FlightDex Privacy Policy
Effective: 6 November 2026, version 1.1 · Hungarian version: Adatkezelési tájékoztató
This policy explains how DataEdge Kft. processes personal data when you use the FlightDex website (https://flightdex.io) and the FlightDex application (https://app.flightdex.io, together "FlightDex" or the "Service"). It meets the information duties of Articles 13 and 14 of the General Data Protection Regulation (EU) 2016/679 ("GDPR") and of Hungarian Act CXII of 2011 on informational self-determination and freedom of information ("Infotv.").
The marketing-site waitlist has its own short notice: Waitlist privacy notice. Cookies and browser storage are described in the Cookie and local-storage notice.
1. Who we are (the controller)
| Name | DataEdge Kft. |
|---|---|
| Registered office and postal address | 6724 Szeged, Bakay Nándor utca 24. D2. ép. 1. em. 13., Hungary |
| Company registration number | 06-09-023337 (registry court: Szegedi Törvényszék Cégbírósága) |
| Tax number / EU VAT number | 25866948-2-06 / HU25866948 |
| Represented by | Márk Lekeny, managing director |
| Privacy contact | privacy@flightdex.io |
| General contact | hello@flightdex.io · support: support@flightdex.io · phone: +36 30 436 0799 |
| Security vulnerability reports | security@flightdex.io |
Data protection officer. We have not appointed a data protection officer. Under Article 37 GDPR one is mandatory only where the core activities consist of large-scale regular and systematic monitoring or large-scale processing of special categories of data. FlightDex is a small service, and health data (medical certificates) is processed only for users who choose to store it. We will reassess this as the service grows. All privacy questions go to the privacy contact above.
2. Our role: controller or processor
FlightDex has two kinds of workspaces. Who decides about the data depends on the workspace and on who the customer is.
| Situation | Who is the controller | Our role |
|---|---|---|
| Your account, sign-in, security, billing, support, the waitlist, our website | DataEdge Kft. | controller |
| Your personal workspace (pilot logbook, credentials, exams, Academy) | DataEdge Kft. | controller |
| An aircraft workspace run by a consumer, meaning a private individual using it for personal purposes | DataEdge Kft. | controller |
| An aircraft workspace run by a business or organisation (company, club, school, co-ownership entity) that has accepted our Data Processing Agreement | the workspace owner (the customer) | processor under Article 28 GDPR |
In the last case, the customer decides what is recorded about its members, pilots, passengers and business partners, and you should contact the customer first. If you contact us, we will forward your request to the customer and help them answer it.
3. What we process, why, on what legal basis and for how long
Beta period. FlightDex is currently an invite-only, free beta: you can register only with an invitation, the Service is free of charge for every invitee, and we process no payment data. During the beta a user can create up to 3 own workspaces, and a workspace can hold up to 3 aircraft and 10 members (pending invitations included). Row 12 (subscriptions) applies only once paid plans start; we will announce them at least 30 days in advance, there is no automatic charge, and a paid plan starts only if you explicitly choose one.
Legal bases (Article 6(1) GDPR): (a) consent; (b) performance of a contract with you, or steps you request before entering into one; (c) compliance with a legal obligation; (f) our or a third party's legitimate interests. For health data, Article 9(2)(a) applies: your explicit consent.
