Privacy policy
Version 1.1 · 15 November 2026 · applies to Astra Aviation (the school system), the ad-astra OFP planner, the Astra Exams add-on and the website astraaviation.tech.
1. Who is responsible
For a school's data (its students, staff, aircraft, bookings and records) the school is the controller. Astra Aviation processes that data on the school's behalf and only on its instructions, under a data processing agreement that is part of the school's contract. If you are a student or staff member of a school, ask the school first; we help it answer.
For the website, demo requests, the free planner and our own customer relationship we are the controller: Mohammad Al Hussein (enskild firma, trading as AstraDev), org. no. 20030804-7554, Skansgatan 8, 211 32 Malmö, Sweden. Contact: see section 10.
2. What we process, and why
| What | Why | Legal basis |
|---|---|---|
| Account: name, username, optional email and phone, role in the school, language and time zone | To sign in and give each person exactly the access their role allows | Contract with the school; for the school, its own legal obligations and contract |
| Training and operations: courses, lessons, grades and comments, flight and duty times, bookings, availability, aircraft and defects, flight documents (OFP, mass and balance, flight plans) and uploaded files | To run the school's training and operations and keep the records an approved organisation must keep | The school's legal obligations (Part-ORA, Part-FCL) and contract |
| Licences, ratings and medical certificates: type, class, number if entered, issue and expiry dates | To check before each booking that the person may fly, and to warn before something expires. We keep only the class and validity of a medical, never medical details. | The school's legal obligations |
| Finance: prices, invoices, payments and balances | To charge for training and show each student their account | Contract |
| Messages and notices in the in-app inbox; email only if the school has switched email on | Communication inside the school | Contract |
| Security data: sign-in sessions, failed sign-in attempts (kept 1 day), two-step sign-in settings (the app secret is readable only by the app for that person; recovery codes only as hashes), and an activity log of changes | To keep accounts safe and to show who changed what (records must be traceable) | Legitimate interest in security; the school's legal obligations |
| Shared links: when someone opens an examiner or sponsor link, the time, IP address and browser | So the school can see who opened what it shared | Legitimate interest of the school |
| Demo requests from the website: name, school, email, phone if given, message | To answer and arrange a demo | Steps before a contract / legitimate interest |
| The planner without an account: nothing on our server. Your plans stay in your own browser. | — | — |
We never sell data, never use it for advertising and never build profiles. There is no automated decision with legal effect: the auto-planner only proposes lessons, a person books them.
3. Where the data is
- Server: a virtual server at Clouding.io in Spain (EU). The database, files and logs are there.
- Off-site backups: every night, encrypted on our server with a key that only we hold, then stored in a private GitHub repository (GitHub, Inc., part of Microsoft). GitHub only ever receives encrypted files it cannot read.
- Email (only if a school switches it on): sent through the email provider configured for that installation.
- Outside services the planner and maps use from your browser: map tiles (OpenStreetMap), place search (Nominatim, OpenStreetMap), weather and elevation (Open-Meteo, Amazon-hosted elevation tiles), aircraft type lookup (hexdb.io, adsbdb.com) and, when you print or export, the export libraries (jsDelivr). Your browser contacts them directly, so they see your IP address and what you asked for (for example the map area), not your name. Airspace data (openAIP, ENAIRE) and the radar picture (adsb.lol) are fetched by our server, so they do not see you.
4. How long we keep it
- Training records: as long as the school's approval requires, at least 3 years after the training ends (ORA.ATO.120), longer if the school decides. Signed records are never edited, only corrected by a new entry.
- Accounts of people who left the school: the school archives or deletes them; records that must be kept stay with the school.
- Failed sign-in attempts: 1 day. Sessions: until you sign out or after 14 days.
- Backups: a rolling set of the last 14 nights, 8 weeks and 12 months.
- Demo requests: up to 24 months after the last contact, unless they become a contract.
- When a school's contract ends: it can export everything; we then delete its data and, as the backups roll over, the copies in them.
5. Security
Each school's data is kept apart in the database itself (row-level security), not only by the app. Connections are encrypted (HTTPS). Two-step sign-in is required for owners and administrators and available to everyone. Every change is logged. The database is backed up before each update and every night, encrypted, off the server.
6. Your rights
You can ask for access to your data, a copy you can take elsewhere, correction, deletion, restriction, and you can object to processing based on legitimate interest. Data the school must keep by law can be restricted but not always deleted. Students and staff of a school: ask the school; it can export, correct and archive your data in the system, and we help it. You can also complain to a data protection authority, for example IMY in Sweden (imy.se, where we are established), the AEPD in Spain (aepd.es) or the one where you live.
7. Children
Flight training can start before 18. A school that trains minors decides how parents or guardians are involved (for example through a sponsor link) and is responsible for any consent the law requires.
8. Cookies
One cookie keeps you signed in; nothing tracks you. Details: cookies.
9. Changes
When this policy changes in a way that matters, schools are told in the app before it applies. The date and version are at the top.
10. Contact
Mohammad Al Hussein (enskild firma, trading as AstraDev), Skansgatan 8, 211 32 Malmö, Sweden. Email: contact@astraaviation.tech. Through the website: the demo request form on astraaviation.tech.