Aerologue

Aerologue — Privacy Policy

Table of Contents

  1. Who We Are
  2. What This Policy Covers
  3. What Data We Collect
  4. How We Collect Your Data
  5. Legal Basis for Processing
  6. How We Use Your Data
  7. Who We Share Your Data With
  8. International Data Transfers
  9. Data Retention
  10. Your Rights
  11. Cookies and Similar Technologies
  12. Location Data
  13. Travel Document Storage
  14. ADS-B Flight Data
  15. Advertising and Ad Targeting
  16. Children's Data
  17. Security
  18. Changes to This Policy
  19. Contact Us

Privacy Policy

Effective Date: 10 March 2026

Your privacy matters to us. This Privacy Policy explains how Aerologue Ltd collects, uses, stores, shares, and protects your personal data when you use the Aerologue platform. We are committed to processing your data lawfully, fairly, and transparently.

This policy is written in plain English as required by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are

1.1 Aerologue Ltd is the data controller responsible for your personal data.

1.2 Company details:

Detail Information
Company Name Aerologue Ltd
Company Number 16876117
Registered Address 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Country of Incorporation England and Wales
Date of Incorporation 26 November 2025

1.3 As a small organisation, we are not required by law to appoint a Data Protection Officer (DPO). However, we take data protection seriously. For any questions or concerns about how we handle your personal data, please contact us at:

Email: samson@aerologue.com Post: Data Protection, Aerologue Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ

1.4 The supervisory authority for data protection in the United Kingdom is the Information Commissioner's Office (ICO). You have the right to make a complaint to the ICO at any time. Details can be found at https://ico.org.uk.

2. What This Policy Covers

2.1 This Privacy Policy applies to all personal data collected through:

(a) the Aerologue website at aerologue.com and aerologue.app;

(b) the Aerologue web application;

(c) any Aerologue mobile applications (when available); and

(d) any communications between you and Aerologue, including email and support requests.

2.2 This policy does not apply to third-party websites, services, or applications that you may access through links within the Aerologue platform. We encourage you to read the privacy policies of any third-party services you use.

3. What Data We Collect

We collect the following categories of personal data:

3.1 Account Data

Data you provide when you register for an account:

3.2 Location Data

3.3 Usage Data

3.4 Device Data

3.5 Uploaded Documents

3.6 Payment Data

3.7 Communication Data

3.8 Advertising Interaction Data

4. How We Collect Your Data

4.1 Directly from You

We collect data that you voluntarily provide to us, including when you:

4.2 Automatically

We collect certain data automatically when you use the Service, including:

4.3 From Third Parties

We may receive data from:

Under the UK GDPR, we must have a lawful basis for processing your personal data. The legal basis we rely on depends on the type of data and the purpose of processing:

Data Category Purpose Legal Basis
Account data (email, name, password) Account creation and management Contract performance -- necessary to provide the Service you have signed up for
Profile data (avatar, bio) Personalising your experience Consent -- you choose to provide this information
Location data (GPS) Triggering geo-specific content and features Consent -- you grant location permission through your device and can withdraw it at any time
Quiz/game scores and usage data Providing core features (leaderboards, achievements, statistics) Contract performance -- integral to the Service
Device data (browser, OS, IP) Ensuring technical compatibility and security Legitimate interests -- maintaining the security and functionality of the Service
Uploaded travel documents Travel Wallet storage and display Contract performance -- providing the Travel Wallet feature you have chosen to use
Payment data Processing subscriptions and purchases Contract performance -- necessary to fulfil your purchase
Communication data Responding to your enquiries Contract performance and legitimate interests -- providing customer support and improving the Service
Advertising interaction data Serving relevant advertisements and measuring performance Legitimate interests -- supporting the advertising-funded model of the Service. Where required, consent is obtained for targeted advertising
Analytics and aggregated usage data Improving the Service, understanding usage patterns Legitimate interests -- developing and enhancing the product

5.1 Where we rely on legitimate interests, we have conducted a balancing test to ensure that our interests do not override your rights and freedoms. You have the right to object to processing based on legitimate interests (see Section 10).

