Pilot documents are kept for three years after the account closes.
- Delivery files stay on the private delivery page with the job record. Download your copies; we do not promise to host them forever.
- Waitlist entries are kept until we launch in that metro or you ask us to remove them.
- Course link requests that nobody confirmed by opening the link are deleted after 90 days. Course records, and the requests that led to them, are kept while we offer the course, or until you ask us to delete them.
- Analytics data in Google Analytics is kept for 14 months.
To delete your account or data, email help@astralpic.com from the address on the account. A person does the deletion by hand and confirms by email. We may keep what the law requires us to keep, such as payment records, and anonymous analytics is not tied back to you.
Where data is stored and who processes it
The service runs on Google Firebase (Authentication, Cloud Firestore, Cloud Storage and Hosting) on Google Cloud servers in the United States. Google processes data on our behalf as our infrastructure provider.
Other companies that receive data, each for the purpose named above: Stripe (payments and pilot payouts), Google Analytics (analytics), PostHog (analytics, only when turned on; US hosting), the US Census Bureau and the OpenStreetMap Foundation (geocoding). We do not sell personal data and we do not share it with advertisers or data brokers.
The site sends three kinds of automatic email: the sign-in link for the free drone license course, the password reset message, and a message that confirms your address after you create an account with a password. We send them from our Google Workspace mailbox, help@astralpic.com. Google receives your email address, your first name if you gave it, and the message, and a copy stays in that mailbox. If that service is not available, Firebase Authentication sends the sign-in link and the password reset message instead. A person at Astral Pic may email you about a job, a payment, a quote or your application, and about pilot work if you ticked that box when you signed up for the course and then opened the link.
Children
The service is not directed at children under 13, and they may not use it. Pilots must hold an FAA Part 107 certificate, which the FAA issues only from age 16.
Your rights
Customers and pilots can see and change most of their details in their dashboard. For anything else, including a copy of the data we hold about you, a correction or a deletion, email help@astralpic.com. We answer within 30 days. Residents of states with privacy laws that grant specific rights can use the same address; we do not sell data or use it for targeted advertising, so there is nothing to opt out of on that front.
Changes
If this policy changes, the new version is posted on this page with a new effective date. If a change matters to how we use data you have already given us, we will tell account holders by email first.
Contact
Questions about this policy: help@astralpic.com.
The operator's legal name and postal address will be published here before the first booking.