Privacy policy

1. Who we are

The data controller is Fin Smith, [ YOUR BUSINESS ADDRESS ], contact finsmith100@gmail.com. We are registered with the ICO under reference [ ICO REFERENCE — register before launch ].

2. What we collect

We keep data to a minimum. We do not offer user accounts, we do not build a marketing list, and we do not sell or share your data for advertising.

Answers you enter in the guided form (operation details, aircraft details, and any names you choose to enter, such as operator, pilot and emergency contact). Before you pay, these stay in your browser's local storage; when you buy a pack, they are stored on our systems only to build and deliver your documents.

Your email address, collected by Stripe at checkout, is used to send you a link to your pack. Payments are processed by Stripe — we receive confirmation of payment, the amount and a transaction reference, never your card details.

Basic technical logs (IP address, user agent) generated by our hosting providers for security and reliability.

3. Why we process it (lawful basis)

To generate and deliver the pack you bought, and email it to you — performance of a contract.

To keep records of the sale and meet tax and accounting obligations — legal obligation.

To secure the service and prevent abuse — legitimate interests.

4. AI processing

Some sections of your documents may be drafted with an AI provider (Anthropic). Only the relevant project answers are sent for drafting; the output is checked automatically before use. Our AI provider does not use this data to train models under the terms of our API agreement.

5. Where your data lives and how long we keep it

Your project is stored with Supabase in London, United Kingdom (Supabase eu-west-2) so we can build and re-issue your pack. Payments are held by Stripe under their own policies.

We keep your project so you can re-download your pack, and purchase records for 6 years for tax purposes. You can ask us to delete your project data at any time via finsmith100@gmail.com.

6. Who we share it with

Our processors: Stripe (payments), Supabase (storing your project to build your pack), Resend (emailing you your pack), Vercel (hosting), Anthropic (AI drafting). We do not sell your data or share it for advertising.

7. Your rights

Under UK GDPR you can ask for access to, correction of, deletion of, or a copy of your data, and you can object to or ask us to restrict processing. Contact finsmith100@gmail.com; we respond within one month.

You can complain to the Information Commissioner's Office (ico.org.uk) if you are unhappy with how we handle your data.

8. Cookies

We use only essential cookies needed to run the checkout. There are no advertising or cross-site tracking cookies.

9. Changes

We will post any changes here with a new effective date. Effective date: 10 July 2026.