Draft — to be reviewed. This text hasn't been reviewed by a lawyer yet. Words in [BRACKETS] are still to be filled in.
Draft of 18 October 2026.
1. Who is responsible
[COMPANY LEGAL NAME], [REGISTERED ADDRESS], decides how personal data in AeroSync is used (the “controller”). Questions or requests: [CONTACT EMAIL].
2. What we store, and why
- Your account: username, password (stored only as a one-way hash, never readable), email address if you add one, your language and display settings, alert settings and the addresses alerts go to. Why: to run your account, sign you in (including sign-in links and password resets) and send the alerts you switch on. Basis: our contract with you.
- Aircraft and maintenance records: aircraft details and images, hours, maintenance tasks and their completions, logbook entries, airworthiness directives, parts, the files you upload, and who you share aircraft with. Why: this is the service. Basis: contract.
- CloudBase connection: your CloudBase username and password (the password encrypted), and the flight data we fetch with them (dates, times, flight durations, hours), kept so pages load quickly. Why: to keep your hours and flights up to date automatically. Your login is only ever used for your own account. Basis: contract.
- Billing: if you subscribe, Stripe handles your card; we keep only Stripe's customer and subscription references and your plan status. Basis: contract.
- Technical records: reports of errors (page address, browser type, your username and what went wrong) so we can fix problems; your IP address, stored only in scrambled (hashed) form and for at most an hour, to slow down repeated sign-in, sign-up and password-reset attempts; the country of your IP address, looked up in a database kept on our server (IP Geolocation by DB-IP) only to choose the language you start in, without storing the address or sending it anywhere; web server logs for [LOG RETENTION]. Basis: our legitimate interest in keeping AeroSync secure and working.
We don't sell personal data, don't use it for advertising and don't share it with anyone except the providers below or where the law requires it.
3. Who handles data for us
- Hosting: [HOSTING PROVIDER AND LOCATION] — the servers that store AeroSync's data and files.
- Stripe — payments, if you subscribe. Stripe's own privacy policy covers your card details.
- [EMAIL PROVIDER] — sends sign-in links, password resets and alerts.
- CloudBase (CloudBaseGA) — the source of your flight data. When you connect it, we send your CloudBase login to CloudBase to fetch your data.
- jsDelivr — pages load the date-picker from jsDelivr's network, which, like any website, sees your IP address and browser.
- Google — only if you use “Leave feedback”, which opens a Google Form; what you type there goes to Google.
[INTERNATIONAL TRANSFERS: where any provider stores data outside the UK/EEA, say where and which safeguards apply.]
4. How long we keep it
- Your data is kept while you have an account.
- When you delete your account, we delete straight away your account, settings, CloudBase login, and the aircraft only you own together with their records and files. On aircraft you share with others, your access is removed; records you made there stay in that aircraft's history for its other owners, as maintenance records must.
- Backups are overwritten within 14 days.
- Error reports are kept until the problem is fixed and at most [ERROR REPORT RETENTION]; those linked to your account are deleted with it.
- Stripe keeps billing records for as long as tax law requires.
5. Your rights
- See and take a copy of your data: Settings > Account > Download my data (JSON and CSV files plus your uploads).
- Correct it: edit it in AeroSync, or ask us.
- Delete it: Settings > Account > Delete my account.
- Object to or ask us to restrict how we use it: write to [CONTACT EMAIL]. We answer within one month.
- Complain to a data protection authority — in the UK the Information Commissioner's Office (ico.org.uk), in Bulgaria the Commission for Personal Data Protection (cpdp.bg), or the authority where you live.
6. Cookies and browser storage
AeroSync uses only what it needs to work:
- a session cookie that keeps you signed in (it ends after 4 hours),
- a security (CSRF) cookie that protects forms,
- a language cookie that remembers the language you picked with the flags, for a year.
Your browser also keeps your layout preferences (such as the sidebar width), recently fetched flight data so pages load faster, and which notices you closed until you sign out. There are no analytics, advertising or tracking cookies, so there is no cookie banner.
7. Security
Connections use HTTPS. Passwords are hashed, CloudBase passwords are encrypted, and uploaded files are only shown to people with access to that aircraft.
8. Children
AeroSync isn't meant for anyone under 16.
9. Changes
We will update this page when anything changes and tell you about important changes by email or in AeroSync.