| # | Purpose | Personal data | Legal basis | Source | Retention |
|---|---|---|---|---|---|
| 1 | Creating and running your account; recording your acceptance of the legal documents and your consents | name, email, phone (if you give it), password (stored only as a hash), language, time zone, workspace memberships and roles, invitations, last login time, sign-in tokens (hashed); acceptances and consents: kind, version, time (we do not record IP address or user agent) | Art. 6(1)(b); records of acceptance: Art. 6(1)(c) (Art. 7(1) GDPR) | you; the person who invited you | deleted after a 30-day grace period from your deletion request (an automatic daily job carries out the deletion). For the name kept after deletion and the proof of consents, see "After account deletion" below |
| 2 | Pilot logbook (EASA FCL.050) | flights: dates, times, departure and arrival places, aircraft, crew names, function times, night/IFR, landings, remarks, private notes, GPS tracks, statistics, goals, opening balances, imported logbooks, paper-logbook scans | Art. 6(1)(b) | you; imports you start; techlog entries of aircraft you fly | until you delete the entries or your account (signed and locked entries are kept as versions while the logbook exists) |
| 3 | Pilot profile, credentials and validity tracking | pilot profile (licence number, date of birth, address(es), home base, for the logbook export header); licence, ratings, language proficiency, radio, instructor/examiner certificates, checks, theory exams, expiry dates, scans and the text extracted from them | Art. 6(1)(b) | you; AI extraction from your scans | until you delete them or your account |
| 4 | Medical certificate (class, limitations, expiry, scan) and medical-expiry reminders | health data (Art. 9 GDPR) | Art. 9(2)(a) explicit consent, given separately in the app before you first store medical data; a second, separate explicit consent before a medical scan is sent for AI extraction | you | until you delete it or withdraw consent; when you withdraw the storage consent we delete medical data, scans and reminders immediately (backups roll off as described below) |
| 5 | Countersignatures by instructors/examiners | signature image, name, certificate number, role, time, IP address and browser user agent at signing, a cryptographic (HMAC) seal | pilot: Art. 6(1)(b); instructor: Art. 6(1)(f), our and the pilot's legitimate interest in verifiable, tamper-evident logbook signatures | the instructor, when signing | as long as the signed logbook entry exists |
| 6 | Aircraft techlog, defects, maintenance, documents | flights per aircraft (PIC, second crew, passenger count, times, fuel, remarks), G1000 data logs with positions (GPS track), defects and photos, deferrals, maintenance items and events, certificate-of-release references, airworthiness acknowledgements, uploaded documents and scans | Art. 6(1)(b) (where we are controller) | workspace members; email forwarding | until the workspace owner deletes them or the workspace is deleted. Records that form part of the aircraft's continuing-airworthiness file cannot be deleted by single users |
| 7 | Trips and operational emails | legs, stops, names of crew and passengers on board and, if given, their phone, email and certificates (the Service does not ask for passport/ID numbers, nationality or date of birth), handler and airport contacts, email drafts, sent emails and replies | Art. 6(1)(b) for you; Art. 6(1)(f) for passengers, crew and correspondents (the legitimate interest in organising the flight) | you; workspace members; replies from airports and handlers | until the trip or workspace is deleted |
| 8 | Inbound email ("forward it to your aircraft") | sender and recipients, subject, body, headers, attachments, authentication results (DKIM/SPF/DMARC), AI summary | Art. 6(1)(b); Art. 6(1)(f) for senders | email senders | mail is accepted only from allow-listed senders; other mail is quarantined. Accepted mail: as long as the workspace keeps it; quarantined mail: until a workspace owner releases or deletes it, or the workspace is deleted |
| 9 | Notifications and system emails | email address, push subscription (browser endpoint, keys, user agent), notification settings, delivery log; system emails (sign-up confirmation, password reset, invitation, export ready, account deletion); the monthly logbook backup email | Art. 6(1)(b) | you; your browser | push subscription: until you unsubscribe, it expires or you sign out; delivery log: as long as your account exists (deleted with the account) |
| 10 | AI-assisted features (see section 5) | content of documents, scans, emails, logbook pages, trip data that you submit to an AI feature | Art. 6(1)(b); medical scans only with the separate consent in row 4 | you | results stored as in the relevant row. See section 6 for the AI provider's own retention |
| 11 | ATPL Academy | progress, answers, scores, spaced-repetition state, bookmarks | Art. 6(1)(b) | you | until account deletion |
| 12 | Subscription and billing (only once paid plans start; not in the beta) | from Paddle: customer ID, name, email, country, plan, status, amounts, dates. Never card data | Art. 6(1)(b); Art. 6(1)(c) for accounting records | Paddle | contract data: until account deletion; accounting documents: 8 years (section 169 of Act C of 2000 on Accounting) |
| 13 | Support, complaints and email to @flightdex.io addresses | your messages (sender, subject, body, attachments), workspace ID, our replies | Art. 6(1)(b) / (f); consumer complaints: Art. 6(1)(c) | you | support: 2 years after the case is closed; consumer complaint record and reply: as long as section 17/A of Act CLV of 1997 on Consumer Protection requires |
| 14 | Security, abuse prevention, audit trail | IP address, browser user agent, request time and URL (web server logs; addresses containing access tokens are masked); failed logins and rate-limit counters; audit log of who changed what (before/after values) | Art. 6(1)(f), the legitimate interest in a secure service and tamper-evident records | your device; the system | web server logs: 14 days; application and system logs: 7 days; rate-limit counters: in memory only, never written to disk; audit log: as long as the related record exists (the audit log holds no IP addresses) |
| 15 | Waitlist and beta invitation (marketing site) | see the Waitlist privacy notice | Art. 6(1)(a) | you | until 12 months after the public launch of FlightDex, or until you withdraw (unsubscribing deletes the record immediately) |
| 16 | Legal claims | data needed to establish, exercise or defend legal claims | Art. 6(1)(f) | the records above | until the limitation period ends (generally 5 years, section 6:22 of the Hungarian Civil Code) |
| 17 | Flight-track and aircraft-data lookups | aircraft registration or ICAO24 address and the flight's time window; the result (track) | Art. 6(1)(b) | external flight-data sources (section 6) | with the logbook entry. These lookups are supported by the software but are not enabled in the Service at present |
Where we rely on legitimate interests (rows 5, 7, 8, 14, 16 and the retained name below), we have balanced those interests against your rights. You can ask us for a summary of that balancing test, and you can object (section 9).
