Privacy Policy
Last updated [[EFFECTIVE DATE]]
This is a working draft pending review by a qualified lawyer. Some details are still marked with placeholders. Do not rely on it as a final agreement.
1. Who we are
GeoPilot (“GeoPilot”, “we”, “us”, “our”) is a drone-airspace-restriction map and flight-planning service available at [[SITE DOMAIN]] and its subdomains (the “Service”).
The data controller responsible for your personal data is:
- [[LEGAL ENTITY NAME]]
- [[REGISTERED ADDRESS]], Romania
- Registration / VAT number: [[COMPANY / VAT NUMBER]]
- Data-protection contact: [[PRIVACY EMAIL]]
We have not appointed a Data Protection Officer, because we are not required to under Article 37 of the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”). Any question about this policy or your personal data can be sent to the address above.
2. Scope
This policy covers personal data we process about:
- visitors to the Service who are not signed in;
- registered users who hold a GeoPilot account;
- subscribers to a paid plan (once paid plans are launched — see section 6.6); and
- people who contact us through the contact form or by email; and
- developers who apply for, or use, our public API.
It does not cover third-party websites we link to, the official aviation-authority sources whose airspace data we display, or any separate agreement you may have with us.
3. The personal data we process
We have designed the Service to collect as little identifying data as possible. In particular, we never store your IP address in a readable form — every IP-derived value we keep is first passed through a one-way keyed hash (HMAC-SHA-256). That makes it pseudonymised data: the address cannot be read from our records, and recovering it would need the secret key only our servers hold, which we do not use for that purpose.
3.1 Data you give us
| Data | When | Notes |
|---|---|---|
| Email address | Registration | Stored in readable form (needed to sign you in and to email you). To change it, write to us — see section 9 |
| Password | Registration and password changes | Stored only as an Argon2id hash — we never see or keep your actual password |
| Acceptance of the Terms | Registration | A timestamp recording that you accepted the Terms and this policy |
| Preferred country | If you set a default map country in your profile | A country code you choose; not derived from your location |
| Flight plans and drawn areas | When you draw or save a flight area | A name, an optional description, the geographic shape you drew, and an altitude |
| SORA and PDRA assessments | When you use the planning tools | A name, optional notes, and the parameters you enter about your intended operation and aircraft, plus the computed result |
| Flight-plan monitors | When you set a plan to be re-checked | The plan and the "fly-at" time you choose |
| Contact-form submissions | When you use the contact form or email us | Your name, email address, subject and message; stored with it, your browser’s user-agent string, a keyed hash of your IP address, the country your connection came from, and whether the anti-bot check passed |
| API-access applications | When you apply for access to our public API | Your email address, organisation name, the use you describe, the access and volume you request; stored with it, a keyed hash of your IP address and whether the anti-bot check passed |
| API keys | When you create a key for the public API | A name you choose, the key’s first few characters (so you can tell keys apart), its permissions and dates. The key itself is stored only as a hash |
| Support correspondence | Any time you write to us | The content of your messages and our replies |
3.2 Data created when you use the Service
| Data | Purpose | Storage |
|---|---|---|
| Session records | Keeping you signed in | A hashed session token, a hashed IP, your browser’s user-agent string, and timestamps |
| Security-event log | Detecting and slowing down password-guessing and abuse of the sign-in, registration, password-reset and verification endpoints | Event type, success/failure, a hashed IP, your user-agent string, timestamps |
| Audit log | An internal record of security-relevant actions | The acting user’s ID, the action, the affected item, a hashed IP, and a small amount of context |
| Transactional-email log | Proving that account emails were sent, diagnosing delivery problems, and tracking our email costs | The recipient email address, the domain, the subject line, the delivery status, any error text returned by the mail server, and a cost estimate |
| Diagnostic (server) logs | Operating and debugging the Service | Request method, path (with share-link and other tokens removed), response status, duration, and the acting user’s ID where applicable — no IP addresses, passwords or tokens |
| Public-API usage log | Rate limits, showing you and us how a key is used, detecting abuse, and API billing | For each API request: the key used, the route, method, status, duration, bytes returned and the permission used — no request bodies and no IP addresses |
| Complimentary access (membership and API grants) | Recording access an administrator gives you free of charge, and when it ends | The kind of grant, its dates and status, and an internal note by the administrator who issued it |
| Notifications | Showing you in-app notices, including announcements administrators send to all users | A type, a title and body, and related identifiers |
3.3 Data used to prevent trial and registration abuse (profiling)
When you register, we compute a risk score to help us detect automated sign-ups and repeat abuse of free trials. To do this we store, for up to 90 days: a keyed hash of your email address; a keyed hash of your IP address; a keyed hash of the coarse network your IP belongs to (your address is first reduced to a /24 or /64 block before it is hashed, so nothing more precise than the network can be derived); the domain part of your email address, in readable form, to check it against a small list of known disposable-email providers; and the resulting numeric score, a band label derived from it (such as “allow” or “review”), and the weighting factors that produced them.
