Privacy policy

1. Who we are

The data controller is Fin Smith, 35 St Aidan's Road, London SE22 0RP, contact finsmith100@gmail.com.

2. What we collect

We keep data to a minimum. We do not offer user accounts, we do not build a marketing list, and we do not sell or share your data for advertising.

Answers you enter in the guided form (operation details, aircraft details, and any names you choose to enter, such as operator, pilot and emergency contact). Before you pay, these stay in your browser's local storage; when you buy a pack, they are stored on our systems only to build and deliver your documents.

Your email address, collected by Stripe at checkout, is used to send you a link to your pack. Payments are processed by Stripe — we receive confirmation of payment, the amount and a transaction reference, never your card details.

Basic technical logs (IP address, user agent) generated by our hosting providers for security and reliability.

3. Why we process it (lawful basis)

To generate and deliver the pack you bought, and email it to you — performance of a contract.

To keep records of the sale and meet tax and accounting obligations — legal obligation.

To secure the service and prevent abuse — legitimate interests.

4. AI processing

Some sections of your documents may be drafted with an AI provider (Anthropic). Only the relevant project answers are sent for drafting; the output is checked automatically before use. Our AI provider does not use this data to train models under the terms of our API agreement.

The optional UK SORA AI pre-review runs only after you tick an explicit transmission-consent box. Before transmission, the server replaces project, portal, preparer and reviewer identifiers with presence flags. Operation summaries, airspace details and other free-text fields may still contain personal, location or commercially sensitive information, so you should remove anything you do not want processed. Evidence-reference text and notes are excluded unless you separately choose to include them. Raw evidence files are never sent by this feature.

The optional SAIL III/IV AI case assistant also requires explicit transmission consent. Named project, application, operator, preparer, consultant and RAE(F) controls become presence flags; only work items with a recorded evidence reference, exact source pointer and operator-confirmed excerpt or fact block are eligible for drafting. Those references, pointers, excerpts, review scope, limitations and related notes may contain sensitive information, so remove anything you do not want processed. Raw evidence files are not sent.

Returned AI observations and case-drafting suggestions are stored in your browser local storage unless you clear them. They are not stored as a project on our systems, cannot complete a human decision gate and cannot submit information to the CAA.

5. Where your data lives and how long we keep it

Your project is stored with Supabase in London, United Kingdom (Supabase eu-west-2) so we can build and re-issue your pack. Payments are held by Stripe under their own policies.

The UK SORA readiness, evidence, review and consultant-case workspaces are local browser tools unless you explicitly use an AI feature. Consultant referral exports are downloaded to your device; Drone Ready does not send them to a consultant for you.

We keep your project so you can re-download your pack, and purchase records for 6 years for tax purposes. You can ask us to delete your project data at any time via finsmith100@gmail.com.

6. Who we share it with

Our processors: Stripe (payments), Supabase (storing your project to build your pack), Resend (emailing you your pack), Vercel (hosting and cookieless, aggregate page analytics), Anthropic (AI drafting and optional UK SORA pre-review/case preparation). We do not sell your data or share it for advertising.

7. Your rights

Under UK GDPR you can ask for access to, correction of, deletion of, or a copy of your data, and you can object to or ask us to restrict processing. Contact finsmith100@gmail.com; we respond within one month.

You can complain to the Information Commissioner's Office (ico.org.uk) if you are unhappy with how we handle your data.

8. Cookies

We use only essential cookies needed to run the checkout. There are no advertising or cross-site tracking cookies.

9. Changes

We will post any changes here with a new effective date. Effective date: 12 August 2026.