If you do not provide data. Account data and the data needed for a feature are required to provide that feature. Medical data is never required: the Service works without it.
After account deletion. When the 30-day grace period ends, we delete your account data, your personal workspace and every workspace in which you are the only active member, including the files. Two things remain:
- Your name. The account record is reduced to your full name: the email address is replaced, the password is made unusable, and the phone number and other details are cleared. The name stays because aircraft techlogs (pilot in command, signatures, continuing-airworthiness records) and other users' logbooks refer to you, and those records must stay complete and unaltered. Legal basis: Art. 6(1)(f), the legitimate interest of the aircraft owners and operators, of other users and of ours in complete continuing-airworthiness and pilot-logbook records, which aircraft owners must keep under Regulation (EU) No 1321/2014 (Part-ML / Part-M) and pilots under FCL.050; where we process the aircraft workspace as a processor, the customer's instructions, given to meet its own legal obligation (Art. 6(1)(c)). We keep the name as long as records referring to you exist. You may object (Art. 21); we will then examine whether your name can be replaced in the specific records.
- Proof of consents. Before deletion we copy your consent and acceptance records (kind, version, action, time) into a pseudonymised archive in which you are identified only by a SHA-256 hash of your normalised email address; the archive holds no name. A deletion log keeps the number of deleted records per table with the same hash. Legal basis: Art. 6(1)(c) with Art. 7(1) GDPR (proving consent), and Art. 6(1)(f) (legal claims). Both are kept until the general 5-year limitation period (section 6:22 of the Hungarian Civil Code) has expired.
Backups. Deleted data stays in backups until those backups expire. All backups are currently stored on the same server in Frankfurt (Hostinger); there is no off-site backup yet.
- Database: a weekly full backup (Sunday), daily differential backups and continuous transaction-log archiving; the last two full backups are kept, so deleted data can remain in database backups for up to about 3 weeks (at most 21 days).
- A daily database dump, kept for 7 days.
- Uploaded files: a mirror copy; files deleted in the Service are moved to a trash folder of the mirror, which is emptied after 14 days.
We plan to add encrypted off-site backups at an EU storage provider. This is not used today. We will name the provider and the retention periods in the sub-processor list at least 30 days before we start using it. If a backup is ever restored, we re-apply earlier account deletions from our deletion log.
Inactive accounts. We do not delete inactive accounts or workspaces automatically; a workspace is deleted only if you ask. If we ever introduce an inactivity rule, we will tell you by email at least 30 days before it applies. Once paid plans exist, a workspace whose paid plan ends becomes read-only: you can still read and export everything.
4. Data about other people (Article 14)
Some data comes from someone other than the person it is about:
- Instructors and examiners who countersign an entry. They receive a short privacy notice on the signing page (
/sign/...) before they sign, with a link to this policy. The signature image is stored as a picture. It is not processed with technical means to identify a person uniquely, so it is not biometric data under Article 9. - Crew members, passengers and other people named in logbooks, techlogs or trips. The user who enters them must have a lawful basis and must tell them where appropriate. Data: names, roles and, for trips, the travel data listed in row 7.
- Email correspondents (airports, handlers, maintenance organisations) whose replies reach a workspace.
For these people, the purposes, legal bases and retention periods are those in section 3. They have the rights in section 9. Where informing each person individually would be impossible or would involve a disproportionate effort, this policy serves as public information (Art. 14(5)(b)).
