Privacy policy

1. Who we are

PlaneLogs is the entity responsible for the personal information described here. You can reach us at [email protected].

2. What we collect

• Account data: name, email address, password hash, and the organisations and aircraft you have been granted access to.
• Logbook and maintenance data: flight entries, aircraft details, maintenance and inspection records, parts, attachments and any documents you upload. Some of this identifies you or other named individuals, such as the pilot or the person who signed off a task.
• Licence and certification data: where you choose to record licences, ratings or medical expiry dates, we store what you enter.
• Technical data: IP address, browser and device information, server logs, and error reports and page performance measurements sent from your browser while you use the Service.
• Mailing list: if you ask for product news on our website, your email address and when you asked. We use it for that and nothing else. Every email we send to the list has an unsubscribe link, and you can also ask us to remove your address at any time.

3. Why we use it

• To provide the Service: storing your records, producing reports, and enforcing access.
• To authenticate you and keep accounts secure.
• To support you, including investigating problems you report and, where necessary to do so, accessing your records.
• To send service messages: expiry and inspection alerts you have configured, security notices, and changes to these policies.
• To detect and prevent abuse, fraud and security incidents.
• To improve the Service, using aggregated or de-identified usage information.

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Where the GDPR or a similar law also applies, our legal bases are: performance of a contract (to provide the Service), legitimate interests (security, abuse prevention, improving the Service), and consent where we ask for it, for example for marketing email, which you can withdraw at any time.

4. Who we share it with

We do not sell personal data and we do not share it for advertising. We share it with:

• Other users you have granted access to: an aircraft's records are visible to the people and organisations authorised on that aircraft, including the author of each entry.
• Service providers acting on our instructions: a hosting provider, which runs our servers and database; a network and storage provider, which carries all traffic to and from the Service and stores uploaded files and database backups; a monitoring provider, which receives logs, error reports and performance data; and an email provider, which delivers account and service email. Each is bound by contract to protect the data and use it only to provide their service to us.
• Authorities, where we are legally required to disclose, or to establish or defend legal claims.
• A successor, if the business is merged or acquired; you will be told before your data becomes subject to a different policy.

5. International transfers

Our servers and database are in Australia, and our monitoring and email providers handle data in Australia too. Some personal information is handled overseas, including in the United States: web traffic passes through our network provider's global network, and that provider stores uploaded files and database backups without a guarantee that they stay in Australia. Where this happens we take reasonable steps under Australian Privacy Principle 8 to ensure the recipient handles it consistently with the Australian Privacy Principles, and rely on an approved transfer mechanism such as the standard contractual clauses where the GDPR applies.

6. How long we keep it

Account and record data is kept while your account is active. After closure, records are retained for 90 days so that you can recover or export them, then deleted or anonymised. Database backups are kept for 14 days, so deleted data is gone from them 14 days later.

Aviation records carry their own statutory retention requirements. CASA sets minimum retention periods for maintenance records and logbooks. Deleting data here does not discharge an obligation you have to keep it elsewhere.

7. Security

Data is encrypted in transit, database backups are encrypted before they leave our servers, access is restricted to staff who need it, and credentials are stored hashed. No system is perfectly secure. If a breach affects your personal data we will notify you and any regulator as required by law.

8. Your rights

Under the Australian Privacy Principles you may ask for access to the personal information we hold about you and ask us to correct it. Depending on where you live you may also have rights to deletion, restriction, objection, data portability, and withdrawal of consent. Mail [email protected] and we will respond within the time the applicable law allows, which is 30 days for an access request under the Privacy Act. If you are not satisfied with our response you may complain to the Office of the Australian Information Commissioner (oaic.gov.au), or to your local data protection authority.

Where you are recorded in another user's maintenance record, as the pilot on a flight or the person who performed a task, that entry may need to be retained for the integrity of the aircraft's history, and we may not be able to delete it on request.

9. Cookies

We use cookies that are necessary for the Service to function, principally to keep you signed in and to protect against cross-site request forgery. Our error and performance monitoring also stores a session identifier in your browser, so that reports from one visit can be grouped together. We do not use advertising cookies or track you across other sites.

10. Children

The Service is not directed at children under 16, and we do not knowingly collect their personal information. If you believe a child has given us their information, contact us and we will delete it.

11. Changes

We may update this policy. Material changes will be notified by email or in the Service before they take effect, and the date at the top will change.

12. Contact

Privacy questions: [email protected]. Other ways to reach us are on the contact page, and the terms of service govern your use of the Service.