This is profiling within the meaning of Article 4(4) GDPR, but it does not currently produce any automated decision that has a legal or similarly significant effect on you. No trial is automatically granted, refused or restricted on the basis of the score, and no account is blocked by it — today the score is recorded for our review only. If we ever change this, we will update this section first and put in place the safeguards required by Article 22 GDPR. You can object to this profiling at any time — see section 9.
3.4 Location and geographic data
- Flight-plan and assessment geometry. The shapes and altitudes you enter are planning data about an area you are interested in — not a record of where you are.
- Approximate country from your connection. Our content-delivery provider (Cloudflare) adds an approximate country code to each request. We use it only to pre-select a sensible default country on the map. We do not store it, except that a contact-form submission records the country it was sent from.
- We do not use browser geolocation, GPS, Wi-Fi or Bluetooth positioning, or any precise location technology.
3.5 Payment data (from launch of paid plans)
When paid plans launch, card payments will be handled by Stripe. You will enter your card details directly with Stripe; we will not receive or store your full card number, CVC or similar. We will store only a Stripe customer/subscription reference, the plan you chose, the billing period, and the status of your subscription.
3.6 Special categories of data
We do not ask for, and ask that you do not send us, any “special category” data (health, racial or ethnic origin, political opinions, religion, trade-union membership, genetic or biometric data, sex life or sexual orientation) or data about criminal convictions. If you put such data into a free-text field, you are providing it on your own initiative and we will hold it only as long as needed to deal with your request.
4. Why we process your data, and our legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Create and operate your account; provide the map and planning tools; store and display the plans and assessments you create | Contract (Art. 6(1)(b)) |
| Send you transactional emails you need for the account: address verification, password reset, a security notice when your password changes, and a notice when you ask us to delete your account | Contract (Art. 6(1)(b)) |
| Take payment, manage your subscription, apply cancellations and plan changes | Contract (Art. 6(1)(b)); and, for keeping invoices and accounting records, legal obligation (Art. 6(1)(c)) |
| Keep you signed in securely; run the login back-off that slows down password-guessing | Legitimate interests (Art. 6(1)(f)) — securing accounts and the Service |
| Detect and prevent trial abuse, automated sign-ups and fraud, including the risk scoring in section 3.3 | Legitimate interests (Art. 6(1)(f)) — protecting the Service and honest users from abuse |
| Keep the audit log of security-relevant actions | Legitimate interests (Art. 6(1)(f)); and legal obligation (Art. 6(1)(c)) where a specific record is required |
| Answer your contact-form and support messages | Legitimate interests (Art. 6(1)(f)); or contract (Art. 6(1)(b)) if your message concerns your account |
| Provide the public API to you: API keys, usage metering, rate limits and API billing | Contract (Art. 6(1)(b)) |
| Review applications for API access | Steps at your request before entering a contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) |
| Issue and administer complimentary access (membership and API grants) | Contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) |
| Send in-app announcements to users of the Service | Legitimate interests (Art. 6(1)(f)) — telling users about changes to the Service |
| Protect the contact form and the API-access application form from spam and bots (Cloudflare Turnstile) | Legitimate interests (Art. 6(1)(f)) |
| Pre-select a default country on the map from your approximate location | Legitimate interests (Art. 6(1)(f)) |
| Keep short-lived diagnostic logs to operate and debug the Service | Legitimate interests (Art. 6(1)(f)) |
| Comply with legal requests and court orders; establish, exercise or defend legal claims | Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)) |
| Send you optional product news or marketing, if we ever offer it | Consent (Art. 6(1)(a)) |
| Set non-essential cookies or introduce analytics, if we ever do | Consent (Art. 6(1)(a)) |
Where we rely on legitimate interests, we have weighed our interest against your rights and freedoms and concluded that the processing is limited to what is necessary and is not overridden by your interests. You can ask us for the details of that assessment, and you can object (see section 9).