5. Artificial intelligence features
FlightDex uses Anthropic's Claude models through Anthropic's commercial API to classify documents, extract data from scans (for example invoices, certificates of release, paper logbook pages and licences), summarise incoming emails, draft operational emails and research airports.
- Suggest, then confirm. The AI produces suggestions. A person confirms, edits or rejects them before they become part of your records. Nothing is sent to a third party without your action.
- No automated decisions. We make no decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). Validity and recency warnings are information for you and decide nothing on your behalf.
- No model training. Under Anthropic's Commercial Terms, Anthropic may not train models on customer content sent through the API.
- Medical scans are sent for AI extraction only if you switch on that separate option (section 3, row 4). You can switch it off at any time.
- Manual alternative. Every AI feature can also be done by hand. AI can be switched off only for the whole Service, by us; there is no per-workspace switch. Every AI suggestion needs a person's confirmation.
- Where it runs. Anthropic stores data in the USA, and processing may also take place in other regions. By default Anthropic deletes API inputs and outputs within 30 days; content flagged for a usage-policy violation may be kept for up to 2 years.
- Airport research uses Anthropic's web search; we send only the airport identifier and the question about the airport, no personal data.
- Usage records. We count AI usage (credits) per workspace. These records contain no content.
6. Recipients and sub-processors
We do not sell personal data and do not use it for advertising.
| Recipient | Purpose | Data | Location | Transfer safeguard | Status |
|---|---|---|---|---|---|
| Hostinger International Ltd., 61 Lordou Vironos str., 6023 Larnaca, Cyprus | server (VPS) hosting, database, file storage, backups | all data in the Service | Frankfurt am Main, Germany (EU) | not needed (EU) | live |
| Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland (contracting party for EEA customers), with processing by Anthropic, PBC (USA) and its sub-processors | AI features (section 5) | content you submit to an AI feature | USA (storage); processing may also run in other regions | EU Standard Contractual Clauses (Commission Decision (EU) 2021/914, Modules 2 and 3) in Anthropic's Data Processing Addendum; we rely on the SCCs only. Retention: 30 days (section 5) | live |
| Mailgun Technologies, Inc. (Sinch group, "Sinch Email"), EU region | receives mail sent to @flightdex.io addresses and forwards it to our mailbox (relay only, no mailbox), and sends system emails from no-reply@mail.flightdex.io | email addresses, message content, attachments, delivery events | EU (Google Cloud, Germany and Belgium); limited account data (not your messages) in the USA | Sinch data protection agreement with SCCs (Modules 2 and 3); in addition, according to its privacy notice, Mailgun Technologies, Inc. participates in the EU-US Data Privacy Framework. Retention: forwarded mail only transiently; delivery logs up to 30 days | live |
| Rackhost Zrt., 6722 Szeged, Tisza Lajos körút 41., Hungary | mailboxes: the mailbox receiving @flightdex.io mail (and mail to the former @chockops.io addresses); sending and receiving airport/handling correspondence (flyops@dataedge.io, SMTP/IMAP); receiving mail forwarded to aircraft workspaces | email addresses, content, attachments | Hungary (EU) | not needed (EU) | live |
| EU off-site backup storage provider | encrypted off-site backups | all data in the Service, encrypted | EU | named in the sub-processor list at least 30 days before use | not used today |
| Paddle.com Market Limited, 30 Old Bailey, London EC4M 7AU, United Kingdom (address per Paddle's privacy notice); Paddle.com Inc. for buyers in the USA | reseller and Merchant of Record: checkout, payment, invoicing, tax; Paddle issues the invoice. Paddle acts as an independent controller under its own privacy notice | name, email, country, address/postcode, VAT ID, payment data (held only by Paddle), IP address for tax location | United Kingdom | EU adequacy decision for the United Kingdom | only from the start of paid plans (not in the beta) |
| OpenStreetMap Foundation, St John's Innovation Centre, Cowley Road, Cambridge CB4 0WS, United Kingdom (via its CDN) | map tiles, loaded directly by your browser when you open a map (with OpenStreetMap attribution). OSMF is an independent controller | IP address, browser user agent, referring page (Referer), the map area requested | United Kingdom / CDN | EU adequacy decision for the United Kingdom | live (tile.openstreetmap.org); we will review the map provider before public launch |
| Flight-data sources: api.adsbdb.com (aircraft data); OpenSky Network (Switzerland); Flightradar24 AB (Sweden), independent providers | ADS-B flight-history and aircraft-data lookups, sent by our server | aircraft ICAO24 address or registration and a time window; your identity is not sent | Switzerland / Sweden (EU) / other | — | supported by the software but not enabled in the Service at present; we will update this policy before enabling any of them |
| Browser push services (Google, Mozilla, Apple, Microsoft, chosen by your browser) | delivering web push notifications | push endpoint, encrypted message, timing | various, including the USA | the message content is end-to-end encrypted (RFC 8291). The provider is determined by your browser | live |
| People you send data to: airports, handlers, maintenance organisations, instructors, co-pilots, other workspace members | operational emails, signature requests, shared workspaces | what you choose to send or share | worldwide | sent on your instruction | live |
| Our accountant, legal advisers, courts and authorities | accounting, legal advice, legal obligations | as needed | Hungary | not needed | as needed |
The Service uses no external weather, NOTAM or airport-data services; airport data comes from a dataset bundled with the application. The current list of processors is on the Sub-processors page. We will update this list before adding or replacing a sub-processor (see section 13). Business customers are notified as set out in the Data Processing Agreement.
