Privacy
What we collect, why, and what we do not do with it.
What we collect
- Account information — your name or shop name, email address, and a hashed PIN. PINs are stored using Argon2id and cannot be recovered, only reset.
- Aircraft records you upload — scanned pages, the text extracted from them, and the entries confirmed from that text.
- Activity — an audit log of uploads, corrections, approvals, downloads, access grants and PIN changes, with IP address, kept because a records system must be able to say who changed what.
We do not collect payment card details; a payment processor handles those and we never see them.
How we use it
Solely to provide the service: storing your records, reading them, compiling them, and controlling who can see them. We do not sell your data, share it with advertisers, or use your maintenance records to train models.
Processing by AI
Scanned pages are sent to Anthropic's API to be read. They are processed to return the extraction and are not used to train models. No other third party receives your records.
Email we send you
We email you only about your own account and aircraft: a document waiting for your approval, a decision on one you submitted, and PIN resets. There is no marketing, so there is nothing to unsubscribe from — a shop that stops needing these is one whose access has been removed.
These messages are delivered by Resend, which therefore receives the recipient's address and the text of the notice. That text names the aircraft, the file and how many entries are involved; it never contains the contents of a maintenance record, a PIN, or a scan.
Who can see your records
Only accounts you have granted access to, via that aircraft's PINs. We access customer records only when necessary to operate or support the service, or where legally required.
Retention and deletion
Records are retained while your account is active. After cancellation or deletion of an aircraft they are kept for 90 days so a mistake can be undone, then permanently deleted. Backups expire on their own rolling schedule. The audit log is retained without record contents.
Security
PINs are hashed with Argon2id. Every PIN check does constant work whether or not the account exists, and repeated failures lock the target. Sessions are server-side and revocable. Traffic is encrypted in transit. An account with no grant on an aircraft cannot confirm that the aircraft exists.
A forgotten PIN is replaced, never recovered — we cannot read yours. The reset link is single-use, expires in 30 minutes, and asking for a new one invalidates the old link. Using it signs the account out everywhere and emails the address on file, so a reset you did not ask for is not a quiet one. The request form answers identically whether or not an address has an account, so it cannot be used to find out who is a customer.
Your rights
You can export all of your data at any time, correct anything through the review screen, and request deletion of your account and records. Write to us and we will act within 30 days.
Contact
Better Call Paul LLC — records@aircraft-logbooks.com