5.2 Where we rely on consent, you have the right to withdraw your consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

6. How We Use Your Data

We use your personal data for the following purposes:

6.1 Providing the Service:

6.2 Improving the Service:

6.3 Communicating with You:

6.4 Advertising:

6.5 Legal and Compliance:

7. Who We Share Your Data With

We do not sell your personal data to third parties. We share your data only with the following categories of recipients, and only to the extent necessary:

7.1 Cloud Hosting Provider

Amazon Web Services (AWS) -- Our infrastructure is hosted on AWS. Your data is processed and stored on AWS servers. AWS acts as a data processor on our behalf under a data processing agreement. AWS complies with industry-standard security certifications including ISO 27001, SOC 2, and is certified under the EU-US Data Privacy Framework.

7.2 Analytics Providers

We may use analytics tools to understand how users interact with the Service. Analytics data is aggregated and, where possible, anonymised. This section will be updated when specific analytics providers are selected.

7.3 Advertising Partners

We share limited data with advertising partners to serve relevant advertisements. This may include:

We do not share your name, email address, or other directly identifying information with advertisers. Ad targeting is based on anonymised and aggregated data.

7.4 eSIM Providers

When you purchase an eSIM through the Travel Wallet, we share the information necessary to fulfil your order with the relevant eSIM provider. This may include your email address and device information. Each eSIM provider operates under its own privacy policy.

7.5 Payment Processors

When implemented, payment transactions will be processed by a third-party payment processor. We will share the data necessary to complete your transaction. This section will be updated with the specific payment provider details once selected.

7.6 Professional Advisors

We may share data with our legal, financial, and professional advisors where necessary for the management of our business, subject to professional duties of confidentiality.

We may disclose your data where required by law, regulation, legal process, or governmental request, or where necessary to protect the rights, property, or safety of Aerologue, our users, or the public.

7.8 Business Transfers

In the event of a merger, acquisition, reorganisation, or sale of assets, your personal data may be transferred to the successor entity, subject to the same privacy protections described in this policy.

8. International Data Transfers

8.1 Aerologue Ltd is based in the United Kingdom. Our primary infrastructure is hosted on Amazon Web Services in the EU-West-2 (London) region.

8.2 Some data processing may occur in other AWS regions or in the locations of our third-party service providers, which may be outside the United Kingdom and the European Economic Area (EEA).

8.3 Where we transfer personal data outside the UK or EEA, we ensure that appropriate safeguards are in place, including:

(a) UK and EU adequacy decisions -- transfers to countries that have been deemed to provide an adequate level of data protection;

(b) Standard Contractual Clauses (SCCs) -- approved by the UK ICO and/or the European Commission, incorporated into our agreements with data processors; and

(c) Data Privacy Framework certification -- for transfers to US-based providers that are certified under the EU-US and UK Extension to the EU-US Data Privacy Framework.

8.4 You may request further information about the safeguards we use for international transfers by contacting us using the details in Section 19.

9. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. The following table sets out our retention periods:

Data Category Retention Period Rationale
Account data Duration of your account + 2 years after deletion To allow account recovery and to comply with legal obligations
Profile data Duration of your account; deleted upon account deletion No longer needed after account closure
Location data Processed in real-time; aggregated data retained for up to 12 months Raw GPS data is not stored beyond the active session; aggregated travel statistics are retained
Quiz/game scores Duration of your account + 1 year after deletion Part of the core Service; retained for leaderboard integrity
Device data 12 months from collection Used for analytics and security; refreshed regularly
Uploaded travel documents Until you delete them or delete your account User-controlled; you can delete documents at any time
Payment data 7 years from transaction date Required by UK tax and accounting regulations (HMRC)
Communication data 3 years from date of communication Customer support records; legal compliance
Advertising interaction data 12 months from interaction Used for ad performance measurement; anonymised after retention period
Analytics data (aggregated) Indefinitely Fully anonymised; not personal data

9.1 When your data reaches the end of its retention period, it will be securely deleted or anonymised so that it can no longer be associated with you.

9.2 You may request deletion of your data at any time (see Section 10). Certain data may be retained beyond your request where we have a legal obligation or legitimate reason to do so, such as tax records.

10. Your Rights

Under the UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data:

10.1 Right of Access -- You have the right to request a copy of the personal data we hold about you. We will respond to your request within one month.

10.2 Right to Rectification -- You have the right to request that we correct any inaccurate personal data or complete any incomplete personal data. You can update most of your data directly in your account settings.