About the US transfer. The EU-US Data Privacy Framework adequacy decision (Commission Implementing Decision (EU) 2023/1795) is in force. The EU General Court dismissed a challenge to it on 3 September 2025 (Case T-553/23, Latombe v Commission). An appeal is pending before the Court of Justice (Case C-703/25 P). Because the outcome is uncertain, we rely on the Standard Contractual Clauses in Anthropic's Data Processing Addendum as our transfer safeguard. For Mailgun, messages stay in the EU, and the DPF is available in addition to the SCCs. You can ask for a copy of the safeguards at privacy@flightdex.io.
7. Cookies and browser storage
The marketing website sets no cookies and uses no analytics or advertising trackers; it only remembers your
light/dark setting in your browser (chockops.theme). The app uses no analytics or tracking either, only
strictly necessary cookies: sign-in (flyops_access, 15 minutes; flyops_refresh, 30 days, sent only to the
sign-in endpoints), protection against cross-site request forgery (flyops_csrf, 30 days), all Secure and
SameSite=Strict, and browser storage for your settings (theme, language, last workspace, layout) and for
offline use (unsynced entries, and a cache of data you opened).
Logging out clears the offline data on that device: the cache of data you opened, the offline queue (including entries not yet synced, so sync before you log out) and your personal settings such as the last workspace, the Academy preferences and the instructor certificate number. A session that simply expires does not clear them, so on a shared device always log out.
We do not ask for consent for this storage because it is strictly necessary for the service you requested (Art. 5(3) of Directive 2002/58/EC; section 155(4) of Hungarian Act C of 2003 on Electronic Communications). Details: Cookie and local-storage notice.
8. How we protect your data (Article 32)
- Encryption in transit (TLS/HTTPS) for all connections; the website and the app send HTTP Strict Transport Security (HSTS, one year).
- Hosting in the EU (Germany).
- Strict separation between customers: every query is filtered by workspace in the application, and also by PostgreSQL Row-Level Security, which fails closed. The application connects to the database with a restricted role.
- Passwords are stored only as salted bcrypt hashes. Sign-in tokens are kept in
httpOnlycookies and refresh tokens rotate. Cross-site request forgery is blocked with the double-submit token pattern. - Role-based access within workspaces (owner, pilot, maintenance, viewer).
- An append-only audit log with before/after values. Entries lock 24 hours after closing. Records are voided rather than deleted.
- Countersignatures are sealed with an HMAC. Any change to a signed field is detected and shown.
- Rate limiting on sign-in and public endpoints. Incoming email is checked against sender allowlists and DKIM/SPF/DMARC, and suspicious mail is quarantined.
- Database backups with point-in-time recovery and a daily logical dump (section 3, "Backups").
- The platform operators' console shows only the waitlist, beta invitations and aggregate counts, never workspace content. Our staff access a customer's workspace data only at the owner's express request, or where needed to fix a security incident or where the law requires it.
- Two-factor authentication is not yet available.
You can report security vulnerabilities to security@flightdex.io.
Personal data breaches. If a breach is likely to result in a risk to your rights, we notify the NAIH within 72 hours of becoming aware of it (Art. 33). If the risk is high, we also inform you without undue delay (Art. 34). Where we act as processor, we notify the customer without undue delay so that the customer can meet its own obligations.