5. How long we keep your data
We keep personal data only as long as we need it for the purpose it was collected for, after which it is deleted or anonymised.
| Data | Retention |
|---|---|
| Account (email, password hash, settings) | For as long as your account exists. If you ask us to delete your account, it is erased once a 30-day grace period (during which you can cancel the request) has passed — in practice within a day of its end |
| Session records | Until the session expires or is ended (signing out, revoking it), then deleted after about 7 days |
| Email-verification and password-reset tokens | Valid until used or expired (24 hours / 1 hour), then deleted after about 7 days |
| Security-event log | 90 days |
| Audit log | 24 months |
| Transactional-email log | 400 days |
| Contact-form messages | 24 months after receipt; a message we have not yet handled is kept until we handle it |
| Trial/registration abuse-prevention signals | 90 days; the numeric risk score is cleared after 90 days |
| Flight plans, SORA and PDRA assessments, monitors | Until you delete them; a deleted item is erased for good 30 days later. All of them are erased with your account |
| API keys | Until you revoke them, or until your account is deleted |
| Public-API usage log | 90 days |
| API-access applications | 24 months after receipt once decided; an application still under review is kept until it is decided |
| Complimentary access records | For the life of your account; after erasure an anonymised record, without the administrator’s note, remains |
| Share links | Until you revoke them or they expire |
| In-app notifications | 12 months |
| Subscription and payment records | For the life of your account. From the launch of paid plans, invoices and accounting records are kept for up to [[7 years]] after your last transaction, as tax law requires |
| Diagnostic (server) logs | 14 days |
Some records outlive an erased account for their own period and no longer: your email address stays in the transactional-email log (400 days) and in contact-form messages you sent (24 months), and the audit and security logs keep their entries with your account reference removed. We may keep specific records for longer where we need them to establish, exercise or defend a legal claim, or where the law requires it — but only for that purpose and only for as long as necessary.
6. Who we share your data with
We do not sell your personal data and we do not share it for anyone else’s marketing. We share it only with the service providers we need to run GeoPilot.
6.1 Our processors and service providers
| Provider | What they do | What they receive | Where |
|---|---|---|---|
| DigitalOcean | Hosting — our servers, database and cache | All data stored by the Service, at rest | European Union (Amsterdam / Frankfurt) |
| Cloudflare | Content delivery, TLS, protection against attacks and bots; the Turnstile anti-bot check on the contact and API-access application forms | All web traffic metadata, including your IP address; for a form submission, your IP address and the Turnstile token | United States (global edge network) |
| Railsware Products Studio LLC (Mailtrap) | Sends our account emails (verification, password reset, password-changed notice, account-deletion notice) | The recipient address, the subject, and the message body | United States |
| Stripe (from launch of paid plans) | Processes card payments and manages recurring billing | The card and billing details you enter directly with Stripe | United States / European Union |
We put a data-processing agreement in place with each of these providers.
6.2 Map tile providers
The map is drawn from image “tiles” your browser downloads directly from a tile provider. The default basemap loads automatically; the others load only if you switch to them. Each provider receives your IP address and the map area you are viewing: CARTO (default basemap, United States / Spain); OpenStreetMap Foundation (“Street” basemap, United Kingdom); Esri (“Satellite” basemap, United States); OpenTopoMap (“Topographic” basemap, Germany).
6.3 Our staff and administrators
A small number of authorised administrators can access, through an internal admin dashboard and in order to run and support the Service: user email addresses and account details; subscriptions and complimentary grants; the transactional-email log; contact-form messages and API-access applications; API keys (never the keys themselves) and API usage; diagnostic logs; and the audit log. Each area is restricted to the administrators who need it.
