Privacy Notice

1. Controller and contact

EastProd s. r. o. is the data controller. The dedicated privacy contact and company details appear below. Use that contact for questions, exports, account deletion and rights requests.

2. Data and sources

You provide your name, email, language, login details, optional pilot profile, IGC/GPS files, media, comments and messages. Passwords are stored as hashes. Google sign-in provides an account identifier, verified email, name and possibly a profile image; we do not receive your Google password.

Flight data includes precise GPS tracks, location and time, altitude, sensor data, derived metrics and saved analysis. We also record team membership, sharing, API access, legal acknowledgements, subscription status and Stripe identifiers. Stripe handles full card numbers and CVC.

Use of the service generates technical and security data, such as IP addresses, device and session details and error records. Listed external sources provide weather, terrain and site context. A precise track can reveal habits and places you visit.

3. Purposes and legal bases

Accounts, flight storage and analysis, requested AI, teams, exports and subscriptions are processed to perform the contract under GDPR Article 6(1)(b). Without information necessary for an account or requested feature we cannot provide it; supplementary profile fields and unused features are optional.

Security, abuse prevention, diagnostics and protection of rights rely on legitimate interests under Article 6(1)(f). Accounting and legally required records rely on Article 6(1)(c). Optional preference storage relies on consent; withdrawing it does not affect the lawfulness of earlier processing.

4. Recipients and transfers

Authorised personnel and infrastructure, email, payment, AI and map providers receive information relevant to the feature used. Providers may act as processors or independent controllers. The Providers page describes purposes, data categories and relevant links.

The main application and database run on AWS in Frankfurt, Germany. External services may process information outside the EEA. Such transfers require an applicable legal mechanism, such as an adequacy decision or Standard Contractual Clauses; request information about applicable safeguards by email.

5. Public links, teams and API

You enable public sharing for a flight and can revoke its link. Anyone holding that link may see the exposed information, including location. Joining a team exposes the flight and profile information available through the team feature to its current members.

API tokens, webhooks and exports you authorise can transfer data to your selected recipient. Protect links and tokens. Revocation stops further access through that feature but cannot remove earlier external copies.

6. Requested AI features

AI debriefs, translations, weather text and LIVE AI send OpenAI the context needed for the requested output, such as flight metrics, title and site, time, weather and selected pilot profile fields. The scope varies by feature and can include location data. We do not send passwords or card details.

We may store output with a flight or in a cache. AI scores and text are advisory; we do not use them for solely automated decisions with legal or similarly significant effects on users.

7. Mobile app and diagnostics

LIVE uses GPS, barometer and other available sensor and technical data to record and display flights. Device settings control location and sensor permissions; refusing them can limit the relevant feature.

The mobile beta stores diagnostic flight logs on the device and may automatically upload completed-flight logs to your private XCInsight account when connected. Logs can include precise location, sensor readings, flight events and the app version. Consider their contents before sharing diagnostic files with others.

8. Retention and deletion

Account, flight, media and analysis data is kept while providing the service until you delete it or request account deletion. Diagnostic and security records are retained for the time needed to investigate errors, incidents and legal claims, considering the event type, investigation and applicable limitation periods.

Operational backups include database and file data and are replaced with newer copies. Current rotation retains backups of the last ten deployments, so their calendar age depends on deployment frequency. Deleted data may remain in isolated backups until retirement; valid deletion requests must be reapplied after restoration.

Accounting and tax records are retained for statutory periods, generally ten years. Other legal and complaint records follow the applicable obligation or claim duration. Account deletion does not remove a legal duty to keep these limited records.

9. Your rights

Subject to GDPR conditions, you have rights of access, rectification, erasure, restriction, portability and objection to processing based on legitimate interests. Withdraw storage consent through Cookie settings. Request an export or account closure at the privacy contact; individual flights can be managed in the app.

We normally respond within one month. A lawful extension may apply to complex or numerous requests; we will explain why. We may proportionately verify identity. You may complain to a competent supervisory authority, especially where you live or work.

Úrad na ochranu osobných údajov SR

10. Security and updates

We use access controls, encrypted connections, password hashing and abuse protections. Protect your account and device too. We update this notice and inform users when processing materially changes, and obtain new consent where required.

Team sharing and recipients

If you join an XCInsight team, other current members of that team become recipients of the flight and profile information made available in the team interface, including flight locations and tracks. This sharing is necessary to provide the team feature you explicitly join and is processed as part of providing the requested service.

Leaving a team or being removed stops future authenticated team access. Information another member previously viewed, exported, screenshotted or otherwise lawfully obtained outside XCInsight cannot always be technically recalled. Team invitations and membership events are logged for security, administration and dispute handling.