Airdeck Log — data protection declaration

1. Contact addresses

Responsible for processing of personal data:

Data protection representation in the European Economic Area (EEA)

Airdeck does not currently maintain an establishment in the EEA. If and when processing of personal data of individuals in the EEA reaches a scale that triggers Art. 27 GDPR, we will appoint a representative and update this declaration.

2. Processing of personal data

2.1 Definitions

Personal data means all information relating to an identified or identifiable natural person. A data subject is a natural person whose personal data is processed.

Processing means any handling of personal data — storage, disclosure, acquisition, collection, erasure, alteration, destruction and use.

2.2 Legal bases

We process personal data in compliance with Swiss data protection law, in particular the Federal Act on Data Protection (nFADP). We generally store personal data in the European Union (EU — Frankfurt) via our managed-database provider.

If and insofar as the General Data Protection Regulation (GDPR) is applicable, we process personal data according to at least one of the following legal bases:

• Art. 6(1)(b) GDPR — necessary to perform a contract with you (operating Airdeck Log).
• Art. 6(1)(f) GDPR — our legitimate interests in providing the service in a user-friendly, secure and reliable manner, including protection against misuse and the exercise of our own legal claims.
• Art. 6(1)(c) GDPR — compliance with a legal obligation, in particular retention obligations applicable to digital pilot logbooks under aviation regulations (FOCA/BAZL, EASA, FLC.050).
• Art. 6(1)(a) GDPR — on the basis of your consent, for example optional communications.

2.3 Type, extent and purpose

We process the personal data that is necessary to operate Airdeck Log and to meet the regulatory obligations attached to a digital pilot logbook. Depending on how you use the product, the data may fall into the following categories:

• Account and contact data: name, email address, phone number (optional), country, locale preference, display name, authentication identifiers.
• Browser and device data: IP address, user-agent, referrer, access status, timestamps — in server log files (see §5.2).
• Pilot logbook data: flight entries (date, aircraft registration, from/to airports, block times, flight times, landings, pilot function, remarks), the aircraft types you have logged, your pilot licence and rating details insofar as you record them for yourself.
• Content data: free-text remarks on flights, attached files (e.g. a scanned proficiency check).
• Signatures on your own flights: when a flight is signed off (by you or by an instructor you fly with), the signatory’s name, licence number and the timestamp are captured on the flight record and retained as an immutable snapshot.
• Meta and usage data: timestamps, actor identifiers for audit-trail metadata.

Airdeck Log does not collect location data from trackers, aircraft or your device. Flights are entered by you (or imported from another system you authorise); the product has no GPS or geolocation feature.

We process personal data for the period required for the relevant purpose(s) or required by law. Signed logbook entries follow the applicable retention periods under aviation regulations. Account data is retained for as long as the account exists; on request, account data is erased subject to any overriding regulatory retention obligations.

2.4 Processing of personal data by third parties, also abroad

We can have personal data processed by contracted third parties, or process it with their help, as well as transmit it to them. Such third parties are, in particular, the service providers listed in §7. Where we use such providers, we ensure an adequate level of data protection — typically by selecting providers located in Switzerland or the EEA, or by using providers covered by an adequacy decision of the Swiss FDPIC and — if the GDPR applies — the European Commission, or on the basis of EU Standard Contractual Clauses.

3. Your rights

3.1 Data protection claims

You have the following rights under applicable data protection law:

• Information: request confirmation of whether we process personal data about you and, if so, what — including the purpose, retention duration, disclosures and sources.
• Correction and limitation: have inaccurate personal data corrected, incomplete data completed, and the processing of your data restricted.
• Deletion and objection: have personal data deleted and object to the processing of your data with effect for the future.
• Portability: receive your personal data in a structured, commonly used, machine-readable format. Airdeck Log makes this available directly to you via the built-in CSV / PDF exports.

We may suspend, restrict or refuse the exercise of these rights to the extent permitted by law. In particular, we may refuse to delete personal data that we are required to retain under aviation regulations (signed logbook entries).

3.2 Right to complain

You have the right to enforce your data protection claims through legal channels or to lodge a complaint with a competent data protection supervisory authority. The authority for private data controllers in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC). If and to the extent the GDPR applies, you may also lodge a complaint with a competent European data protection supervisory authority.

4. Data security

We take appropriate technical and organisational measures to ensure data protection and data security. These include transport encryption (SSL/TLS, via HTTPS) for all traffic; access controls at the application and database layer; signed and immutable audit snapshots on logbook entries; daily encrypted backups and point-in-time recovery of our managed database. Despite these measures, no system is absolutely secure, and we cannot guarantee absolute data security.

5. Use of the website and the iOS app

5.1 Cookies and local storage

We use the smallest set of cookies and comparable local storage necessary to run Airdeck Log. We do not use advertising or tracking cookies.

• Authentication cookies (strictly necessary) — set by our authentication provider to keep you signed in. Removing them signs you out.
• Preference storage — a small number of UI preferences (theme, last-used filters) stored in your browser’s localStorage / sessionStorage.

We do not currently use third-party analytics, advertising or marketing cookies. If we add any in the future, we will update this declaration and ask for consent via a cookie banner.

5.2 Server log files

Each time you use Airdeck Log we may log the following information insofar as your browser or app transmits it: date and time including time zone; IP address; HTTP status code; user-agent (operating system, browser and version); the pages or endpoints that were accessed including the transmitted data volume; and the referring page. This information is necessary to provide the service reliably and to detect and investigate security issues.

6. Notifications and messages

We send transactional notifications by email — for example a verification email when you register, a password-reset link when you request one, or a confirmation when you export your logbook. These notifications are necessary for the operation of the service.

We do not currently operate a marketing newsletter; if we introduce one, it will use a double-opt-in consent flow and provide a one-click unsubscribe link.

6.1 Service provider for notifications and messages

Transactional email is relayed via Register.it (Register.it S.p.A., Italy — authenticated SMTP at authsmtp.register.it), acting as a data processor for us. The message body, subject and recipient address are shared with the provider for the sole purpose of delivering the message. Register.it is located in the European Union; no additional transfer safeguards are required.

7. Third-party services

We use services provided by specialised third parties in order to run Airdeck Log durably, securely and reliably.

7.1 Digital infrastructure

• Vercel — application hosting and content delivery network. Provider: Vercel Inc. (USA), with request routing optimised for the user’s region. Transfers outside the EEA are covered by Vercel’s GDPR data processing addendum and EU Standard Contractual Clauses. See Vercel privacy policy.
• Supabase — managed PostgreSQL database, authentication, and object storage. Provider: Supabase Inc. (USA), operating infrastructure in the EU (Frankfurt region). Your account data and logbook entries are stored on this infrastructure. See Supabase privacy policy.
• Register.it — domain and transactional email relay for airdeck.ch addresses. Provider: Register.it S.p.A. (Italy). See Register.it privacy information.

8. Concluding provisions

We may adjust or supplement this data protection declaration at any time. We will provide notification of such adjustments in an appropriate form — in particular by publishing the updated declaration on this page.