9. Your rights
You have the following rights under the GDPR:
- Access (Art. 15): a copy of your data and information about how we process it.
- Rectification (Art. 16): correction of inaccurate data. You can edit most data yourself in the app. Signed and locked entries are corrected by creating a new version.
- Erasure (Art. 17): you can delete data or your account in the app, or ask us to. The right has exceptions, for example where we must keep data by law or need it for legal claims (see "After account deletion" in section 3).
- Restriction of processing (Art. 18).
- Data portability (Art. 20): the app exports your data in common formats (PDF, CSV, a full ZIP archive).
- Objection (Art. 21) to processing based on legitimate interests (section 3, rows 5, 7, 8, 14 and 16, and the name kept after account deletion).
- Withdrawal of consent at any time, without affecting the lawfulness of earlier processing (Art. 7(3)). For medical data: delete it in the app or switch off the consent there. For the waitlist: use the unsubscribe link or write to us.
- No solely automated decisions with legal or similarly significant effects (Art. 22). See section 5.
How to exercise them. Use the in-app settings (full data export as a ZIP, which stays available for download for 7 days; account deletion with a 30-day grace period; withdrawing medical consent), or write to privacy@flightdex.io or to our registered office. We may ask you to confirm your identity. We answer within one month. Where requests are complex or numerous, we may extend this by two further months and will tell you why within the first month (Art. 12(3)). Exercising your rights is free unless a request is manifestly unfounded or excessive (Art. 12(5)).
10. Complaints and remedies
You may complain to us first, but you do not have to. You have the right to lodge a complaint with a supervisory authority, in particular in the EU country where you live or work, or where the alleged infringement took place (Art. 77). In Hungary this is:
Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH) (Hungarian National Authority for Data Protection and Freedom of Information) Office: 1055 Budapest, Falk Miksa utca 9–11. · Postal address: 1363 Budapest, Pf. 9. Phone: +36 1 391 1400 · Email: ugyfelszolgalat@naih.hu (proceedings cannot be started by email) · Web: https://naih.hu
You can also go to court (Art. 79 GDPR; section 23 Infotv.). In Hungary the regional court (törvényszék) has jurisdiction, and you may choose to bring the case before the regional court of your place of residence or stay.
11. Children
FlightDex is intended for people aged 16 or over. We do not knowingly process the data of younger children. Users under 18 need the consent of a parent or guardian to buy a paid plan. If you believe a child under 16 has given us data, contact us and we will delete it.
12. Data processed for business customers
Where we act as processor (section 2), we process data only on the customer's documented instructions under the Data Processing Agreement. That agreement covers confidentiality, sub-processors, assistance with data-subject requests, breach notification, and the return or deletion of data at the end of the contract.
13. Changes to this policy
We may update this policy, for example when we add a feature or a sub-processor. We publish the new version here with its effective date. We tell signed-in users about material changes by email or in the app, at least 30 days in advance where possible. Previous versions are available on request.
| Version | Date | Change |
|---|---|---|
| 1.0 | 2026-10-31 | first published version |
| 1.1 | 2026-11-06 | the service is renamed FlightDex (formerly ChockOps); new addresses flightdex.io, app.flightdex.io and @flightdex.io; the provider, the processing and your rights do not change |
14. Legal sources
- GDPR, Regulation (EU) 2016/679: https://eur-lex.europa.eu/eli/reg/2016/679/oj
- Infotv., Hungarian Act CXII of 2011: https://net.jogtar.hu/jogszabaly?docid=a1100112.tv
- ePrivacy Directive 2002/58/EC, Art. 5(3): https://eur-lex.europa.eu/eli/dir/2002/58/oj ; Hungarian Act C of 2003 (Eht.), section 155(4): https://net.jogtar.hu/jogszabaly?docid=a0300100.tv
- Standard Contractual Clauses, Decision (EU) 2021/914: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj
- EU-US Data Privacy Framework, Decision (EU) 2023/1795: https://eur-lex.europa.eu/eli/dec_impl/2023/1795/oj ; participant list: https://www.dataprivacyframework.gov/list
- Continuing airworthiness, Regulation (EU) No 1321/2014: https://eur-lex.europa.eu/eli/reg/2014/1321/oj
