# Privacy Policy **XC Connect** Last updated: August 2026 This notice explains how XC Connect processes personal data when you use the website, API, and related services. It is intended to meet the transparency requirements of the **UK GDPR** and **EU GDPR** (Articles 12–14). For contractual terms, see the [User Agreement](/user-agreement). --- ## Who is responsible (controller) The **controller** is the person or organisation operating the XC Connect deployment you use (for example the production service at xc-connect.com). Operators should publish their legal name and postal address here when they go live. **Privacy contact:** [privacy@xc-connect.com](mailto:privacy@xc-connect.com) — use this address for questions about this notice or to exercise your rights. If you operate a self-hosted instance, replace this with your own contact details. --- ## What personal data we process Depending on how you use the service, we may process: - **Account data:** email address, password (stored as a cryptographic hash only), account status, timestamps. - **Session data:** authentication tokens / session records needed to keep you signed in. - **Files and metadata:** files you upload or submit for processing (including names, types, sizes), sync state, and optional **guest share links** you create (tokens that allow limited access for others you share with). - **Technical and security data:** IP addresses, HTTP logs, and similar data typically collected by hosting providers, load balancers, and CDNs; application logs may contain redacted identifiers. - **Email delivery:** messages sent through our email provider (e.g. account activation, password reset, and files you choose to send to a recipient) include the recipient's email address, and files you send carry your own address as the reply address. - **File sending by email:** the recipient addresses you enter when sending a file (kept as a short list of your recent recipients so you can pick them again and remove them), and a record of each send (time, file, recipient) used to apply sending limits. If a recipient blocks a message, their address is kept so it receives no further files by email through XC Connect from any sender, unless the recipient unblocks it from the same link. - **Website analytics (optional):** if you **accept** analytics cookies on the public site, **Google Analytics** may process online identifiers and usage events as described in the cookie notice and [Google’s Privacy Policy](https://policies.google.com/privacy). We do **not** intentionally collect special categories of personal data under Article 9 GDPR (such as health data). Your uploaded flight files are treated as **your responsibility**; do not upload content you are not entitled to share. --- ## Purposes and legal bases - **Providing the service** (registration, login, file storage, sync, guest links, security) — **Performance of a contract** (Article 6(1)(b) GDPR). - **Service emails** (activation, password reset) — **Performance of a contract**. - **Sending a file to an address you choose** — **Performance of a contract** (Article 6(1)(b)) towards you; towards the recipient, who is not our user, **Legitimate interests** (Article 6(1)(f)) in delivering messages sent to them and, where they block one, no longer delivering messages from any XC Connect user. - **Security and abuse prevention** (rate limits, authentication failures, incident investigation) — **Legitimate interests** (Article 6(1)(f)), balanced against your rights. - **Optional analytics on the public website** (aggregated usage statistics) — **Consent** (Article 6(1)(a)) via the cookie banner. - **Improving and developing the service** — **Legitimate interests** (Article 6(1)(f) GDPR). Where we rely on **legitimate interests**, you may have a **right to object** under Article 21 for grounds relating to your particular situation. --- ## Recipients and subprocessors We use service providers that process personal data on our instructions (where applicable, as **processors** under Article 28 GDPR). Depending on configuration, these may include: - **Amazon Web Services (AWS)** — hosting, object storage (e.g. S3), email (SES), databases, logging (see [AWS Privacy](https://aws.amazon.com/privacy/)). - **Google** — **Google Analytics** on the public website if you consent; **Google Fonts** may load when you visit the site (see [Google Privacy](https://policies.google.com/privacy)). - **Cloudflare** — may appear in security or performance tooling for certain pages (see [Cloudflare Privacy](https://www.cloudflare.com/privacypolicy/)). - **Open-Meteo** — when creating a task from a briefing photo or a scanned QR code, turnpoint coordinates that still have no elevation are sent to look up terrain elevation for them (see [Open-Meteo Terms](https://open-meteo.com/en/terms)). We do **not sell** your personal data. --- ## International transfers If data is processed outside the **UK** or **European Economic Area**, we rely on appropriate safeguards where required (for example the UK **IDTA** / EU **Standard Contractual Clauses**) through our providers’ terms. Contact the privacy address above for more information on transfers relating to your data. --- ## Retention - **Active accounts:** data is kept for as long as your account exists and you use the service. - **Inactive sign-ups:** accounts that never complete activation may be deleted automatically after a limited period. - **Deleted accounts:** profile, sessions, and file records tied to the account are removed from the live database when you delete your account; **residual copies** may persist for a period in backups, logs, or caches operated by us or our providers. - **Email recipients and send records:** your list of recent recipients keeps at most the 20 most recently used addresses and can be cleared by you at any time; records of each file email, used to apply sending limits, are kept for 30 days. Both are deleted with your account. An address a recipient has blocked is kept, by design, so it receives no further files by email through XC Connect from any sender, unless the recipient unblocks it from the same link within that 30-day window. - **Logs:** retained according to our internal logging and security policy. --- ## Your rights Subject to applicable law, you may have the right to: - **Access** your personal data - **Rectify** inaccurate data - **Erase** data (“right to be forgotten”) — you can delete your account from account settings where available - **Restrict** processing in certain cases - **Data portability** — request a copy of data you provided, in a structured, commonly used format where technically feasible - **Object** to processing based on legitimate interests - **Withdraw consent** at any time for analytics — use **Cookie settings** in the site footer - **Lodge a complaint** with a supervisory authority — in the Netherlands, the **Autoriteit Persoonsgegevens (AP)** ([autoriteitpersoonsgegevens.nl](https://www.autoriteitpersoonsgegevens.nl)) To exercise rights, contact [privacy@xc-connect.com](mailto:privacy@xc-connect.com). We may need to verify your identity before responding. --- ## Automated decision-making We do not use automated decision-making or profiling that produces legal or similarly significant effects on you. --- ## Children The service is not directed at children under **16**. If you believe we have collected data from a child without appropriate authority, contact the privacy address above. --- ## Changes We may update this notice from time to time. Material changes will be highlighted on the website or by email where appropriate. The “Last updated” date will be revised when we publish changes. --- ## More information - [User Agreement](/user-agreement) — terms of use, liability, and acceptable use. - Cookie choices — **Cookie settings** in the site footer.