Privacy & Cookies
This notice explains what personal data Vela Air Ltd (“Vela Air”, “we”) collects, why we collect it, how it is protected, and what your rights are. We are registered as a data controller under the UK GDPR.
What data we collect and why
| Data | Why we collect it | Lawful basis |
|---|---|---|
| Name and email address | Account creation and communication | Contract |
| Phone number (optional) | Two-factor authentication | Legitimate interest / contract |
| Pilot licence number and medical certificate | Currency checks and eligibility verification | Contract |
| GPS flight tracks | Moving map, logbook, post-flight review | Contract |
| Aircraft data (registration, W&B, maintenance) | Pre-flight planning and fleet management | Contract |
| Payment information | Subscription billing (processed by Stripe; we do not store card numbers) | Contract |
| Device identifiers | Push notifications and device management | Legitimate interest |
How we protect your data
All personally identifiable information is encrypted using a four-layer key hierarchy:
- A per-user encryption key (DEK) unique to your account
- A key-encryption key (KEK) managed by HashiCorp Vault
- Database-level encryption (InnoDB encryption at rest)
- Storage-level encryption in the cloud infrastructure
Email addresses and licence numbers are stored as one-way HMAC-SHA256 hashes for lookup purposes. Vela Air staff cannot reverse these to recover your email or licence number in plaintext.
GPS tracks on the free Fly Safe tier are automatically deleted after 14 days. On paid plans, tracks are retained for the duration of your active subscription.
Full details of our security measures are on the How We Protect Your Data page.
Data retention
- Active accounts: Data is retained for as long as your account is active.
- Cancelled accounts: We retain data for 30 days after cancellation in case you reactivate, then initiate deletion.
- Account deletion: When you delete your account, we destroy your personal encryption keys. Your data becomes permanently and cryptographically unrecoverable — not just marked as deleted, but unreadable by anyone, including Vela Air.
- Anonymised flight statistics may be retained in aggregate form with no link to your identity.
Data sharing
We do not sell your data. We share it only with the third-party processors required to operate the service:
- Stripe — payment processing
- Cloud infrastructure provider — hosting and storage
- XContest — only if you explicitly connect your XContest account
All processors are bound by data processing agreements. We do not transfer your data outside the UK/EEA without appropriate safeguards.
Your rights
Under the UK GDPR you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Request erasure (“right to be forgotten”) — note that account deletion triggers cryptographic erasure
- Request a machine-readable export of your data (data portability)
- Withdraw consent where processing is based on consent
- Object to processing for legitimate interests
- Lodge a complaint with the ICO (ico.org.uk)
To exercise any of these rights: [email protected]
Cookies
All of our services may use cookies for authentication and strictly functional purposes, such as saving browser preferences.
Optionally, we leverage application performance monitoring (APM), bug-tracking, and monitoring services from New Relic; no personal information or marketing data is sent to this service.
We do not use tracking or advertising cookies. A separate cookie policy is available on request.
Contact
Data protection enquiries: [email protected]
To file a complaint or exercise your rights, you may also contact the Information Commissioner’s Office at ico.org.uk.