1. Data Controller

The data controller for personal data processed through the Platform is:

2. Personal Data We Collect

We collect and process the following categories of personal data:

• Account Data: name, email address, company name, job title, phone number
• Usage Data: pages visited, features used, interaction timestamps, browser type
• Document Data: uploaded AOC, ARC, insurance certificates, and extracted compliance information
• Communication Data: correspondence with our support, sales, and legal teams
• Technical Data: IP address, device identifiers, cookies and similar tracking technologies

We do not intentionally collect special categories of personal data (such as health information, political opinions, or biometric data). Any such data inadvertently included in uploaded documents is processed solely for the purpose of document verification and is immediately deleted after extraction.

3. Legal Basis for Processing

We process personal data under the following legal bases:

• Contractual Necessity: To provide the Platform services you have subscribed to
• Legitimate Interests: To improve our services, ensure security, and communicate with users
• Consent: For marketing communications where you have opted in
• Legal Obligation: To comply with applicable aviation regulations and record-keeping requirements
• Vital Interest: In exceptional circumstances related to aviation safety

4. Data Sharing & Third Parties

We share personal data only with trusted third-party service providers who process data on our behalf:

• Google Cloud (europe-west1, Belgium): AI processing via Gemini API
• Supabase (AWS eu-central-1, Frankfurt): Database and storage infrastructure
• Resend: Transactional email delivery
• Vercel: Frontend hosting and analytics

All third-party providers are contractually bound to process data exclusively within the European Economic Area (EEA) and in compliance with GDPR. We do not sell your personal data to third parties.

5. Data Retention

We retain your personal data only as long as necessary:

• Account data: for the duration of your account plus 12 months after termination
• Document data: 7 days post-processing unless longer retention is agreed
• Usage analytics: 24 months
• Communication data: 36 months from last contact

6. Your GDPR Rights

Under the General Data Protection Regulation, you have the following rights:

• Right to Access: Request a copy of your personal data we hold
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure: Request deletion of your data (“right to be forgotten”)
• Right to Restrict Processing: Limit how we use your data
• Right to Data Portability: Receive your data in a machine-readable format
• Right to Object: Object to processing based on legitimate interests or direct marketing

To exercise any of these rights, contact our Data Protection Officer at dpo@aerovectra.com. We will respond within 30 days. You also have the right to lodge a complaint with the State Data Protection Inspectorate of Lithuania.

7. Data Security

We implement appropriate technical and organisational measures to protect your personal data:

• Encryption in transit: TLS 1.3 on all connections
• Encryption at rest: AES-256 for all database storage
• Access control: Role-based access with strict least-privilege policies
• Audit logging: All access to personal data is logged and monitored
• Regular security assessments and penetration testing

8. International Data Transfers

All personal data is processed and stored within the European Economic Area (EEA). Our infrastructure is hosted exclusively in EU-based data centres (Frankfurt, Germany and Belgium). We do not transfer your personal data outside the EEA.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated “Last updated” date. For material changes, we will notify you via email or through the Platform.