Privacy Notice

The controller responsible for the processing described in this notice is:

This notice covers the web application, its same-origin API, and the operational data handled through them. Data comes from you, Virtual Airline administrators and dispatchers, the configured authentication provider, and—when live ACARS is enabled—participating Hoppie's ACARS stations.

The service is multi-tenant. Membership and operational records are restricted to the Virtual Airline organization associated with your authenticated account.

You are not legally required to provide this information. Account and core operational data are, however, necessary to provide the signed-in service. Without them, an account or requested dispatch function may not be available.

Authorized Virtual Airline members receive only the information their operational role permits. The following providers process data to run the service:

• Clerk, Inc. — account authentication, organization membership, sessions, and abuse protection. See the Clerk Data Processing Addendum.
• Vercel Inc. — application hosting, delivery, server execution, infrastructure logs, privacy-preserving web analytics, performance measurement, and bot and abuse detection. See the Vercel Data Processing Addendum.
• Neon, LLC — managed application database and backups. See the Neon Data Processing Agreement.
• Hoppie's ACARS — only when a tenant configures its Hoppie ground station. Station identifiers and messages are relayed through a Netherlands-hosted hobby network. Hoppie warns that ACARS is not a private messaging system and messages may be visible to others. Never put personal, confidential, or special-category data in an ACARS message. See the Hoppie privacy statement.

Some providers are established in the United States or use subprocessors outside the European Economic Area. Where personal data is transferred to a country without an EU adequacy decision, the controller relies on an applicable transfer mechanism such as the EU Standard Contractual Clauses and supplementary safeguards. Where a provider is validly certified, the EU–US Data Privacy Framework may be used. Current subprocessor and transfer details are available from the provider documents linked above.

The current application does not use advertising or marketing cookies. Optional Vercel Web Analytics stores anonymized aggregate data without analytics cookies, and Speed Insights reports browser performance metrics. Both remain off until you select “Allow anonymous analytics”. Vercel BotID is always active on protected mutations: it runs a browser challenge and sends proof and security signals with those requests.

Authentication and security storage is strictly necessary to provide the signed-in service requested by the user (Section 25(2)(2) TDDDG). The privacy preference is stored only after you make a choice. Optional Analytics and Speed Insights rely on your consent under Section 25(1) TDDDG and Article 6(1)(a) GDPR. You can withdraw that consent at any time through “Cookie settings” in the footer; future optional telemetry then stops. You can also inspect or clear site data in your browser at any time.

Subject to the applicable conditions, you have the right to access your data (Article 15 GDPR), rectify inaccurate data (Article 16), erase data (Article 17), restrict processing (Article 18), receive portable data (Article 20), and object to processing based on legitimate interests (Article 21). You may also withdraw consent at any time for future processing. This deployment relies on consent only for optional Vercel Analytics and Speed Insights.

Send a request to fabian@shiftbloom.studio. We may need to verify your identity before disclosing or changing account data.

You have the right to lodge a complaint with a data-protection supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or the alleged infringement. The authority configured for the controller is Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD).

The service uses role-based access, tenant isolation, encrypted transport, encrypted storage for provider credentials, request-level audit identifiers, and security headers. Access is limited to people and providers who need it for the stated purposes. No solely automated decision with legal or similarly significant effects is made. BotID automatically classifies protected requests for abuse prevention as described above; it is not used for marketing or member evaluation.

This notice is updated when processing purposes, providers, browser storage, or legal requirements change. A changed notice version causes the cookie notice to be shown again. Material changes that require consent will not take effect for optional processing until valid consent has been obtained.