Privacy policy

This policy explains what personal data AviationMasters (“we”, “us”) processes when you use our website and apps (learning modules, the pilot logbook, the CV, the crew circle and the jobs board), why, and what rights you have.

Who is responsible for your data

The controller of your personal data under the EU General Data Protection Regulation (GDPR) is:

• AviationMasters
• Contact: hello@aviationmasters.com

We have not appointed a Data Protection Officer; contact us at hello@aviationmasters.com.

1. Data we process

• Account and sign-in. Your email address, name and profile picture. If you sign in with Google, Google shares your name, email address and profile picture with us (scopes “openid”, “email”, “profile”); we never receive your Google password and never post anything for you. If you sign in with an email link, we send a one-time link to your address.
• Profile and learning. Your display name, settings, learning progress, quiz attempts, XP and badges.
• Logbook. The flights you enter or import (dates, times, places, aircraft types and registrations, functions, totals, remarks, names of other crew you choose to record), files you attach, imports from airline flight records, spreadsheets, PDFs or photos of paper logbooks, and signatures. When you ask someone to sign an entry, we process their name and the signature they give through the link you send them.
• Pilot CV. The information you put in your CV, including an optional photo and contact details. The photo is stored privately; contact details are hidden unless you choose to show them. A CV is only visible to others through a share link you create, and you can revoke it.
• Medical class (optional). You can add your medical class and the validity date of your medical certificate to your CV. This is data concerning health. We only process it if you give your explicit consent when you add it (see section 2), and it is shown only through CV share links you create.
• Crew circle. If you and another pilot both opt in, each of you sees the other's name and aggregated activity (delayed by 24 hours). You can block or remove people, and export or erase your circle data.
• Jobs. The jobs you save and your job alerts. Job adverts come from public sources; we remove recruiters' names and personal contact details from them.
• Technical data. IP address, browser and device information, and server logs needed to run and secure the service (for example rate limiting and error reports).

2. Why we use it (legal bases)

• To provide the service you asked for: your account, logbook, CV, crew circle and saved jobs (contract, Art. 6(1)(b) GDPR).
• To keep the service secure, prevent abuse and fix errors (legitimate interests, Art. 6(1)(f)).
• People recorded in a logbook. The names of other crew members you record, and the name and signature of anyone who signs an entry, are processed on the basis of legitimate interests (Art. 6(1)(f)): yours and ours in keeping an accurate pilot logbook. The signing page includes a link to this policy, so anyone asked to sign is told who we are and how we handle their data (Art. 14). We do not contact other crew members whose names a user records and do not have their contact details; this policy is publicly available for them. Anyone recorded in a logbook can object or exercise their rights by emailing hello@aviationmasters.com.
• Optional features you switch on, such as sharing your CV or joining the crew circle (consent, Art. 6(1)(a)). You can withdraw consent at any time in the app.
• Medical class and certificate validity in your CV: only with your explicit consent (Art. 9(2)(a)). You can withdraw it at any time by removing the field from your CV or by emailing hello@aviationmasters.com; we then delete that data. Withdrawing consent does not affect processing that took place before.
• To meet legal obligations, where they apply (Art. 6(1)(c)).

• Statistics and advertising cookies: only with your consent (Art. 6(1)(a) GDPR and Portuguese Law 41/2004, Art. 5), for personalised and non-personalised ads alike. Without consent, Google Analytics is not loaded and only limited ads may be shown, without cookies (see section 5).

We do not sell your personal data. Health data (your medical class and certificate validity), your logbook and anything in the signed-in area are never used for advertising and are never shared with advertising partners.

3. Scanning paper logbook pages

When you scan a paper logbook page, the photo is first read on your device. If cloud reading is enabled, which the scan page tells you, the photo (reduced to about 2000 pixels) is sent to Google Cloud Vision through its European endpoint (eu-vision.googleapis.com), so it is processed in the European Union, to recognise the handwriting. It is processed in memory only: we do not store the photo, and only the recognised text comes back to your device for you to review before anything is saved.

4. Who processes data

• Hostinger: web hosting and database, as our processor (servers in the European Union).
• Google Cloud Vision: reading scanned logbook photos when cloud reading is enabled. Google acts as our processor, and the photos are processed through the European endpoint (eu-vision.googleapis.com), in the European Union.
• Email provider: when email sign-in is enabled, an email provider sends the sign-in links for us, as our processor.
• Forward Email (Forward Email LLC, United States): forwards messages sent to hello@aviationmasters.com to our support mailbox, as our processor. Messages pass through its servers in the United States.
• Google (Gmail): hosts the mailbox where we receive and answer support messages, so the content of your messages and your email address are stored with Google, including outside the European Economic Area.
• Google Analytics (Google Ireland Limited): statistics, only with your consent, as our processor under Google's data processing terms (see section 5).
• Google advertising (Google AdSense): when we show ads, Google acts as an independent controller for that advertising (see section 5).
• Paddle (Paddle.com Market Limited): sells our paid plans as Merchant of Record and processes payment data as an independent controller (see "Payments and Paddle" below).
• Google Sign-In: if you choose “Sign in with Google”, Google acts as an independent controller, not as our processor. Its processing is governed by its own privacy policy (https://policies.google.com/privacy). We only receive the data listed in section 1.

