PRIVACY POLICY
LAST UPDATED: SEPTEMBER 2026 · VERSION 2.7 · GDPR · UK-GDPR · CCPA/CPRA · UAE-PDPL · KSA-PDPL
1. Controller & Contact
v1prep (“we”, “us”, “our”) is the trading name under which the Operator (a natural person or legal entity identified in our Legal Notice / Imprint) provides the Service. The Operator is the Data Controller for personal data processed through the Service, as that term is defined in Article 4(7) GDPR / UK-GDPR. For any privacy enquiry please use our Contact form with subject “Privacy Request”. A formal Data Protection Officer (DPO) is appointed only if mandated by Art. 37 GDPR (most solo operators are exempt); where no DPO is required, privacy requests are handled directly by the Operator via the Contact form.
2. Scope
This policy applies to all users of the Service worldwide. Regional laws apply in addition — we have included specific sections for EU/EEA & UK, California, other US states, UAE and Saudi Arabia.
3. What data we collect
- Account data — name, email, hashed password, plan tier, account creation date, language and theme preference.
- Usage data — questions attempted, correctness, session duration, streak, bookmarks, flagged questions, error reports.
- Payment metadata — billing country, plan purchased, subscription status, transaction reference. Card data is handled exclusively by Gumroad (PCI-DSS Level 1). We never see or store card numbers or CVVs.
- Contact data — name, email, organisation, message content (if you contact us).
- Technical data — IP address (in our hosting provider's server logs), browser type, device type, referrer, approximate region (from IP), timestamps.
- Device and session data — when you are signed in: a random device identifier, time zone, browser language and browser type for each session, used to keep accounts secure and to detect account sharing.
- Support data — correspondence content and attachments you send to support.
- Flight school data — only if you join a flight school on v1prep with the code it gave you: which school you joined and when. While you are a member, the school’s instructors can see your name, email, when you last studied and your progress by subject (questions answered, correct answers, number of sessions and the date of the last one), never your individual answers. You can leave the school at any time in My Account, and an instructor can remove you; either ends the sharing at once.
- CV data — only if you press Send my CV on the Pilot CV Builder: the CV you built (for example your name, contact details, nationality and right to work if you entered them, licences, ratings, medical class and expiry, flight hours, jobs, education and languages), the airline you chose and your notes. We use it only to optimise that CV and send it back to you. Until you press Send, the CV stays in your browser and we never see it.
- Training quote requests — only if you press Request a quote on the Type Rating Training Map: your name, e-mail, the centre and type rating you chose, and what you add (licence, total hours, when you would like to start, your message). With the consent you give in the form, we send it to that centre only, which then answers you directly and handles your data under its own privacy policy. We do not sell it or pass it to anyone else.
We do not knowingly collect special-category data (health, biometric, genetic, political, religious, sexual-orientation data) and ask you not to submit any. We do not engage in automated decision-making or profiling with legal or significant effect on you.