10.3 Right to Erasure ("Right to be Forgotten") -- You have the right to request that we delete your personal data in certain circumstances, including where the data is no longer necessary for the purpose it was collected, or where you withdraw your consent.

10.4 Right to Restriction of Processing -- You have the right to request that we restrict the processing of your personal data in certain circumstances, such as while we verify the accuracy of your data following a challenge.

10.5 Right to Data Portability -- You have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format (such as JSON or CSV), and to transmit that data to another controller.

10.6 Right to Object -- You have the right to object to processing based on legitimate interests or for direct marketing purposes. Where you object, we will stop processing your data for that purpose unless we can demonstrate compelling legitimate grounds that override your interests.

10.7 Right to Withdraw Consent -- Where we process your data based on consent, you have the right to withdraw that consent at any time. This includes withdrawing consent for location data collection (through your device settings) and marketing communications (through unsubscribe links or account settings).

10.8 Right to Complain -- You have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe we have not handled your data in accordance with data protection law:

Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF Telephone: 0303 123 1113 Website: https://ico.org.uk

10.9 To exercise any of your rights, please contact us at samson@aerologue.com. We will respond to your request within one month. In exceptional circumstances, we may extend this period by up to two further months, but we will inform you if this is necessary.

10.10 We will not charge a fee for handling your request unless the request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse the request.

11. Cookies and Similar Technologies

11.1 What Are Cookies?

Cookies are small text files placed on your device when you visit a website. They are widely used to make websites work, to improve efficiency, and to provide information to the website operator.

11.2 Cookies We Use

We use the following categories of cookies:

Essential Cookies (Strictly Necessary)

Cookie Purpose Duration
Authentication token Keeps you logged in during your session Session / up to 30 days
Session identifier Manages your active session Session
Cookie consent preferences Remembers your cookie choices 12 months

These cookies are necessary for the Service to function. They cannot be disabled.

Analytics Cookies

Cookie Purpose Duration
To be implemented Helps us understand how users interact with the Service, including page views, feature usage, and session duration To be confirmed

These cookies will be placed only with your consent once analytics are implemented. You can opt out at any time through our cookie settings.

Advertising Cookies

Cookie Purpose Duration
Ad targeting Helps deliver relevant destination-based advertisements and measures ad performance To be confirmed
Ad frequency capping Limits the number of times you see the same advertisement Session

These cookies are placed only with your consent. You can opt out at any time through our cookie settings or your account advertising preferences.

11.3 Managing Cookies

When you first visit the Aerologue platform, you will be presented with a cookie banner that allows you to:

(a) Accept all cookies; (b) Accept only essential cookies; or (c) Customise your cookie preferences by category.

You can change your cookie preferences at any time through the cookie settings accessible from the footer of our website.

You can also manage cookies through your browser settings. Please note that disabling essential cookies may prevent the Service from functioning correctly.

11.4 Do Not Track

Some browsers include a "Do Not Track" (DNT) feature. We currently respond to DNT signals by treating them as a request to disable non-essential cookies.

12. Location Data

12.1 The Aerologue application uses GPS location data from your device to provide location-based features, including geo-triggered factoids, geo-quizzes, and position-based game mechanics.

12.2 Location data is collected only when:

(a) you have granted location permission through your device's operating system settings; and

(b) you are actively using the Aerologue application.

12.3 We do not collect location data when the application is running in the background or when it is closed.

12.4 Your real-time GPS position is used to trigger content relevant to your current location. Raw GPS coordinates are processed in real-time and are not stored persistently. Aggregated travel statistics (such as countries overflown and distance tracked) are derived from location data and stored in your profile.

12.5 You can disable location data collection at any time by:

(a) revoking location permission in your device settings; or

(b) disabling location-based features in your Aerologue account settings.

12.6 Disabling location data will prevent geo-triggered features (factoids, quizzes, and certain games) from functioning but will not affect other features of the Service.

13. Travel Document Storage

13.1 The Travel Wallet feature allows you to voluntarily upload and store digital copies of travel documents. We recognise that these documents may contain sensitive personal data.

