Privacy notice
Draft for review by AEROCX. Confirm the controller details, the retention periods and the processor list before launch.
Controller
[AEROCX legal entity], [address], [email]. For any question about your data, write to us there.
What we hold, and why
| Data | Why | Basis |
|---|---|---|
| Email address, name, password hash | To create your account and let you sign in | Performance of the contract |
| Purchase record: Stripe customer and session id, amount, VAT, date | To grant access, issue receipts and meet tax obligations | Contract and legal obligation |
| Progress: best score and attempts per question bank and mock paper | To show you where you stand and what to revise | Performance of the contract |
| Server logs and security events | To keep the service available and detect abuse | Legitimate interest |
What we do not do
We do not sell your data, we do not use it for advertising, and we do not profile you. Card details never reach our servers: Stripe processes payments and we store only the reference.
Processors
Supabase (accounts, database, hosted in the EU region), Vercel (site hosting), Stripe (payments and invoicing), and [email provider] for transactional email. Each is bound by a data processing agreement.
Retention
Account and progress data for as long as the account exists, then deleted within [30] days of a deletion request. Invoicing records for the [seven] years required by Belgian tax law.
Your rights
Access, rectification, erasure, restriction, objection and portability. Write to [email] and we will answer within one month. You may also complain to the Belgian Data Protection Authority.
Cookies
Only what the service needs: a session cookie so that you stay signed in, and Stripe’s own cookies during checkout. No analytics or advertising cookies are set.
Last updated [date].