Draft for review. This text is written for Aeroledger and should be checked by a legal adviser before launch.
This policy covers aeroledger.eu, the Aeroledger logbook, GliderTrack and the Logbook Binder. Aeroledger is the controller of your personal data under the EU General Data Protection Regulation (GDPR). For GliderTrack, your club decides who is on its member list. For that list the club is the controller and we process the data on its behalf.
What we collect
| Data | Why | Legal basis |
|---|---|---|
| Name, email, password (stored only as a salted hash), country, optional phone and address | To run your account and sign you in | Contract |
| Flights, simulator sessions, aircraft, licences, medicals, ratings and currencies you enter | That is the logbook: totals, exports and reminders | Contract |
| Medical certificate class and expiry | Expiry reminders. This can be health-related data, so it is up to you whether you enter it | Your explicit consent (you can remove it any time) |
| Instructor sign-offs and club links | To share a flight with the instructor or club you chose | Contract |
| Payment and invoice details (Pro) | Billing and our tax records | Contract and legal obligation |
| Contact form and Report / Request messages | To answer you and improve the product | Legitimate interest |
| Technical logs (IP address, time, page requested) | Security, abuse prevention, fixing errors | Legitimate interest |
What we do not do
- We do not sell or rent your data, and we do not show advertising.
- We use no tracking or analytics cookies. The site uses one session cookie to keep you signed in and stores your theme and currency choice in your own browser.
- We never read your logbook for any purpose other than running the service, unless you ask us to help you with it.
Who else sees your data
- People you choose: an instructor you send a flight to for sign-off, and clubs you approve under Connections.
- Service providers: our hosting provider in the EU, Cloudflare (network protection and bot checks), our email provider and, for Pro, our payment provider. Each works under a data processing agreement and only on our instructions.
- Authorities: only where the law requires it.
Your data is stored in the European Union. Where a provider may process data outside the EU, we rely on the EU standard contractual clauses or an adequacy decision.
How long we keep it
See the data retention page. In short: as long as your account exists, and then it is deleted, except what the law requires us to keep.
Your rights
You can see, correct, export and delete your data. Most of it you can do yourself in the logbook (Settings › Import/Export and Settings › Options › Profile). You may also object to processing based on legitimate interest, withdraw consent, and ask us to restrict processing. Use the contact form (topic “Privacy / my data”). We answer within one month. You may also complain to the data protection authority in your own country.
Security
Connections are encrypted (HTTPS), passwords are stored as salted hashes, sessions expire after inactivity and backups are kept for a limited time only. If a breach puts your data at risk, we will tell you and the authority as the law requires.
Children
Young glider pilots fly solo from 14 in many countries. If you are under 16, ask a parent or guardian to agree to your account.
Changes
When this policy changes in a way that matters, we tell you by email or in the logbook before the change takes effect.