Legal
Privacy Policy
Version 1 · published 23 Sept 2026
This policy explains how aday-air.com ApS processes personal data when you visit aday-air.com, create an account, publish a listing, connect to an aircraft or use the business tools. We follow the EU General Data Protection Regulation (GDPR) and the Danish Data Protection Act.
1. Who is responsible
The data controller is aday-air.com ApS, CVR 45984923, Visionsvej 51, st., 9000 Aalborg, Denmark — palle@aday-air.com, +45 40 72 38 95. For data that a company (tenant) enters about its own customers, suppliers, pilots or employees in the business tools, that company is the controller and we process the data on its behalf.
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Account | name, email, phone, password (stored as a hash), role, language, login times | you |
| Company (tenant) | company name, CVR / VAT number, address, billing email, bank details for the accounting features, logo | you |
| Aircraft and claims | which aircraft you own, operate, maintain, instruct on or learn on; claim type, period, permissions; documents you upload to prove a claim (registration certificate, bill of sale, lease, insurance) — these can contain names and addresses of other people | you, the aircraft owner |
| Listings and media | photos, videos, texts, prices, location, seller contact details, inquiries and messages about a listing | you; for imported listings the public marketplace where we found them |
| Registry data | registration marks, serial numbers, owner names where a public register publishes them, accident records, ADS-B positions | public registers (e.g. FAA, NTSB, national CAAs), ADS-B feeds |
| Bookings, contracts, invoices | rental requests, signed contracts, hours, invoices, payments, expenses and bank transactions in the business tools | you, your counterpart, your bank (when you connect it), Stripe |
| Communication | messages in the platform chat, support tickets, emails you send us, notifications we send you | you |
| Technical | IP address, browser and device type, pages visited, referrer, screen size, time stamps, error logs; a random session id for statistics (only with consent) | your browser |
| Learning | subjects opened, answers to exercises, exam plans and results you record | you |
We do not ask for special-category data. Do not upload medical certificates or similar unless a feature explicitly asks for them.
3. Why, and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Running your account, the marketplace, claims and permissions, bookings, contracts, notifications and support | art. 6(1)(b) — performance of the contract with you |
| Verifying ownership claims and documents, preventing fraud and misuse, keeping the registry correct | art. 6(1)(f) — our and other users' legitimate interest in a trustworthy registry |
| Showing public registry data and imported listings | art. 6(1)(f) — legitimate interest in a complete aviation registry; the data is already public |
| Invoicing, bookkeeping, VAT reporting | art. 6(1)(c) — legal obligations (Danish Bookkeeping Act, VAT Act) |
| Security, logging, backups, abuse prevention | art. 6(1)(f) — legitimate interest in a secure service |
| Page-view statistics with our own counter | art. 6(1)(a) — your consent (cookie banner); withdraw it on the Cookies page |
| AI-assisted features (extracting data, drafting texts, classifying receipts, answering manual questions) | art. 6(1)(b) when you use the feature; art. 6(1)(f) for quality and cost monitoring |
| Service emails (claim decisions, bookings, invoices, security) | art. 6(1)(b); product news only with consent, art. 6(1)(a) |
4. Who we share data with
Other users. Your listing details and seller contact are shown to visitors as you set them. The verified owner of an aircraft sees who has claimed a connection to it (name, company, email, documents you attach to the claim). Users connected to the same aircraft see each other's names and companies. Counterparts in a booking or contract see what the contract needs.
Processors working for us (they may only process data on our instructions):
- Hosting of the website: Vercel Inc. (USA / EU edge network). Our API, database and job servers run on servers at a Danish hosting partner.
- Media storage and delivery (photos, videos, documents): Cloudinary Ltd. (EU / USA).
- Payments and invoices: Stripe Payments Europe Ltd. (Ireland) — Stripe is an independent controller for the payment itself.
- AI features: Anthropic PBC and OpenAI OpCo LLC (USA). Only the content needed for the request is sent (e.g. the listing page, the document, the receipt, the manual passage); under their business terms it is not used to train their models.
- Email delivery: our email gateway provider.
- Weather for the animated sky on some pages is fetched by your browser from Open-Meteo; only your IP address reaches them, no account data.
Authorities and advisers when the law requires it, to defend legal claims, and our accountant and auditor for bookkeeping. Public sources are not given your data; we only read from them.
We never sell personal data and we show no third-party advertising.
5. Transfers outside the EU/EEA
Some processors (Vercel, Cloudinary, Anthropic, OpenAI) are in the USA. Transfers rely on the EU–US Data Privacy Framework where the provider is certified and otherwise on the European Commission's Standard Contractual Clauses, plus technical measures such as encryption in transit and at rest. Ask us for a copy of the safeguards.
6. How long we keep data
- Account and company data: for as long as the account exists, then deleted or anonymised within 90 days.
- Claims, permissions, documents: for as long as the claim is active; a released or ended claim and its documents are kept 12 months for dispute handling and then deleted. The permission log (who granted / ended what) is kept 5 years.
- Listings: until you remove them; sold / expired listings stay in the price history without personal seller details.
- Invoices, payments, expenses, bank data: 5 years after the end of the financial year (Danish Bookkeeping Act).
- Messages and support tickets: 2 years after the last message.
- Technical logs: 90 days; statistics page views 24 months, without IP address after 30 days.
- Backups: rotated within 35 days.
- Acceptance of terms and privacy policy: which version you accepted and when, for as long as the account exists plus 5 years.
7. Your rights
You have the right to access the data we hold about you, to have it corrected or deleted, to restrict or object to processing based on legitimate interest, to receive the data you gave us in a portable format, and to withdraw consent at any time (this does not affect processing done before). Most account data you can see and change yourself under Account; write to palle@aday-air.com for the rest. We answer within one month.
If you are unhappy with how we handle your data you can complain to the Danish Data Protection Agency: Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, datatilsynet.dk, dt@datatilsynet.dk.
8. Security
Data is encrypted in transit (TLS) and at rest on our database servers, passwords are stored as salted hashes, access is limited by role and by the aircraft permissions the owner sets, and every change to claims and permissions is logged. Only a small number of named staff have administrative access. If a breach is likely to put your rights at risk we will tell you and Datatilsynet within the legal deadlines.
9. Children
The platform is for adults and businesses. We do not knowingly collect data from anyone under 18; tell us if a minor has created an account and we will remove it.
10. Changes to this policy
We update this policy when the platform or the law changes. The date at the top shows the current version; material changes are announced in the account or by email.