Data Processing Addendum

1. Subject Matter and Duration

myAviationTools LLC processes personal data on your instructions for the duration of your subscription to myAviationTools. Closing an account anonymizes name and email and ends sessions; it is not a timed recovery window. See our Terms of Service.

2. Nature and Purpose of Processing

We process personal data in order to:

• Provide the Service (authentication, data storage, cross-app integration)
• Fulfill billing and subscription management
• Diagnose errors and improve the Service (via Sentry error tracking, when enabled; not currently enabled)
• Respond to support requests and legal obligations
• Send transactional notifications (via our own mail relay)

3. Type of Personal Data

The categories of personal data we process include:

• Identification data (name, email address)
• Professional data (FAA certificate number, ratings, role)
• Account credentials (hashed password via scrypt)
• Usage and telemetry (page views, feature usage, error events)
• Payment metadata (Stripe customer ID, subscription status — not payment card data)
• Communication data (support tickets, messages within the Service)

4. Categories of Data Subjects

Data subjects whose personal data we process include:

• Account holders (mechanics, pilots, employers)
• Users invited by account holders (team members, employees)
• Individuals referenced in user-submitted records (crew, passengers, maintenance contacts)

5. Roles of the Parties

You (the customer) decide why and how personal data is processed. You determine the purposes and means of personal data processing.

myAviationTools LLC is the service provider. We process personal data only on your documented instructions, as set out in this DPA and the Terms of Service.

6. Sub-processors

We may engage third-party sub-processors to assist in providing the Service. A complete list of current sub-processors is available at /subprocessors. We notify you at least 30 days before adding or removing a sub-processor via in-app notification and email. You may object to a new sub-processor by emailing [email protected] within 14 days of notice.

7. Data Subject Rights

You are responsible for fulfilling data subject rights requests (access, correction, deletion, portability, objection, restriction, automated decision-making). We will assist you upon request:

• Access: Users can request a copy of their data by emailing [email protected]; MyLogbook data can also be exported from Logbook Settings → Data
• Correction: Users can edit profile details directly in the app
• Deletion: Users can close their account from the account deletion page. Name and email are replaced with dummy values and sessions end. We still keep the original name, email and files so the account can be restored, and we do not automatically erase them on a schedule. To have them erased, email [email protected]
• Portability: JSON export available on request to [email protected]

We will respond to legally valid requests within 14 business days.

8. International Transfers

Our application servers and primary database are hosted on a virtual server operated by netcup GmbH in the European Union. Uploaded files are stored with Cloudflare R2, and we use Cloudflare for content delivery, so some data may be processed outside the EU, including by other sub-processors (see section 6 and the sub-processor list).

For sub-processors located outside the EU/EEA, we rely on Standard Contractual Clauses (SCCs) or other contractual safeguards. This DPA is a contract term and is not a claim of compliance with any regulation or certification.

9. Security Measures

We implement technical and organizational measures to protect personal data, including:

• Backup encryption: Database and file backups are encrypted with age (X25519) before they are stored
• Encryption in transit: TLS 1.3 on all endpoints with HSTS
• Password security: Hashed via scrypt (Better Auth default)
• Session management: HttpOnly, Secure, SameSite=Lax cookies; 30-day expiration, refreshed daily while active
• Access controls: Role-based access, API authentication
• Audit logging: Administrative action logging (in development)
• Infrastructure security: netcup GmbH KVM VPS in the European Union, with UFW firewall, fail2ban, Cloudflare DDoS protection

Detailed security measures are described in our Privacy Policy.

10. Personal Data Breach Notification

In the event of a confirmed personal data breach, we will notify you without undue delay after we confirm it, and within any time limit that applicable law requires. We will provide:

• Description of the breach and data affected
• Likely consequences for data subjects
• Measures taken or proposed to mitigate the harm
• Contact details of our privacy contact

You are responsible for notifying your data subjects if required by applicable law.

11. Audit Rights

You have the right to audit our compliance with this DPA upon reasonable notice (at least 30 days). We will provide necessary cooperation and documentation. Audits may be conducted no more than once per calendar year unless required by law or a regulator.

Contact [email protected] to request an audit.

12. Return and Deletion of Data

Upon termination of your subscription:

• You may request an export of your data before you close the account, or by emailing [email protected]
• Closing the account replaces name and email with dummy values and ends sessions. We still keep the original name, email and files so the account can be restored, and we do not automatically erase them on a schedule. To have them erased, email [email protected]
• You are responsible for archiving any data you wish to retain

Backups taken before an account is closed still contain that data. Closing an account does not rewrite or delete backups.

13. Liability

Each party's liability is limited as described in the Terms of Service Section 10 (Limitation of Liability).

14. Governing Law and Amendment

This DPA is governed by the laws of the State of Texas, without regard to conflict-of-laws provisions. Any dispute will be resolved exclusively in the state or federal courts located in Texas. Material changes to this DPA will be announced via email and in-app notification at least 30 days in advance.

15. Contact

For questions about this DPA or to exercise data subject rights:

• Privacy contact: [email protected]
• Legal inquiries: [email protected]