1. Data Controller
The data controller is FLYGTS (Gregory Tuck Sherman), 32 rue des Astronomes, 1180 Brussels, Belgium. Contact: contact@easafly.com.
2. Collected Data
- Account: email, full name, hashed password, OAuth identifiers (Google / Apple).
- Flight data: dates, aerodromes, registration, durations, aircraft type, ratings, remarks you enter.
- Technical: IP address, browser type, access logs, session durations.
- Support: content of your emails and support messages.
- Payment: credit card data is collected and stored by Paddle.com, not by us. We only receive a customer identifier, subscription status, country, and associated email.
3. Purposes and Legal Basis
- Provide the Service (contract performance).
- Manage your subscription and billing via Paddle (contract performance).
- Security, fraud prevention (legitimate interest).
- Customer support (contract performance).
- Product improvement, aggregated and anonymized statistics (legitimate interest).
- Transactional communications (contract performance).
- Compliance with our legal obligations (accounting, authority requests).
4. Recipients and Processors
- Paddle.com (Merchant of Record) — sales, subscription management, payment, VAT, billing.
- Supabase (database hosting and authentication, EU).
- Lovable / Cloudflare (application hosting and CDN).
- Google / Apple only if you use the corresponding OAuth login.
- Professional advisors (legal, accounting) and authorities when required by law.
5. International Transfers
Our processors may process data outside the EEA (notably certain Cloudflare services). Transfers are governed by the European Commission's Standard Contractual Clauses and, where applicable, by relevant adequacy decisions.
6. Retention
Account and flight data are kept as long as the account is active. After account deletion, they are erased within 30 days, unless there is a legal obligation to retain them (billing: 7 years in Belgium).
7. Your Rights (GDPR)
You have the following rights: access, rectification, erasure, restriction, portability, objection, withdrawal of consent. To exercise your rights, write to contact@easafly.com. We respond within one month.
You can also file a complaint with the Belgian Data Protection Authority (APD/GBA).
8. Security
We implement appropriate technical and organizational measures: encryption in transit (HTTPS), encryption at rest, access control, least privilege principles, and logging.
9. Cookies
We only use essential cookies necessary for your authentication and the operation of the Service. We do not use advertising cookies or third-party tracking pixels.
