Privacy Policy

XC Connect
Last updated: August 2026

This notice explains how XC Connect processes personal data when you use the website, API, and related services. It is intended to meet the transparency requirements of the UK GDPR and EU GDPR (Articles 12–14). For contractual terms, see the User Agreement.

Who is responsible (controller)

The controller is the person or organisation operating the XC Connect deployment you use (for example the production service at xc-connect.com). Operators should publish their legal name and postal address here when they go live.

Privacy contact: [email protected] — use this address for questions about this notice or to exercise your rights. If you operate a self-hosted instance, replace this with your own contact details.

What personal data we process

Depending on how you use the service, we may process:

  • Account data: email address, password (stored as a cryptographic hash only), account status, timestamps.
  • Session data: authentication tokens / session records needed to keep you signed in.
  • Files and metadata: files you upload or submit for processing (including names, types, sizes), sync state, and optional guest share links you create (tokens that allow limited access for others you share with).
  • Technical and security data: IP addresses, HTTP logs, and similar data typically collected by hosting providers, load balancers, and CDNs; application logs may contain redacted identifiers.
  • Email delivery: messages sent through our email provider (e.g. account activation, password reset, and files you choose to send to a recipient) include the recipient's email address, and files you send carry your own address as the reply address.
  • File sending by email: the recipient addresses you enter when sending a file (kept as a short list of your recent recipients so you can pick them again and remove them), and a record of each send (time, file, recipient) used to apply sending limits. If a recipient blocks a message, their address is kept so it receives no further files by email through XC Connect from any sender, unless the recipient unblocks it from the same link.
  • Website analytics (optional): if you accept analytics cookies on the public site, Google Analytics may process online identifiers and usage events as described in the cookie notice and Google’s Privacy Policy.

We do not intentionally collect special categories of personal data under Article 9 GDPR (such as health data). Your uploaded flight files are treated as your responsibility; do not upload content you are not entitled to share.

Purposes and legal bases

  • Providing the service (registration, login, file storage, sync, guest links, security) — Performance of a contract (Article 6(1)(b) GDPR).
  • Service emails (activation, password reset) — Performance of a contract.
  • Sending a file to an address you choose — Performance of a contract (Article 6(1)(b)) towards you; towards the recipient, who is not our user, Legitimate interests (Article 6(1)(f)) in delivering messages sent to them and, where they block one, no longer delivering messages from any XC Connect user.
  • Security and abuse prevention (rate limits, authentication failures, incident investigation) — Legitimate interests (Article 6(1)(f)), balanced against your rights.
  • Optional analytics on the public website (aggregated usage statistics) — Consent (Article 6(1)(a)) via the cookie banner.
  • Improving and developing the service — Legitimate interests (Article 6(1)(f) GDPR).

Where we rely on legitimate interests, you may have a right to object under Article 21 for grounds relating to your particular situation.

Recipients and subprocessors

We use service providers that process personal data on our instructions (where applicable, as processors under Article 28 GDPR). Depending on configuration, these may include:

  • Amazon Web Services (AWS) — hosting, object storage (e.g. S3), email (SES), databases, logging (see AWS Privacy).
  • Google — Google Analytics on the public website if you consent; Google Fonts may load when you visit the site (see Google Privacy).
  • Cloudflare — may appear in security or performance tooling for certain pages (see Cloudflare Privacy).
  • Open-Meteo — when creating a task from a briefing photo or a scanned QR code, turnpoint coordinates that still have no elevation are sent to look up terrain elevation for them (see Open-Meteo Terms).

We do not sell your personal data.

International transfers

If data is processed outside the UK or European Economic Area, we rely on appropriate safeguards where required (for example the UK IDTA / EU Standard Contractual Clauses) through our providers’ terms. Contact the privacy address above for more information on transfers relating to your data.

Retention

  • Active accounts: data is kept for as long as your account exists and you use the service.
  • Inactive sign-ups: accounts that never complete activation may be deleted automatically after a limited period.
  • Deleted accounts: profile, sessions, and file records tied to the account are removed from the live database when you delete your account; residual copies may persist for a period in backups, logs, or caches operated by us or our providers.
  • Email recipients and send records: your list of recent recipients keeps at most the 20 most recently used addresses and can be cleared by you at any time; records of each file email, used to apply sending limits, are kept for 30 days. Both are deleted with your account. An address a recipient has blocked is kept, by design, so it receives no further files by email through XC Connect from any sender, unless the recipient unblocks it from the same link within that 30-day window.
  • Logs: retained according to our internal logging and security policy.

Your rights

Subject to applicable law, you may have the right to:

  • Access your personal data
  • Rectify inaccurate data
  • Erase data (“right to be forgotten”) — you can delete your account from account settings where available
  • Restrict processing in certain cases
  • Data portability — request a copy of data you provided, in a structured, commonly used format where technically feasible
  • Object to processing based on legitimate interests
  • Withdraw consent at any time for analytics — use Cookie settings in the site footer
  • Lodge a complaint with a supervisory authority — in the Netherlands, the Autoriteit Persoonsgegevens (AP) (autoriteitpersoonsgegevens.nl)

To exercise rights, contact [email protected]. We may need to verify your identity before responding.

Automated decision-making

We do not use automated decision-making or profiling that produces legal or similarly significant effects on you.

Children

The service is not directed at children under 16. If you believe we have collected data from a child without appropriate authority, contact the privacy address above.

Changes

We may update this notice from time to time. Material changes will be highlighted on the website or by email where appropriate. The “Last updated” date will be revised when we publish changes.

More information

  • User Agreement — terms of use, liability, and acceptable use.
  • Cookie choices — Cookie settings in the site footer.