- Hungarian Accounting Act (Act C of 2000), section 169: https://net.jogtar.hu/jogszabaly?docid=a0000100.tv
- Hungarian Consumer Protection Act (Act CLV of 1997), section 17/A: https://net.jogtar.hu/jogszabaly?docid=a9700155.tv
- Hungarian Civil Code (Act V of 2013), section 6:22: https://net.jogtar.hu/jogszabaly?docid=a1300005.tv
- AI Act, Regulation (EU) 2024/1689: https://eur-lex.europa.eu/eli/reg/2024/1689/oj
- Anthropic Commercial Terms: https://www.anthropic.com/legal/commercial-terms
- Anthropic DPA: https://www.anthropic.com/legal/data-processing-addendum ; retention: https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data
- Hostinger DPA: https://www.hostinger.com/legal/dpa ; Paddle: https://www.paddle.com/legal/privacy
- Mailgun / Sinch DPA: https://sinch.com/legal/terms-and-conditions/other-sinch-terms-conditions/data-protection-agreement/ ; regions: https://www.mailgun.com/regions
- Sub-processor list: Sub-processors
- NAIH: https://naih.hu
FlightDex Early Access Waitlist: Privacy Notice
Effective: 6 November 2026, version 1.1
Controller: DataEdge Kft., 6724 Szeged, Bakay Nándor utca 24. D2. ép. 1. em. 13., Hungary (registered office and postal address); company reg. no. 06-09-023337; phone +36 30 436 0799; privacy contact: privacy@flightdex.io. No data protection officer has been appointed. See the full Privacy Policy.
What we store when you join. Your email address, the role you choose (pilot, aircraft owner, or flight school/club), the aircraft type if you give one, the language of the page, which button opened the form, the time you gave consent, the version of this notice you agreed to, and the number of times you submitted the form. If we send you an invitation, we record when it was sent, when it expires (30 days) and whether you accepted it.
What we do not store. We do not save your IP address with your sign-up. To prevent abuse, the server counts requests per IP address (or IPv6 /64 network) in memory only, for a short time, and this count is not written to disk. Like any web server, ours also keeps access logs (IP address, time, page requested, browser) for security and troubleshooting, for 14 days. The website sets no cookies and uses no analytics or advertising trackers.
Purpose and legal basis. We use your details to invite you to the invite-only free beta, to send you launch news about FlightDex, and to understand who is interested (for example, how many owners and how many pilots). The legal basis is your consent (Art. 6(1)(a) GDPR), given by ticking the box. Access logs are kept on the basis of our legitimate interest in a secure website (Art. 6(1)(f) GDPR).
How long. Until 12 months after the public launch of FlightDex (an automatic daily job then deletes all waitlist records), or until you withdraw your consent, whichever comes first. If you unsubscribe, we delete your record immediately; invitations sent to your address that you have not accepted are revoked and the address in them is anonymised. We keep no suppression list. If you create an account, your waitlist record is deleted together with the account, and the Privacy Policy applies from sign-up.
Who receives it. Our hosting provider, Hostinger International Ltd. (Cyprus), with servers in Frankfurt, Germany (EU), and, for sending invitations and news, the EU-region email service of Mailgun Technologies, Inc. (Sinch group), which handles the message in the EU; because Mailgun's parent is in the USA, the transfer safeguard is the EU Standard Contractual Clauses, and according to its privacy notice Mailgun also participates in the EU-US Data Privacy Framework. If you write to hello@ or privacy@flightdex.io, your email passes through Mailgun to our mailbox hosted by Rackhost Zrt. (Hungary). We do not sell or share your details.
Your rights. You may ask for access to your data, its correction, erasure, restriction, or a copy (portability), and you may withdraw consent at any time, using the unsubscribe link in every email we send or by writing to privacy@flightdex.io. Withdrawal does not affect earlier processing. We answer within one month.
Complaints. Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), 1055 Budapest, Falk Miksa utca 9–11.; postal: 1363 Budapest, Pf. 9.; +36 1 391 1400; ugyfelszolgalat@naih.hu; https://naih.hu. You may also complain to the authority in your EU country of residence, or go to court (Art. 77 and 79 GDPR; section 23 Infotv.).
Age. The waitlist is for people aged 16 or over.
Sources: GDPR https://eur-lex.europa.eu/eli/reg/2016/679/oj · Infotv. https://net.jogtar.hu/jogszabaly?docid=a1100112.tv