AirMXTrack ("we", "us") is operated by Vasco Manuel Carvalho dos Santos, registered in Portugal, Rua das Salinas N83 1ºDto, 2890-231 Samouco, Portugal, company number 216875269. We are the data controller for the personal data described in this policy. Contact: support@airmxtrack.com.

AirMXTrack is a digital maintenance logbook for licensed aircraft maintenance engineers. This policy explains what data we process, why, for how long, and your rights under the EU General Data Protection Regulation (GDPR).

• Account data — name, email address and authentication identifiers, created when you register.
• Profile data — information you choose to add: full legal name, date of birth, nationality, licence numbers and issuing authorities (including additional licences such as UK CAA, GCAA or FAA), licence categories, aircraft type ratings and endorsement authorities, and organisation. This is professional identity data you control and can edit or remove at any time.
• Logbook data — the maintenance entries you create or import: dates, aircraft types and registrations, work order references, ATA chapters, task descriptions, man-hours, locations and organisations. Task descriptions may incidentally contain names of third parties (e.g. certifying staff on a work order); see Section 6.
• Imported documents — photos and PDFs of maintenance documents you upload for AI extraction. These are stored privately (accessible only through time-limited signed links tied to your account).
• Payment data — subscriptions are processed by Stripe. We never receive or store your card details; we receive only subscription status and billing metadata.
• Technical data — standard logs (IP address, browser type, timestamps) generated by our hosting platform for security and operation.

• To provide the service (Art. 6(1)(b) GDPR — contract): storing your logbook, calculating EASA Part-66 recency, generating recency and experience letters, processing imported documents. This is the core of what you signed up for.
• To operate securely and improve the product (Art. 6(1)(f) — legitimate interest): security logs, aggregate usage statistics, fixing defects.
• To send you product news (Art. 6(1)(a) — consent): marketing emails are optional; every email contains an unsubscribe link and you can opt out at any time without affecting the service.
• To comply with law (Art. 6(1)(c)): invoicing and tax records.

When you import a document, it is transmitted to Google's Gemini API for data extraction. Processing is transient: the document is sent, structured data is returned, and you review every extracted entry before it is saved. We use Google's paid API tier, under which Google does not use submitted content to train its models. No automated decision with legal effect is made about you — extraction results are always subject to your review and validation.

• Imported documents are permanently removed from your account and made inaccessible 30 days after the corresponding entry is validated.
• Before removal you are warned in the app (Dashboard notice and the document vault in Export), and you can download any document or mark it "Keep" to exempt it from automatic removal for as long as you choose.
• Your extracted logbook data is never affected by document removal — it remains until you delete it or close your account.
• Editing an entry restarts its document's 30-day clock.

• Account, profile and logbook data: kept while your account is active; deleted upon account closure (residual copies in encrypted backups are purged on the backup cycle, within 90 days).
• Billing records: kept for the period required by Portuguese tax law (currently 10 years).
• Support emails: kept for up to 2 years.

Work orders and task cards may contain personal data of colleagues (names, signatures, staff numbers). You are responsible for ensuring you may lawfully upload such documents. Our 30-day default retention, private storage, and transient AI processing are designed to minimise this data. If you are asked by a colleague or employer to remove a document, you can delete it (or the entry) at any time.

We use the following processors: Base44 (a Wix company) — application hosting and storage; Google — Gemini API document extraction; Stripe — payments; Zoho — email and mailing. Some processors operate outside the EEA; where they do, transfers rely on adequacy decisions or Standard Contractual Clauses as applicable. A current list of subprocessors is available on request.

We do not sell your data. We do not share it with advertisers.

You have the right to access, rectify, erase, restrict, object to, and port your personal data, and to withdraw consent at any time. In-app: you can edit your profile, delete individual entries or documents, export your full logbook (CSV/PDF), and delete your account. For anything else, email support@airmxtrack.com — we respond within one month. You may lodge a complaint with the Portuguese supervisory authority, CNPD (cnpd.pt), or your local authority.

Data is stored on our hosting platform with encryption in transit; imported documents use private storage accessible only via expiring signed links; access to production data is restricted. No system is perfectly secure — in the event of a breach affecting your rights, we will notify you and the CNPD as required by Art. 33–34 GDPR.

AirMXTrack is a professional tool for licensed engineers and is not directed at anyone under 18.

We may update this policy; material changes will be announced in the app or by email. The "Last updated" date above always reflects the current version.