Our processors act only on our instructions under data processing terms (Art. 28 GDPR). Where a provider processes data outside the European Economic Area (Forward Email and Google in the United States), the transfer relies on the EU–US Data Privacy Framework, where the provider is certified, or on the European Commission's Standard Contractual Clauses (Art. 46 GDPR). You can ask us for a copy of the relevant safeguards at hello@aviationmasters.com. Paddle is established in the United Kingdom, which benefits from an EU adequacy decision; as an independent controller, Paddle may also transfer payment data to other countries outside the EEA, including the United States, and is responsible for safeguarding those transfers (see "Payments and Paddle").

Payments and Paddle

Our paid plans are sold by Paddle.com Market Limited ("Paddle"), which acts as our Merchant of Record. When you start a free trial or subscribe, you enter your payment details directly with Paddle; we never see or store your full card details.

Paddle processes your name, email address, billing country and address, payment details, tax information (such as a VAT number, if you give one), transaction history and fraud-prevention data as an independent controller, to process payments, collect tax, issue invoices, handle refunds and chargebacks, prevent fraud and meet its legal obligations. Paddle's own privacy notice applies: https://www.paddle.com/legal/privacy.

Paddle sends us the information we need to manage your subscription (for example your email address, plan, country, subscription status, and the dates and amounts of charges). We use it to give you access to the paid features, send trial and renewal reminders, provide support and keep accounting and tax records. Legal bases: performance of the contract (Art. 6(1)(b) GDPR) and legal obligations (Art. 6(1)(c) GDPR). We keep billing records for 10 years, as required by Portuguese tax and accounting law.

Paddle may transfer data outside the EEA (including to the United Kingdom, which has an EU adequacy decision, and to the United States). Paddle is responsible for safeguarding those transfers.

5. Cookies, analytics and advertising

Necessary. Without asking for consent, we only use what is strictly necessary to provide the service you ask for: cookies to keep you signed in (session), to protect forms (CSRF) and to remember your cookie choice, and preferences you choose, such as the theme, stored in your browser.

Statistics. With your consent, we use Google Analytics 4 (Google Ireland Limited) to count visits and see which pages are useful. It sets the cookies _ga and _ga_<id>. Until you consent, the Google Analytics script is not loaded at all and Google receives nothing from us. If you withdraw consent, we delete these cookies. Where Google processes data in the United States, the safeguards in section 4 apply (EU–US Data Privacy Framework).

Advertising. We may show advertising served by Google (Google AdSense) on public pages. For that advertising Google acts as an independent controller. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the Internet. You can read how Google uses data from sites that use its services at https://policies.google.com/technologies/partner-sites. You can opt out of personalised advertising in Google's Ads Settings at https://adssettings.google.com, and opt out of some third-party vendors' use of cookies for personalised advertising at https://www.aboutads.info or https://www.youronlinechoices.eu.

Advertising, personalised or not, only uses cookies or similar technologies with your consent. Without your consent, only limited ads may be shown, without cookies or other local storage. Advertising cookies last at most 13 months.

Your choice. The banner offers Accept all, Reject all and Customize with equal weight. You can change or withdraw your choice at any time through “Cookie settings” in the footer of every page; withdrawing does not affect processing that took place before. We ask again after 12 months or when the cookies we use change. Our Cookie Policy (/cookies) lists every cookie with its provider, purpose and duration (Portuguese Law 41/2004, Art. 5).

6. How long we keep data

• Account, profile, logbook, CV, crew circle and saved jobs: for as long as you keep your account. A pilot logbook is a long-term record, so we keep it until you delete it or your account. Names and signatures of other people are part of the logbook entries they relate to and are kept for as long as those entries.
• Medical class and certificate validity: until you remove them, withdraw your consent or delete your account.
• Scanned photos: not stored. Recognised text is only kept if you import it.
• Server logs and security records: up to 90 days, unless needed to investigate a specific incident.
• After you delete your account, we erase your data within 30 days, except where the law requires us to keep it.
• Backups are overwritten on a rolling cycle; deleted data disappears from them within [35] days.

7. Your rights

You have the right to:

• access your data;
• correct (rectify) it;
• have it erased;
• restrict its processing;
• object to its processing, in particular where we rely on legitimate interests;
• receive it in a portable format (portability);
• withdraw your consent at any time, without affecting processing that took place before.

You can export your logbook (CSV and a full backup file) and your data from the app (Settings, and Logbook → Export). To delete your account or exercise any other right, email hello@aviationmasters.com. We answer within one month; for complex or numerous requests this can be extended by up to two further months, in which case we will tell you why within the first month.

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).

You can also complain to a data protection authority. In Portugal this is the Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt; you can also contact the authority of the country where you live or work.

8. Security

Connections are encrypted (HTTPS), access to data is limited to your account, and secrets are kept out of the code. Please report security issues to security@aviationmasters.com (see also security.txt).

9. Children

We do not ask for your age when you sign in. Under 13s may use the service only with a parent's or guardian's authorisation, as set out in our Terms (Portuguese Law 58/2019, Art. 16). Advertising personalisation signals are only sent if you tick Marketing in Cookie settings, which confirms that you are 18 or older; otherwise any ads are non-personalised. If we learn that an account is used without the required authorisation, we may delete it.

10. Changes

We will update this page when our processing changes and show the date above. Material changes will be announced in the app or by email. See also our Terms of use.