Privacy Policy

1. Who is responsible

Controller for data processing on copilot.atlantic-iot.com is the operator named in the Impressum. Contact: carsten.renken@gmail.com.

2. What we store, and why

• Account data — email address, display name, a salted password hash (bcrypt — we never store your password), sign-up/sign-in timestamps, your subscription plan and its end date. Legal basis: contract performance (Art. 6(1)(b) GDPR).
• Payment data — payments are processed by SumUp Limited (EU). Your card details are entered on SumUp's payment page and never touch our server; we store only the plan purchased, amount, checkout id and — for auto-renewal — a card reference token held by SumUp. SumUp's privacy policy: sumup.com/privacy.
• Voice and chat processing — when you speak or type to the First Officer, the audio snippet / text (plus basic flight-sim telemetry for context) is sent to OpenAI (USA) to be transcribed and answered, and the reply is converted to speech. Per OpenAI's API terms this data is not used to train their models. We do not keep your audio; conversation text stays in your browser. Legal basis: contract performance; transfer safeguarded by the EU–US Data Privacy Framework.
• Optional transcript sharing — only if you enable "share transcripts" in Settings, individual text exchanges are logged on our server to improve the copilot. Off by default; legal basis: consent.
• Usage metering — we count your daily AI requests (numbers only) to enforce plan limits and prevent abuse.
• Technical error logs — if the app hits an error, a technical report (error message, browser version, page) is logged so we can fix it. No flight or voice content is included.
• Emails — we send transactional email only (password reset, renewal reminders, receipts). No marketing, no newsletters, no sharing of your address.

3. Cookies and local storage

We use no tracking cookies and no analytics. The app stores your settings and session locally in your browser (localStorage) — this stays on your device and is technically necessary, so no consent banner is required.

4. Third-party content the app loads

• Map tiles (CARTO/OpenStreetMap), weather & network data (aviationweather.gov, VATSIM), fonts/icons (Google Fonts, Cloudflare CDN on some pages): when these load, those services see your IP address. Aviation charts (FAA, NATS, Austro Control) are fetched through our server, and chart PDFs load directly from the authorities' servers when you open them.
• ChartFox — only if you actively connect your own ChartFox account (OAuth).

5. How long we keep data

Your account data is kept until you delete your account. Server backups are retained for 7 days. Billing records (plan, amount, date) are kept as long as commercial law requires. Error logs are size-capped and overwrite themselves.

6. Your rights

You have the right to access, rectify, export and erase your data, to restrict or object to processing, and to complain to a supervisory authority (for Germany: your state's Datenschutzbehörde).

Delete your account yourself at any time: in the app, open Settings → Advanced → Subscription → Delete account. This permanently removes your account, plan and usage records from our systems. Payment records held by SumUp are subject to their legal retention.

7. Simulation only

AI First Officer is a flight-simulation tool. It must not be used for real-world aviation.