Summary: We collect only what is strictly necessary to save your drill progress, manage your login, and process payments. We use privacy-friendly analytics without tracking cookies, and we never sell your data.
1. Data Controller
Pilot Interview Handbook ("we", "us", "our") is the Data Controller responsible for your personal data under the EU General Data Protection Regulation (GDPR).
For any privacy inquiries or data protection requests, contact us at: support@pilotinterviewhandbook.com.
2. What Personal Data We Collect and Why
We adhere strictly to the principle of data minimisation:
- Account Credentials: Your email address and an encrypted password hash (managed via Supabase Auth) to provide secure account access.
- Drill Progress & Preferences: Your individual drill ratings (clean, fuzzy, couldn't say) and interface preferences. This is stored securely in our database so your study progress seamlessly syncs across your devices.
- Transaction Information: Purchase records, order date, plan type, and payment transaction IDs. We never see, collect, or store your credit or debit card numbers on our servers. Payment processing is handled securely by our payment processor / Merchant of Record.
- Privacy-First Analytics: We use Umami Analytics for aggregate, privacy-preserving website traffic insights. It does not use tracking cookies, does not collect personal identifiers, and does not track you across other websites.
3. Legal Basis for Processing (GDPR Art. 6)
We process your data under the following legal bases:
- Performance of a Contract (Art. 6(1)(b)): To create your account, deliver paid educational materials, and persist your study progress.
- Legitimate Interests (Art. 6(1)(f)): To maintain platform security, prevent unauthorized account sharing, and defend against malicious attacks.
- Legal Obligations (Art. 6(1)(c)): To maintain commercial and tax records as required by European law.
4. Data Storage and Infrastructure
Our backend database is hosted in Frankfurt, Germany (EU region) with encryption at rest and in transit (TLS/HTTPS). Row Level Security (RLS) policies enforce that users can only ever access their own study records.
5. Data Retention and Account Erasure (Right to be Forgotten)
We retain your account and progress data for as long as your account remains active.
You have the right to request the complete deletion of your account and personal data at any time under GDPR Art. 17. Upon an erasure request:
- Your account credentials, profile, and study progress are permanently deleted.
- In accordance with legal accounting obligations, transaction ledger rows are anonymized (the personal email and customer links are permanently severed while preserving numerical accounting integrity).
6. Your Rights Under the GDPR
As an individual in the European Union, you have the following rights:
- Right of Access: Request a copy of the personal data we hold about you.
- Right to Rectification: Update or correct inaccurate information.
- Right to Erasure: Request deletion of your personal data.
- Right to Data Portability: Receive your data in a structured, commonly used format.
- Right to Object / Restrict Processing: Object to specific data processing activities.
To exercise any of these rights, please email us at support@pilotinterviewhandbook.com. We will respond within 30 days.
7. Changes to this Policy
We may update this Privacy Policy periodically. The "Last updated" date at the top of this page reflects the current version.