In short. We keep the account and the flights you log so the app can work. We do not sell that data, and this website does not use advertising or analytics cookies. You can see, correct, or delete your data, and you can ask for a copy even if you are not on Zulu Pro. Payments go through Apple. We never see your card number.
Who we are
Zulu Aviation (“we”) is the controller of the personal data described here. That means we decide why and how it is used.
Privacy contact: support@zuluaviation.co.uk. We are established in the United Kingdom. We have not appointed a data protection officer; you do not need one to reach us. Use the same address for access, correction, deletion, and any other privacy request.
We reply within one month. If a request is complex, or you have sent several, we may extend that by up to two further months and we will tell you if we do.
What this notice covers
It covers personal data we process when you use the Zulu Aviation app, when you use this website (including the password reset page), and when you email us.
Please do not put health information, or anything else sensitive, in flight remarks or a support email. We do not ask for it, and we do not use remarks for any purpose other than storing the logbook entry you wrote.
What we use, why, and the lawful basis
UK GDPR requires a lawful basis for each use. We rely on contract where we need the data to provide the app you asked for, and on legitimate interests where we need it to answer you or keep the service secure. We do not rely on consent for the core service, so there is no separate consent to withdraw. You can stop using Zulu and you can ask us to delete the account.
| Data | Why | Lawful basis |
|---|---|---|
| Name and email address | Create your account, sign you in, and send service messages about the account. | Contract |
| Sign in with Apple identifier, and whatever name or email you choose to share with Apple’s sign-in | Authenticate you without a separate password. | Contract |
| Flight entries: airfields, times, aircraft, pilot function, landings, remarks, and similar fields you fill in | Provide the logbook, totals, statistics, currency, and export. | Contract |
| Optional profile, such as home airfield, licence type, hours, and ratings | Only if you add it, so features such as currency can use it. | Contract — we process it because you added it to use those features |
| Subscription status from Apple. Not your card number. | Know whether Pro features are unlocked. | Contract. Apple is the controller for the payment itself. |
| Email and new password on the reset page, plus the one-time code in the reset link | Complete a password reset you requested. The page then signs you out. | Contract |
| Support emails, and the address you wrote from | Reply, and keep a record of the problem in case you write again. | Legitimate interests. You can object. If you are an existing user, answering you is also part of the contract. |
| Connection logs a website host may keep: IP address, time, page, and browser | Deliver the page and investigate abuse or faults. | Legitimate interests. We do not use these logs to build a marketing profile. |
We do not use your data to advertise to you, and we do not sell it. This website does not run an analytics or advertising tool. The app does not currently include a third-party analytics SDK. If that changes, we will update this notice before it starts.
Currency dates and totals are arithmetic on the entries you stored. They are shown to you. They are not a decision about you that has a legal or similarly significant effect, and there is no solely automated decision-making of that kind.
You do not have to give us flight data, but the logbook cannot work without the entries you want it to keep. If you do not create an account, you cannot sync a book to our servers.
Who else sees it
We use processors who handle data only on our instructions. We do not share your logbook with other pilots, advertisers, or aviation authorities.
| Who | Role |
|---|---|
| Supabase, Inc. | Stores account and flight data, and checks password-reset links. Their privacy notice is at supabase.com/privacy. |
| Apple | Sign in with Apple, and App Store billing. Apple processes your payment under Apple’s privacy policy. We do not receive your card details. If you use iCloud on your own device, that storage is Apple’s, under your Apple ID, and is separate from the copy we hold. |
| Our website host | Sends you these pages. They may keep short security logs. We do not add our own tracker. |
| Email providers | Deliver messages to and from support@zuluaviation.co.uk. |
We also disclose data if the law requires it, or to establish or defend a legal claim. We will not sell the book as part of a business sale without telling you, and the buyer would have to honour this notice.
Transfers outside the UK
Supabase and Apple may process data outside the United Kingdom, including in the United States. Where a transfer is not covered by UK adequacy regulations, we rely on appropriate safeguards. Those are the provider’s data processing terms together with the UK International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses, as applicable.
You can ask us for a copy of the safeguards we rely on. We may redact parts that are commercially confidential.
How long we keep it
- Account, profile, and flights. For as long as the account exists.
- After you delete the account, or after we close it, we delete the personal data from live systems without undue delay, and in any case within 30 days. Encrypted backups are overwritten on the provider’s normal cycle and are not used for anything else.
- Support email. For 24 months after the last message in the thread, unless we need it longer to deal with a legal claim.
- Password reset. The code in the link only works for the short period Supabase allows, and the sign-in session on that page is ended as soon as the password is changed.
- Host logs. On the host’s ordinary short cycle. Where we control the period, no longer than 30 days.
You can delete the account in the app under Settings. If you cannot get into the app, email support@zuluaviation.co.uk from the address on the account and ask us to delete it. Export anything you want to keep first. Deletion is permanent.
Your rights
You can ask us to:
- confirm whether we hold personal data about you, and for a copy of it (access);
- correct data that is wrong;
- delete it, in the cases the UK GDPR allows;
- restrict how we use it while a dispute about it is unresolved;
- receive the data you provided, in a commonly used electronic format, and have us send it to another controller where that is technically feasible (portability);
- object to processing based on legitimate interests. We will stop unless we can show a compelling reason that overrides your interests, or we need the data for a legal claim.
EASA PDF and CSV export inside the app are Zulu Pro features. That does not limit these rights. On request we will give you a copy of the personal data we hold, free of charge, whether or not you pay for Pro. Write to support@zuluaviation.co.uk. We may ask for enough information to be sure it is your account.
If we refuse a request we will explain why, and you can complain to the ICO as set out below.
Children
Zulu is a pilot’s logbook. It is not directed at children under 13, and we do not knowingly create accounts for them. The age of digital consent in the UK is 13. If you believe we have data about a child under 13, email us and we will delete it.
Security
The app and this site are served over HTTPS. Account and flight data are stored with Supabase, which encrypts data in transit and at rest as part of that service. Access to production data is limited. No online service is perfectly secure, and we do not claim otherwise.
Cookies and similar storage
The marketing pages do not set analytics or advertising cookies, and they do not load fonts, scripts, or images from another company. A host may still set a strictly necessary cookie to deliver or protect the site. We do not use that to follow you around the web.
The password reset page stores a short-lived sign-in session in local storage on your device so the reset can finish. It is removed when the page signs you out. That storage is required for the reset you asked for, so we do not ask you to accept it with a banner. Details are on the cookie page.
Changes
If we change this notice we will post the new version here and change the date at the top. If a change materially affects how we use app data, we will also tell you in the app or by email where we have an address for you. We will not apply a new use to data we already hold until this notice describes it.
Contact and complaints
Email support@zuluaviation.co.uk.
You can complain to the Information Commissioner’s Office, the UK regulator for data protection: ico.org.uk/make-a-complaint, or call 0303 123 1113. We would like the chance to put things right first.