4. Purposes & lawful bases (GDPR Art. 6)
| Purpose | Lawful basis |
|---|---|
| Create and operate your account | Contract §6(1)(b) |
| Deliver Content and track progress | Contract §6(1)(b) |
| Process payments and prevent fraud | Contract §6(1)(b) · Legal obligation §6(1)(c) |
| Send transactional emails (receipts, resets, a reminder before a paid access ends) | Contract §6(1)(b) |
| Optimise a CV you send us and send it back (Pilot CV) | Contract §6(1)(b) |
| Pass a training quote request to the centre you chose | Consent §6(1)(a) — the box in the form; withdraw it by writing to us before we pass the request on |
| Show your progress by subject to the instructors of a flight school you joined | Consent §6(1)(a) — given by joining with the school’s code, withdrawn by leaving the school |
| Answer support requests | Contract §6(1)(b) · Legitimate interest §6(1)(f) |
| Accounting & tax records | Legal obligation §6(1)(c) |
| Site security, abuse/fraud prevention, log analysis | Legitimate interest §6(1)(f) |
| Aggregated usage analytics (no personal profiling) | Legitimate interest §6(1)(f) |
| Marketing emails & newsletters | Consent §6(1)(a) — opt-in & opt-out anytime |
| Non-essential cookies & tracking | Consent §6(1)(a) · ePrivacy Art. 5(3) |
5. Third-party processors & recipients
| Processor | Purpose | Location |
|---|---|---|
| Gumroad | Payment processing (Merchant of Record), VAT/sales-tax handling, invoicing | USA — SCCs + supplementary measures |
| Google Firebase (Cloud Firestore, Cloud Functions) | Account database, sign-in and payment functions, study-progress sync, event log, contact-form messages and training quote requests, and the pilot tools’ live weather and flight briefing (the airport codes and departure time you enter are sent, with your account e-mail and sign-in token when you are signed in, to check what your account includes, and nothing is stored; v1prep’s server then asks the US Aviation Weather Center for the weather, aerodrome and pilot-report data, OpenTopoData for terrain heights, and, once connected, the US FAA NOTAM service for NOTAMs, sending them only airport codes and coordinates, never your details) | USA/EU — SCCs + Data Privacy Framework |
| Resend | Email: welcome, receipts, password resets, reminders before a paid access ends, news for those who opted in, and a CV or a contact-form message you send us (delivered to our own mailbox) | USA — SCCs |
| Hostinger | Website hosting, TLS, server logs, and our mailbox (support e-mail and CVs sent for optimisation) | EU — SCCs where applicable |
| Anthropic (Claude) | AI assistance when we optimise a CV you send us, and in answering support e-mail; only the CV, your notes and the e-mail concerned | USA |
| Plausible Analytics | Cookieless page and event analytics; events carry no email, name or message text | EU |
| Google Analytics 4 (Google Ireland Ltd / Google LLC) | Page and event analytics, only if you accept analytics cookies; events carry no email, name or message text, advertising features are off and Google Analytics 4 does not log or store IP addresses | EU/USA — SCCs + Data Privacy Framework |
| Sentry | Error reports from the app (page address, browser, a random device identifier; no email) | EU |
| OpenStreetMap tile servers and Cloudflare (cdnjs) | Only on the Type Rating Training Map page: map tiles and the Leaflet map library; your IP address and the page address reach them when the map loads | EU/USA — SCCs where applicable |
All processors are bound by Data Processing Agreements and are contractually restricted to processing your data only on our documented instructions.
6. International transfers
Some processors operate outside the EU/EEA and UK. When we transfer personal data to such countries we rely on: the EU Commission adequacy decision (if any), Standard Contractual Clauses (SCCs) 2021/914, the UK International Data Transfer Addendum, or (for US-Data-Privacy-Framework-certified recipients) the DPF. You may request a copy of the safeguards we use.
7. Retention periods
| Category | Period |
|---|---|
| Account data (active account) | As long as the account is active |
| Account data (after deletion request) | 30 days then erased |
| Transaction records, invoices, tax | 10 years (legal obligation) |
| Usage & progress data | 24 months then anonymised |
| Server access logs | 90 days |
| Security logs (incident investigation) | 12 months |
| Support correspondence | 24 months |
| A CV sent for optimisation (the CV, your notes, the optimised version) | 90 days after we send it back, then deleted from our mailbox; the record that you sent one (date, account, how it was paid) is kept with transaction records |
| A training quote request | 12 months, then deleted |
| Marketing consent / opt-out records | 3 years after last interaction |
8. Security
We apply appropriate technical and organisational measures including TLS 1.2+ in transit, passwords stored on our servers only as one-way hashes and never kept in your browser (a revocable device token is used instead), restricted access to production systems, logging, security patching, supplier due-diligence, and incident-response procedures. No system is 100% secure and we cannot guarantee absolute security.
9. Breach notification
In the event of a personal-data breach likely to result in a risk to your rights and freedoms we will notify the competent supervisory authority within 72 hours (GDPR Art. 33) and will notify affected individuals without undue delay where the breach is likely to result in a high risk (Art. 34).
10. Cookies & similar technologies
We describe cookies and browser-storage usage in a separate Cookie Policy. You can change your preferences at any time via the “Cookie Settings” link in the footer.
11. Your rights (all regions — summary)
- Access — obtain a copy of your personal data.