13.2 Your uploaded documents are:

(a) encrypted at rest using AES-256 encryption on AWS S3;

(b) encrypted in transit using TLS 1.2 or higher;

(c) accessible only to you through your authenticated account; and

(d) not accessed, read, or processed by Aerologue staff unless required for technical support at your explicit request or by legal obligation.

13.3 You have full control over your uploaded documents. You can:

(a) view and download your documents at any time;

(b) delete individual documents at any time; and

(c) delete all documents by deleting your account.

13.4 When you delete a document, it is permanently removed from our active storage systems. Backup copies may persist for up to 30 days in our automated backup systems before being permanently purged.

13.5 We do not use optical character recognition (OCR) or any automated processing to extract data from your uploaded documents. Documents are stored as uploaded files and displayed back to you as-is.

14. ADS-B Flight Data

14.1 ADS-B (Automatic Dependent Surveillance -- Broadcast) data is publicly broadcast by aircraft transponders. It includes aircraft position, altitude, speed, heading, and identification information.

14.2 ADS-B data is not personal data. It relates to aircraft, not to individuals. Aerologue's use of ADS-B data to display flight tracking information does not involve the processing of your personal data.

14.3 When you interact with ADS-B data within the Service (for example, selecting a flight to track or playing a game that uses live flight data), your interaction with that data is recorded as usage data under Section 3.3.

15. Advertising and Ad Targeting

15.1 Aerologue displays destination-based advertisements within the Service. Advertisements are served based on:

(a) your flight destination;

(b) the geographic region you are overflying; and

(c) your stated advertising preferences.

15.2 We do not build detailed personal profiles for advertising purposes. Ad targeting is contextual (based on where you are going) rather than behavioural (based on tracking you across the internet).

15.3 Advertising interaction data (impressions, clicks, saves, dismissals) is collected and aggregated for ad performance measurement. This aggregated data is shared with advertising partners in anonymised form. Individual users are not identifiable from the data shared with advertisers.

15.4 You can manage your advertising preferences in your account settings, including:

(a) selecting preferred and excluded advertising categories;

(b) dismissing individual advertisements; and

(c) if you are a Premium subscriber, reducing or removing advertisements entirely.

16. Children's Data

16.1 The Aerologue Service is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13.

16.2 If you are between 13 and 18, you must have the consent of a parent or legal guardian to use the Service.

16.3 If we become aware that we have collected personal data from a child under 13 without verifiable parental consent, we will take steps to delete that data as soon as possible.

16.4 If you believe that we have collected data from a child under 13, please contact us immediately at samson@aerologue.com.

17. Security

17.1 We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, alteration, disclosure, or destruction.

17.2 Our security measures include:

(a) Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher.

(b) Encryption at rest: Sensitive data, including uploaded travel documents, is encrypted at rest using AES-256 encryption.

(c) Access controls: Access to personal data is restricted to authorised personnel on a need-to-know basis.

(d) Authentication security: Passwords are salted and hashed. Authentication is managed through AWS Cognito with JWT token-based sessions.

(e) Infrastructure security: Our AWS infrastructure is configured with security best practices, including VPC isolation, security groups, and IAM role-based access.

(f) Regular audits: We conduct regular security reviews and dependency vulnerability scanning.

(g) Breach response: We maintain a data breach response plan. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the ICO within 72 hours and notify you without undue delay.

17.3 While we implement robust security measures, no system is completely secure. We cannot guarantee the absolute security of your data. You are responsible for maintaining the security of your account credentials and for any activity under your account.

18. Changes to This Policy

18.1 We may update this Privacy Policy from time to time to reflect changes in our data practices, the Service, or applicable law.

18.2 We will notify you of material changes by:

(a) posting the updated policy on our website with a revised "Effective Date";

(b) sending an email notification to the address associated with your account; and/or

(c) displaying a prominent notice within the Service.

18.3 We encourage you to review this policy periodically.

18.4 Your continued use of the Service after changes are posted constitutes your acceptance of the revised policy.

19. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data protection rights, or have a complaint about how we handle your data, please contact us:

Aerologue Ltd 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom

Email: samson@aerologue.com Post: Data Protection, Aerologue Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ

Company Number: 16876117

Information Commissioner's Office (ICO): If you are not satisfied with our response, you have the right to complain to the ICO:

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF Telephone: 0303 123 1113 Website: https://ico.org.uk