Who we are
Boplo Flight (“Boplo”, “we”) is run by BOPLO. We are the data controller for the personal data described here. Contact us about privacy at support@boplo.app.
What we collect
| Data | Examples | Where it comes from |
|---|---|---|
| Account | Email address, name, and a basic Google profile if you sign in with Google | You, or Google with your permission |
| Training records | Your licence goal, school, aircraft, flights, routes and GPS tracks, debrief notes, lesson preparation, study and radio practice progress, document expiry dates | You |
| Billing | Your plan, trial and subscription status, billing country, and a Stripe customer reference. Card details go straight to Stripe; we never see or store them. | You and Stripe |
| Technical | A sign-in cookie, IP address, browser type and request logs used to run and secure the service | Your device |
We don’t ask for sensitive data such as health information. Please don’t put medical details in your notes; for your medical certificate we only need its expiry date.
Why we use it
- To provide Boplo Flight (performing our contract with you): your desk, logbook, progress, maps, weather lookups, simulator and the features you use.
- To take payments and keep records (contract and legal obligation): subscriptions, invoices and the tax and accounting records the law requires.
- To keep the service secure and working (legitimate interests): preventing abuse and fraud, fixing errors and understanding which features are used, in aggregate.
- To email you: sign-in links and messages about your account and payments. We only send marketing emails if you agree, and you can unsubscribe at any time.
Features that use other services
- Ask Boplo: when you ask a question, we send it, your recent messages in that chat, and a short summary of your desk (licence and authority, hours, next lesson and preparation, syllabus progress and your last few flights with debrief notes) to Anthropic’s Claude API to write the answer. Anthropic doesn’t use this data to train its models. Your chat history is kept in your browser, not on our servers; we only count how many questions you ask each day.
- Voice debrief: speech-to-text runs in your browser. Your browser’s provider (for example Google in Chrome or Apple in Safari) may process the audio. If you choose Tidy up, the text of your debrief is sent to Google’s Gemini API to organise it.
- Weather: when you look up weather, our server asks NOAA’s Aviation Weather Center for the airport or area you chose.
- Maps and simulator: your browser loads map, terrain and 3D scenery from Google Maps Platform, OpenFreeMap, EOX, Amazon Web Services and code from public CDNs (jsDelivr, unpkg). These providers receive your IP address and the area being viewed. Using the 3D scenery also means agreeing to the Google Maps/Google Earth Additional Terms of Service and the Google Privacy Policy.
- Instructor link: if you create one, anyone with the link can see your first name, next lesson, preparation, syllabus progress, totals and recent flights with debrief notes. You can turn it off at any time.
Who we share it with
We don’t sell your data or use it for advertising. We share it only with providers that help us run Boplo, under contracts that protect it:
| Provider | What for |
|---|---|
| Cloudflare | Hosting, database and security |
| Stripe | Payments, subscriptions, invoices and tax |
| Anthropic | The Claude API, which writes Ask Boplo’s answers |
| Sign in with Google, the Gemini API (debrief tidy-up, and Ask Boplo if Claude is unavailable) and Map Tiles (3D scenery) | |
| Resend | Sending sign-in and account emails |
Some providers are outside the European Economic Area, mainly in the United States. Where that happens, transfers are protected by the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses. We may also disclose data where the law requires it.
How long we keep it
We keep your account and training records until you delete your account. Deleted data is removed from our live systems straight away and from backups within 30 days. Payment and invoice records are kept for as long as tax and accounting law requires (in Spain, usually up to six years), by us and by Stripe.
Your rights
You can access, correct, download or delete your data, and object to or restrict how we use it. Most of this you can do yourself: edit your profile, use Download everything in Profile → Your data, or Delete my account. For anything else, email support@boplo.app; we reply within one month.
If you’re unhappy with how we handle your data, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos, or to the authority where you live (in the UK, the ICO).
Cookies and local storage
We use one essential cookie, boplo_session, to keep you signed in. Your browser’s local storage holds small preferences on your device, such as simulator settings and a cost plan you made before signing up. Stripe sets cookies needed to prevent fraud on the payment form. We don’t use advertising or analytics cookies; if we add any, we’ll ask first.
Children
Boplo Flight is for people aged 16 and over. If you’re under 18, you need a parent or guardian’s permission to buy a subscription.
Security
Data is encrypted in transit, sign-in sessions are stored only as hashes, and access to production systems is limited. No system is perfectly secure; if a breach affects you, we’ll tell you as the law requires.
Changes
If we change this policy in a meaningful way, we’ll tell you in the app or by email before the change applies.