- Rectification — correct inaccurate or incomplete data.
- Erasure (“right to be forgotten”) — request deletion subject to legal retention.
- Restriction — limit processing while a dispute is pending.
- Portability — receive your data in a commonly-used machine-readable format.
- Object — to processing based on legitimate interest or direct marketing.
- Withdraw consent — at any time, without affecting prior lawful processing.
- Not be subject to solely automated decision-making — with legal or significant effect (we do not engage in this).
- Lodge a complaint with your supervisory authority (see regional sections).
To exercise any right, use our Contact form. We respond within 30 days (GDPR) or 45 days (CCPA/CPRA); we may ask you to verify identity before acting on a request. There is no fee; excessive or manifestly unfounded requests may be charged or refused.
12. Children's privacy
The Service is not intended for children under 16 (EU/EEA) or 13 (US/UK). We do not knowingly collect data from such children. If you believe a child has provided us data, contact us and we will delete it promptly.
13. EU/EEA supplement (GDPR)
If you are in the EU/EEA, the General Data Protection Regulation (EU) 2016/679 applies. You may lodge a complaint with the supervisory authority of your country of residence, work or alleged infringement. A list of EU DPAs is available at edpb.europa.eu. If we do not have an establishment in the EU we will designate an EU representative (Art. 27); their contact details will appear in our Legal Notice.
14. UK supplement (UK GDPR & DPA 2018)
If you are in the UK, the UK General Data Protection Regulation and the Data Protection Act 2018 apply. You may complain to the Information Commissioner's Office (ICO) at ico.org.uk or 0303 123 1113. If we are based outside the UK we will designate a UK representative where required by Art. 27 UK-GDPR.
15. California & other US residents (CCPA/CPRA & state privacy laws)
Notice at collection: in the previous 12 months we have collected the categories of personal information listed in section 3 (identifiers, commercial information, internet/network activity, geolocation approximation, inferences). Purposes and disclosures are described above. We retain each category as set out in section 7.
Sale / sharing: we do not sell your personal information and we do not share it for cross-context behavioural advertising, as those terms are defined by the CCPA/CPRA.
Your California rights: the right to know, delete, correct, limit the use of sensitive personal information (we do not collect such information), opt-out of sale/sharing (N/A), and the right to non-discrimination for exercising any right. You may also make a “Shine the Light” request (Cal. Civ. Code § 1798.83).
Global Privacy Control: we honor the GPC browser signal as an opt-out of sale/sharing where applicable.
How to exercise: submit a request via our Contact form. Authorised agents may act on your behalf with written authorisation and identity verification.
Other states: residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA) and other states with comparable laws have equivalent access, deletion, correction and opt-out rights. Submit requests via the Contact form.
16. Middle East supplement (UAE PDPL, Saudi PDPL)
If you are in the United Arab Emirates, Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) applies. You have rights comparable to the GDPR: access, correction, erasure, restriction, objection, portability and withdrawal of consent. Complaints may be addressed to the UAE Data Office.
If you are in the Kingdom of Saudi Arabia, the Personal Data Protection Law (Royal Decree M/19 of 2021, as amended) applies. You have comparable rights of access, correction and deletion; cross-border transfers are permitted only with appropriate safeguards and, where required, authorisation of the Saudi Data & AI Authority (SDAIA).
Other Middle-Eastern jurisdictions (Bahrain, Qatar QFC, DIFC Law 5 of 2020, ADGM) have similar regimes; we honour equivalent rights. Submit requests via our Contact form.
17. Other regions
We honour equivalent privacy rights granted under applicable law to residents of Canada (PIPEDA/Law 25 Quebec), Brazil (LGPD), Switzerland (revFADP), Australia (Privacy Act 1988), Japan (APPI), South Korea (PIPA), Singapore (PDPA), and others.
18. Changes to this policy
We may update this Policy to reflect changes in law or our practices. Material changes will be notified via email or a prominent site banner at least 30 days before taking effect. The “Last updated” date at the top reflects the latest revision.
19. Contact
Privacy enquiries, rights requests, complaints: use our Contact form. DPO and EU/UK representative details (where appointed) appear in our Legal Notice / Imprint.