6.4 Legal and safety disclosures
We may disclose personal data if we are required to by law, a court order or a competent authority, or where we believe in good faith that disclosure is necessary to protect the safety of any person, to prevent fraud or abuse, or to protect our legal rights.
6.5 Business transfers
If GeoPilot or its assets are acquired by, merged with, or transferred to another organisation, your personal data may be transferred as part of that transaction. We will tell you and the new controller will remain bound by this policy or a policy at least as protective, unless you are told otherwise and given a choice where the law requires one.
6.6 Note on paid plans
Paid subscriptions are not yet active. The references to Stripe and to payment data in this policy describe how billing will work once it launches, and take effect at that point.
7. Sending data outside the EEA
Your data is stored at rest in the European Union. Some of the providers listed in section 6 are located outside the European Economic Area (principally the United States), so using the Service involves transfers of personal data outside the EEA. For those transfers we rely on the European Commission’s Standard Contractual Clauses; and/or the provider’s certification under the EU–US Data Privacy Framework, where it holds one; and for the United Kingdom, the European Commission’s adequacy decision. You can ask us for a copy of the safeguards that apply to a particular transfer by writing to [[PRIVACY EMAIL]].
8. How we protect your data
- passwords stored only as Argon2id hashes;
- all IP-derived values stored only as one-way keyed hashes (pseudonymised), never in readable form;
- encryption in transit (HTTPS/TLS);
- session controls — automatic expiry, an idle timeout, and the ability for you to see and revoke your active sessions;
- a separate, isolated administrative system;
- least-privilege access for our staff, and rate-limiting and abuse controls on sensitive endpoints.
No method of transmission or storage is completely secure. If we become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the supervisory authority, and you, as required by Articles 33 and 34 GDPR.
9. Your rights
Under the GDPR you have the right to:
- Access — obtain confirmation of whether we process your data, and a copy of it;
- Rectification — have inaccurate data corrected and incomplete data completed;
- Erasure — have your data deleted where one of the grounds in Article 17 applies;
- Restriction — have our processing restricted in the circumstances in Article 18;
- Portability — receive the data you gave us in a structured, commonly used, machine-readable format, and have it sent to another controller where technically feasible;
- Object — object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests (including the abuse-prevention profiling in section 3.3); and object at any time to processing for direct marketing;
- Withdraw consent — where we rely on your consent, withdraw it at any time;
- Not be subject to a solely automated decision with legal or similarly significant effect (we do not currently make such decisions).
How to exercise your rights. For most rights you can act directly in the Service: update your country in your profile (to change your email address, write to us); see and revoke your active sessions; download a copy of your data using “Download my data” in your profile; delete your account using “Delete account” in your profile. Or write to [[PRIVACY EMAIL]]. We may ask you to confirm your identity before we act. We will respond within one month (extendable by two further months for complex or numerous requests). There is no fee, unless your request is manifestly unfounded or excessive.
10. Complaints
If you think we have not handled your personal data properly, please contact us first at [[PRIVACY EMAIL]]. You also have the right to lodge a complaint with a supervisory authority, in particular the Romanian one:
Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
B-dul General Gheorghe Magheru nr. 28-30, Sector 1, 010336 București, Romania
Web: dataprotection.ro · Email: [email protected]
You may also complain to the supervisory authority in the EEA country where you live or work, and you have the right to an effective judicial remedy.
11. Children
The Service is not directed at children. You must be at least 16 years old to create a GeoPilot account (the age of consent for information-society services under Article 8 GDPR as applied in Romania). We do not knowingly collect personal data from children under 16. If you believe a child has given us their data, contact [[PRIVACY EMAIL]] and we will delete it.
12. Changes to this policy
We may update this policy from time to time. When we do, we will change the “Last updated” date above. If the changes are material, we will give you additional notice — for example, an in-app notification or an email — before they take effect.
13. Contact
Questions about this policy or your personal data: [[PRIVACY EMAIL]] · [[LEGAL ENTITY NAME]], [[REGISTERED ADDRESS]], Romania.