Privacy Policy

Hearing Software S.L. (CIF B93374585), Calle Alejandro Dumas 17 - Oficinas, 29004 Málaga, Spain, is the data controller for personal data processed through the Pilot Sanchez Service.

Privacy contact: contacto@byhs.eu

This Privacy Policy explains how we process personal data when you use the Pilot Sanchez websites, web apps (Portal, Briefing, Planner), and the mobile companion app, in accordance with Regulation (EU) 2016/679 (GDPR) and the Spanish Organic Law 3/2018 on personal data protection (LOPDGDD).

It does not apply to third-party websites or services you access via links from our Service.

Depending on how you use the Service, we may process:

• Account data: email address, name, username, password (stored hashed), email verification status, terms and privacy acceptance records, preferred language.
• Organization and fleet data: school or club membership, roles, aircraft registrations you manage, hangar and maintenance records, consumption logs, access requests, and operational policies you configure.
• Planning and briefing data: routes, airports, performance and weight-and-balance inputs, METAR/TAF selections, documents you generate or upload in Briefing or Planner.
• Flight tracking data: GPS tracks and telemetry recorded when you start a recording in the mobile app, imported GPX/KML/CSV files, live position points during an active session, flight analysis results, and optional AI debrief text.
• Device and security data: mobile API tokens, device identifiers needed for push delivery, session cookies on the web, IP address and server logs for security and abuse prevention.
• Communications: messages you send via contact forms and support requests.
• Usage analytics and diagnostics: aggregated events via Umami (configured without advertising cookies on our domains); in production, Google Analytics 4 (uses cookies) to measure traffic and feature usage; error and performance monitoring via Sentry when enabled.

We process personal data for the following purposes and legal bases under GDPR:

• Providing the Service, maintaining your account, and performing our contract with you (Art. 6(1)(b) GDPR).
• Email verification, password reset, transactional notifications, and push messages you enable (Art. 6(1)(b) and, where applicable, Art. 6(1)(f) for security).
• GPS flight recording and background location only while you actively start and run a recording in the mobile app (Art. 6(1)(b); location is not collected for advertising).
• Flight analysis and optional AI debrief features that process track summaries and prompts you request (Art. 6(1)(b)).
• Compliance with legal obligations, including responding to authorities when required (Art. 6(1)(c)).
• Legitimate interests in securing the platform, preventing abuse, improving reliability, and defending legal claims, balanced against your rights (Art. 6(1)(f)).
• Umami analytics without advertising cookies to understand aggregate usage (Art. 6(1)(f)).
• Google Analytics 4 in production to measure audience and product usage, including cookies (Art. 6(1)(f), balanced against your rights; you may limit cookies in your browser).
• Sentry error and performance monitoring to keep the Service reliable and secure (Art. 6(1)(f)).
• Google reCAPTCHA on the contact form to prevent spam and abuse (Art. 6(1)(f)).

We use carefully selected providers that process personal data on our instructions and under data processing agreements where required. They do not use your data for their own marketing. Main categories:

• Hosting and infrastructure: OVHcloud (European Union data centres) for servers, databases, object storage, and backups.
• Email delivery: our SMTP provider for verification, password reset, and operational messages.
• Push notifications: Google Firebase Cloud Messaging (and Apple Push Notification service via your device) to deliver notifications you opt into.
• AI flight analysis: OpenAI (when you use AI debrief or similar features) as processor for the prompts and track summaries we send under your request.
• Web analytics (cookieless): Umami for aggregated usage metrics on our domains without advertising cookies.
• Web analytics (cookies): Google Analytics 4 (Google Ireland Limited / Google LLC) in production when configured, to measure visits and interactions using cookies and similar technologies.
• Error and performance monitoring: Sentry (Functional Software, Inc.) for crash reports, traces, and related diagnostic data when enabled.
• Contact form protection: Google reCAPTCHA (Google) to verify that contact submissions are made by humans and to prevent abuse.
• Maps and aeronautical data providers: basemap and catalog services configured in the product (requests may include viewport or airport identifiers, not your identity for advertising).

We primarily host and process personal data in the European Union (OVH). Some processors are established in the United States or otherwise outside the EEA, including Google (Firebase Cloud Messaging, Google Analytics 4, and reCAPTCHA), Sentry, and OpenAI. Where personal data is transferred outside the EEA, we implement appropriate safeguards under GDPR Chapter V, such as the European Commission Standard Contractual Clauses and supplementary technical and organisational measures, and we rely on the EU-US Data Privacy Framework certification where the provider participates and the transfer meets its conditions.

We keep personal data only as long as necessary for the purposes above:

Account data is retained while your account is active. After account deletion, we delete or anonymize personal data within a reasonable period, except where we must retain certain records for legal, security, or billing obligations.

Flight tracks and analysis outputs are retained until you delete them or delete your account, subject to backup rotation described below.

Server logs and security records are kept for limited periods aligned with incident investigation needs.

We apply technical and organizational measures appropriate to the risk, including encryption in transit (HTTPS/TLS), access controls, and separation of environments.

Regular backups are stored on infrastructure operated by our hosting provider in the EU. Backups are used for disaster recovery and are rotated; deleted account data will age out of backups according to our backup schedule.

Umami: we use Umami on our websites for privacy-oriented, aggregated analytics. Our production configuration is intended to avoid advertising cookies and cross-site tracking on pilotsanchez.com and related subdomains.

Google Analytics 4: in production we enable Google Analytics (measurement ID configured via NEXT_PUBLIC_GA_MEASUREMENT_ID) to understand how visitors use the Service. GA uses cookies (for example _ga) and similar technologies. You can limit or delete cookies through your browser settings or tools such as the Google Analytics opt-out browser add-on where available.

Sentry: when configured, Sentry collects error and performance data (for example stack traces, request context, and browser metadata) to diagnose failures and improve stability. See section 5 for the provider role.

Google reCAPTCHA: the public contact form uses reCAPTCHA, which may set cookies and process interaction data to prevent automated abuse.

The mobile app records precise location only when you explicitly start a flight recording. Background location is used solely to continue that recording while the app is in the background, and stops when you end the session. We do not sell location data or use it for advertising profiles.

If you enable push notifications, we store a device token and send messages related to the Service (for example operational or account-related notices you configure). You can disable notifications in device settings.

When you request an AI debrief or similar feature, we send relevant flight summaries and your prompts to OpenAI as our processor to generate text for you. Do not include personal data of third parties you are not authorized to share. You can avoid AI features if you prefer not to have track summaries processed this way.

Under GDPR and LOPDGDD you may exercise the following rights, subject to legal limits: access, rectification, erasure, restriction, portability, objection, and withdrawal of consent where processing is consent-based.

To exercise rights, email contacto@byhs.eu from the address linked to your account. We may need to verify your identity.

You may lodge a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es

You can delete your account from the mobile app or from account settings on the Portal. Deletion removes or anonymizes personal data associated with your account, except data we must retain by law or in encrypted backups for a limited time.

Organization-owned operational records created in a school or fleet context may remain under the organization's control where another user is the data controller for fleet operations; contact your organization administrator if you need clarification.

The Service is not directed at children under 16. We do not knowingly collect data from children under 16. If you believe we have done so, contact us to request deletion.

We may update this Privacy Policy. The version and last updated date appear at the top. Material changes will be communicated where appropriate. Continued use after the effective date constitutes notice of the updated Policy.

Hearing Software S.L., Calle Alejandro Dumas 17 - Oficinas, 29004 Málaga, Spain — contacto@byhs.eu

Support page: https://pilotsanchez.com/support