Privacy Notice

1. Controller status

For personal data collected via the marketing site (leads, contact forms, account signups), Alistair McKay is the data controller.

For personal data your flight school uploads into its Skyline workspace (students, instructors, pilot documents, syllabus records), your organisation is the controller and we act as the processor, handling the data strictly on your documented instructions.

2. Categories of personal data we collect

• Website & public forms: Name, email, school name, country, fleet size, message content, request timestamps. Purpose: responding to enquiries and providing trials (legitimate interests / contract).
• Account registration: Operator name, work email, hashed password, organisation identifier. Purpose: creating and securing your account (contract).
• School operations data: Student roster, flight hour logs, instructor ratings, pilot medical expiry dates, booking schedules. Purpose: providing the Service to your school (contract, on the school's instructions).
• Usage & technical data: IP address, device and browser information, error and audit logs. Purpose: security, fraud prevention and service improvement (legitimate interests).

3. Who we share data with

• Service providers: hosting, database, email-delivery and support tooling providers acting as our subprocessors.
• Paddle.com: our Merchant of Record for Skyline software subscriptions. Paddle handles subscription payments, invoicing, sales tax compliance and subscription management, and processes the billing data you enter at checkout under its own privacy notice.
• Your school's own payment provider: if your school collects student payments through its own connected account (for example its own Stripe account), that provider is engaged by the school, not by Skyline.
• Professional advisers and authorities: legal or accounting advisers, and public authorities where required by law.

4. Retention

We keep account and operations data for as long as your school holds an active workspace, and delete or anonymise it within 90 days of account closure unless we must retain it to meet a legal obligation. Marketing enquiries are kept for up to 24 months.

5. Storage, security and international transfers

Data is stored in encrypted databases hosted in secure UK and European data centres, with strict Row-Level Security partition guards between tenants, access controls and encryption in transit. Where a subprocessor processes data outside the UK/EEA, we rely on adequacy decisions or Standard Contractual Clauses.

6. Cookies

We use essential cookies to keep you signed in and to remember your cookie choices, and optional analytics cookies only with your consent. You can change your preferences at any time from the cookie banner.

7. Your rights

You have the right to access, rectify, erase, restrict, port or object to the processing of your personal data, and to withdraw consent where processing relies on it. You may also complain to the UK Information Commissioner's Office. We respond within one month. Contact us at allymckay5@gmail.com or hello@flyskyline.app.