1. Introduction
1.1. This Privacy Policy explains how Pilotlab collects, uses, shares and protects personal data when you visit pilotlab.app, create an account, keep a logbook, or use any of our Services, including the mobile app.
1.2. Pilotlab is a digital flight logbook and operations platform for pilots, flying clubs, flight schools and instructors. Much of what you record is about your own flying, but some of it is about other people, such as crew, students and instructors. This policy covers both.
2. Who we are
2.1. Pilotlab Ltd is the controller of the personal data described in this policy. Our registered address is 675 Coast Road, RD 1, Wainuiomata, Lower Hutt 5373, New Zealand.
2.2. Where a flying club, school or other organisation runs a workspace on Pilotlab and decides how its members' data is used, that organisation may be a controller too, and our Data Processing Addendum applies to the processing we carry out for it.
2.3. You can reach us about anything in this policy at privacy@pilotlab.app.
3. Whose data this covers
- Individual pilots using a personal workspace.
- Members, staff and instructors of a club, school or other organisation workspace.
- People named on a flight or sign-off who may not have a Pilotlab account themselves, such as crew, students, instructors and examiners.
- Visitors to our website.
4. Data we collect
| Category | Examples |
|---|---|
| Account and identity | Name, email address, password (stored only as a hash), workspace memberships and roles. |
| Logbook | Flights, including dates, aircraft, routes, times and crew roles, together with totals, remarks, weather and flight-track data. |
| Training and credentials | Licences, ratings, endorsements, exam and theory records, and the identity of the instructor or examiner who signed them. |
| Documents and notes | Files you upload, scans of paper logbook pages, and notes you write. |
| Club and school operations | Bookings, memberships, member documents, account balances and staff records. |
| Payments | Subscription and billing details. Card details are held by our payment provider, not by us. |
| Technical and usage | IP address, browser and device details, session data, product usage events and error reports. |
| Communications | Messages you send to our support team and emails we send to you. |
| Connected services | Encrypted access tokens for cloud storage you choose to connect for backups. |
4.1. We do not set out to collect special category data. A club may record a member's aviation medical class as an operational field. Where it does, access is limited to authorised club staff.
5. How we collect it
5.1. Most data comes directly from you as you use the Services. Some is collected automatically, such as usage and device data. Some comes from other people or sources:
- another member of your workspace, for example an instructor recording a lesson with you or a club admin adding you as a member;
- a pilot who names you as crew, student or instructor on a flight;
- public flight-tracking data, when you ask us to fill in a flight from its aircraft registration.
6. How we use your data, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Providing your logbook and workspace, and calculating totals and currency | Contract |
| Keeping a tamper-evident history of changes to your logbook | Legitimate interests (the integrity of your record), and legal obligation where a regulator requires it |
| Running club, school and instructor operations such as bookings and sign-offs | Contract, and legitimate interests |
| Letting club admins and instructors see members' logbook entries (see section 7) | Legitimate interests (instruction, oversight and safety) |
| Securing the Services and preventing abuse | Legitimate interests |
| Understanding how the Services are used and fixing faults | Legitimate interests |
| Account and service emails | Contract |
| Product updates and marketing emails | Consent, where the law requires it |
| Backing up to cloud storage you connect | Consent |
| Producing exports you choose to share with an authority | Contract, and at your direction |
6.1. The lawful bases above are those used in the UK and EU. Where the New Zealand Privacy Act 2020 or similar laws apply, we collect and use personal data only for these purposes and in line with those laws.
7. Who can see your logbook
7.1. Your logbook is yours. In a club, school or other organisation workspace:
- an ordinary member can see and export only their own logbook entries;
- a club admin, or a member the club has given an instructor or operations role, can see other members' entries so they can instruct, sign off training and meet their safety and oversight obligations;
- club dashboards and reports use totals and operational records such as bookings, not other members' personal logbook entries.
7.2. Joining a club workspace is your choice, and you can leave it. Leaving stops the club seeing your future entries.
8. AI processing
8.1. Some features use an AI model provided by a third party:
- when you import scans or photos of a paper logbook, the images are sent to the model to read the entries;
- when you use the in-app assistant, your questions, any voice messages, and the logbook data needed to answer them are sent to the model.
