Privacy Policy and Data Protection (GDPR)

The data controller for the personal data collected on the Application is:

We only collect the data strictly necessary for the operation and improvement of the Service (principle of data minimisation).

A. Account and identification data

• Account creation : E-mail address, password (securely hashed by Supabase), first and last name (optional).
• Preferences : Interface language (French, English), notification settings.

B. Aeronautical and tracking data (Business data)

• Licenses and ratings : License types (PPL, CPL, ATPL, type/class ratings, language proficiency), issue and expiration dates.
• Medical certificates : Calendar expiration dates of medical examinations (Class 1, Class 2, LAPL).
• Logbook and activity : Recorded flight hours, aircraft types, landings, onboard roles.
• Training tracking and budget (evolving features) : Information relating to training tracking, simulators, instruction hours and associated training organisations.

C. Technical and browsing data

• HTTP headers, browser type, operating system, IP address (logged and anonymised strictly for security and fraud-prevention purposes).

D. Payment data

• Financial transactions are entirely handled by our PCI-DSS-certified provider Stripe. The Publisher never has access to your full banking details (credit card numbers). Only the Stripe customer ID, subscription status and invoice history are retained.

The data collected serves the following purposes:

Your personal data is never sold, rented or transferred to third parties for commercial or advertising purposes.

They are shared with technical sub-processors acting exclusively on behalf of the Publisher:

• Supabase Inc. : Database, authentication and secure storage (data hosted within the European Union).
• Vercel Inc. : Application hosting and edge network infrastructure.
• Resend Inc. : Automated transactional and alert e-mail delivery service.
• Stripe Payments Europe, Ltd. : Secure payment processing and subscription management.

International transfers: where these sub-processors transfer data to the United States, such transfers are governed by the EU-US Data Privacy Framework (DPF) or by the Standard Contractual Clauses (SCC) adopted by the European Commission, ensuring a level of protection equivalent to the GDPR.

• Account and business data : Retained for the entire period during which the user account is active.
• Inactive account : In the event of prolonged inactivity (no access for 24 months), an alert is sent. Without a response, the account and its data are deleted.
• Account deletion : Upon a request to close the account, all personal data, licenses and logbooks are permanently deleted within a maximum of 30 days, subject to the legal obligations to retain accounting and invoicing data (10 years in accordance with Article L. 123-22 of the French Commercial Code).

The Publisher implements all appropriate technical and organisational measures to guarantee a level of security appropriate to the risk:

• Encryption of communications in transit via TLS/HTTPS.
• Passwords encrypted and irreversibly hashed.
• Strict access control via Row Level Security (RLS) on the Supabase database (each user only accesses their own data).
• Isolation of access tokens and infrastructure API keys.

In accordance with Articles 15 to 22 of the GDPR, you have the following rights regarding your personal data:

• Right of access : Obtain confirmation that your data is processed and receive a copy.
• Right to rectification : Correct inaccurate or incomplete data directly from your account area or on request.
• Right to erasure (“right to be forgotten”) : Request the permanent deletion of your account and your data.
• Right to data portability : Receive your data in a structured, commonly used and machine-readable format (data export).
• Right to object and to restriction : Object to certain processing or restrict its scope.

To exercise any of these rights, contact us at: contact@blockoff.app. A response will be provided within 30 days at the latest.

If you believe your rights are not being respected, you have the right to lodge a complaint with the CNIL (French data protection authority): https://www.cnil.fr.

The Application only uses technical and strictly necessary cookies for the proper operation of the service (maintaining the Supabase authentication session, remembering the interface language).

No advertising cookies or third-party behavioural tracking tracers are placed.

The Publisher reserves the right to modify this Privacy Policy at any time, in particular in the event of changes to the Service’s features or the legal framework. Users will be informed of any material change by e-mail or via a notification in the Application.