Privacy Policy

Who is responsible

AflyZon is operated by Luciano Arnal Mahon.

Contact: aflyzon@gmail.com

The operator is the controller of your personal data under the EU General Data Protection Regulation (GDPR).

What we collect

• Your account: your email address and the name you enter.
• Your password, which is handled by Supabase Auth: it is stored only as a secure hash, and AflyZon never sees it.
• Profile data you choose to save, such as your photo, bio, nationality, licence, home airport and flight hours; your phone number and date of birth if you add them, which only you can see; your pilot profile (personal minima and aircraft) and your progress in training challenges.
• Reviews you post on About Us: your rating and text. They are shown publicly with your name, photo and licence.
• Technical data needed to run the site: IP address, browser type and the pages requested, in the hosting provider's logs, and anonymous visit statistics.

Why we use it

• To create and run your account, sign you in and keep your profile and settings across your devices (to provide the service you asked for, Article 6(1)(b) GDPR).
• To publish the reviews you choose to post (same basis).
• To keep AflyZon secure and working, for example to prevent abuse, and to understand in aggregate how the site is used so we can improve it (our legitimate interest, Article 6(1)(f) GDPR).

Who processes it for us

• Supabase stores your account, profile and reviews and handles sign-in (database, authentication and file storage).
• Vercel hosts the website, delivers its pages and provides anonymous visit statistics (Vercel Web Analytics, which uses no cookies).

Both act as our processors, only on our instructions. Where they process data outside the European Economic Area, they rely on the safeguards the GDPR requires, such as the European Commission's standard contractual clauses. Some maps and libraries are loaded by your browser directly from their providers (for example OpenFreeMap and the jsDelivr network), which receive your IP address as any website you visit does.

Data stored on your device

• Your browser keeps your preferences (such as the language), your pilot profile and, if you use the offline features, the weather of the airports you saved, in its local storage (localStorage and IndexedDB), and your signed-in session, which Supabase keeps in localStorage. This data stays on your device.
• We use only cookies that are strictly necessary: the sign-in session for the Weather tools, your language choice and, for invited visitors who enter an access code, the private access cookie. That cookie only gives access to the sections that are not public yet; it is HttpOnly (the page's scripts cannot read it) and expires 24 hours after the code is entered. There are no advertising or tracking cookies.
• You can delete this data at any time in your browser's settings.

How long we keep it

We keep your account data for as long as your account exists. Encrypted backups are kept for up to 30 days.

To delete your account and its data, write to aflyzon@gmail.com from the email address of your account. We will delete it within one month and confirm it to you.

Your rights

Under the GDPR you can ask to access, correct or delete your data, to restrict or object to its processing, and to receive it in a portable format. Where processing is based on your consent, you can withdraw it at any time.

To exercise your rights, write to aflyzon@gmail.com. We will answer within one month.

If you think your data has not been handled correctly, you can complain to a data protection authority; in Spain, the Agencia Española de Protección de Datos (aepd.es).

No sale of data, no advertising

AflyZon does not sell personal data, does not show advertising and does not share your data with anyone except the providers named above.

Changes to this policy

We may update this policy. The date at the top shows the current version; if a change is significant, we will inform signed-in users.