8.2. Logbook pages can contain the names of other people, such as crew and instructors. That data is sent only to carry out the task you asked for. Our AI provider, OpenAI, is listed on our Sub-processors page. OpenAI does not use data sent through its API to train its models. It keeps that data for up to 30 days to monitor for abuse, then deletes it.
8.3. We use scans you import to improve our own page reading only if you have opted in, and you can opt out at any time.
9. People named in your logbook
9.1. When you record a flight or an instructor signs a training record, the names of crew and the identity of the signer are saved with the record. This is what gives a logbook its value as evidence, so these details are not changed later if the person's account changes.
9.2. An instructor or examiner who does not have a Pilotlab account can sign through a single-use link sent to them by email.
9.3. If you are named in someone else's logbook and want to ask about it, contact us at privacy@pilotlab.app.
10. Sharing your data
10.1. We share personal data only:
- with sub-processors that host and support the Services, listed on our Sub-processors page;
- with cloud storage providers you connect, and only when you turn on backups, in which case the backup is written to your own storage;
- with other members of your workspace, within the limits in section 7;
- with a regulator or authority when you create and share an export, or where the law requires us to disclose it;
- with professional advisers, or a buyer in a corporate transaction, under confidentiality obligations.
10.2. We do not sell personal data.
11. Where your data is stored
11.1. Pilotlab is hosted by Amazon Web Services in Sydney, Australia. Some sub-processors, including our analytics, email and AI providers, process data in the United States and other countries.
11.2. When personal data leaves New Zealand, the UK or the EEA, we rely on the protections required by the applicable law, such as adequacy decisions, standard contractual clauses, or contractual safeguards comparable to the New Zealand Privacy Act 2020.
12. Security
12.1. Data is encrypted in transit and access within the platform is controlled by role. Tokens for connected services are encrypted at rest. Logbook history is protected at the database level so that it cannot be silently changed or deleted, even by our own staff.
12.2. To report a security issue, see our Vulnerability Disclosure Policy.
13. How long we keep data
| Data | How long we keep it |
|---|---|
| Your logbook and its change history | For as long as your account is open. After you close your account it is kept until you ask us to erase it. |
| Scans and staging data from logbook imports | 30 days after the import finishes |
| Exports you generate | 90 days. You can generate a new one at any time. |
| Other data you delete, or from a closed account | 60 days, then permanently deleted |
13.1. A logbook is a long-term record that pilots rely on for their licences, so we do not delete it just because time has passed. When you close your account we first send you a full export of your logbook. We erase it only if you ask us to.
14. Your rights
14.1. Depending on where you live, you have the right to access your personal data, correct it, erase it, restrict or object to how we use it, and receive it in a portable format. You can also withdraw consent where we rely on it.
14.2. Much of this you can do yourself: you can view, edit and export your logbook at any time. For anything else, email privacy@pilotlab.app. We may need to confirm your identity first, and we will reply within the time the law allows.
14.3. Erasing a logbook entry removes its content but leaves a marker showing that an erasure took place. This keeps the rest of your record verifiable. Where a regulator or a legal claim requires some of the record to be kept, we will explain what and why.
14.4. If you are unhappy with how we handle your data, you can complain to the Office of the Privacy Commissioner in New Zealand, the Information Commissioner's Office in the UK, or the data protection authority where you live. We would appreciate the chance to put it right first.
15. Marketing
15.1. We send product updates and marketing emails only where you have agreed to receive them or the law otherwise allows it. You can unsubscribe at any time using the link in any email, or by contacting us.
16. Cookies
16.1. Our use of cookies and similar technologies is described in our Cookie Policy.
17. Children
17.1. Pilot training can begin before adulthood. The Services are not directed at children under 15, and we do not knowingly collect personal data from anyone younger without the consent of a parent or guardian.
18. Changes to this policy
18.1. We will post any changes on this page and update the date shown at the top. If a change materially affects how we use your data, we will tell you by email or in the app before it takes effect.
If you have a question about this policy, or wish to exercise any of your rights, contact our privacy team.
privacy@pilotlab.app