Privacy Policy

Effective Date: [ДАТА ВСТУПЛЕНИЯ В СИЛУ]
Product: FlyLegal Portugal
Author / Provider: AltVision / [ПРОДАВЕЦ]

This Privacy Policy explains how AltVision and [ПРОДАВЕЦ] ("we", "us", or "our") collect, use, and protect your personal data when you visit our website and access the "FlyLegal Portugal" digital guide.

"FlyLegal Portugal" is an independent digital educational guide. It is not affiliated with, endorsed by, or partnered with ANAC, AAN, EASA, EUROCONTROL, or any other government authority or aviation regulator.

1. Data Controller

The data controller responsible for the processing of your personal data on this website is:

• Project / Author: AltVision
• Legal Entity / Sole Proprietor: [ПРОДАВЕЦ]
• Contact Email: [EMAIL]

2. What Personal Data We Collect

We adhere to the principle of data minimization and collect only the data necessary to provide you with access to the guide and ensure site security.

a) Purchase and Billing Data

The digital guide is sold via Lemon Squeezy, which acts as the Merchant of Record.

• When you purchase a license, Lemon Squeezy processes your payment information, name, email address, billing address, and country.
• Payment transactions do not pass through or get stored on our website servers. Lemon Squeezy provides us with confirmation of your purchase, order details, and an issued license key so that we can verify your access.
• For information on how Lemon Squeezy processes your payment and billing data, please refer to Lemon Squeezy's Privacy Policy.

b) License Key and Technical Cookie (av_access)

To access the paid chapters of the guide, you enter your license key on the website.

• Cookie av_access: Upon successful activation, our website sets a strictly necessary technical cookie named av_access (configured as HttpOnly, Secure, and SameSite=Lax, with a validity period of up to 400 days).
• Contents: The cookie contains a signed, base64url-encoded JSON payload storing your license key, device activation ID, access tier (e.g., Basic), and the timestamp of the last verification check. The signature prevents tampering.
• Necessity: This cookie is strictly technical and required for the digital access mechanism to function. Without it, the site cannot authenticate your session or grant access to the paid content.
• Device Limit & Logout: A license key can be activated on up to 3 devices (browsers) simultaneously. Logging out removes the av_access cookie and frees up that device activation slot in Lemon Squeezy.

c) Hosting and Server Log Data

Our website is hosted on Cloudflare Pages and Cloudflare Functions.

• When you visit our website, Cloudflare automatically processes standard server logs, which may include your IP address, browser type, operating system, referring URL, date and time of request, and requested pages.
• This data is processed automatically to deliver web pages, maintain network stability, prevent DDoS attacks, and protect infrastructure security.

d) Analytics and Tracking Technologies

• We currently do NOT use tracking cookies, analytics tools (such as Google Analytics), advertising pixels, or profiling mechanisms.
• [ПРОВЕРИТЬ если подключим] Если будет подключена аналитика, этот раздел нужно обновить и добавить cookie-баннер.

3. Purposes and Legal Bases for Processing (GDPR, Art. 6)

We process personal data in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679 — GDPR) based on the following grounds:

1. Performance of a Contract (GDPR Art. 6(1)(b)):
   • Verifying your license key;
   • Providing access to the paid digital content across up to 3 authorized devices;
   • Maintaining your active session via the essential av_access cookie.
2. Legitimate Interests (GDPR Art. 6(1)(f)):
   • Ensuring the security, integrity, and uninterrupted technical operation of the website and server functions;
   • Preventing unauthorized access, abuse, and piracy;
   • Diagnosing technical issues and server errors.
3. Compliance with Legal Obligations (GDPR Art. 6(1)(c)):
   • Complying with applicable accounting, tax, and statutory requirements where required by law.

4. Data Retention Periods

We do not retain personal data longer than necessary for the purposes for which it was collected:

• Technical Cookie (av_access): Stored in your browser for up to 400 days or until you log out or manually delete your browser cookies.
• License Activation Records: Maintained for the duration of your active license [СРОК ХРАНЕНИЯ — заполнить владельцем].
• Hosting Server Logs (Cloudflare): Stored in accordance with Cloudflare's standard retention cycles [СРОК ХРАНЕНИЯ — заполнить владельцем].
• Transaction and Tax Records: Handled primarily by Lemon Squeezy as Merchant of Record; any records retained by us for legal compliance are stored for the period required by applicable law [СРОК ХРАНЕНИЯ — заполнить владельцем].

5. Third-Party Service Providers (Data Processors)

We share limited data with trusted service providers only as necessary to deliver the service:

1. Lemon Squeezy (Merchant of Record): Handles sales processing, checkout, invoicing, license key generation, and activation limits management.
2. Cloudflare (Cloudflare Pages & Cloudflare Functions): Provides content delivery, hosting, edge server execution, and web infrastructure security.

We do not sell, rent, or trade your personal data to any third parties for marketing or advertising purposes.

6. International Data Transfers (Outside the EEA)

Our third-party providers (Cloudflare, Inc. and Lemon Squeezy) are based in or operate infrastructure in countries outside the European Economic Area (EEA), including the United States.

Where personal data is transferred outside the EEA, such transfers are carried out under appropriate safeguards, primarily Standard Contractual Clauses (SCCs) approved by the European Commission.

7. Your Rights Under GDPR

Under Regulation (EU) 2016/679 (GDPR), you have the following rights regarding your personal data:

• Right of Access: You can request confirmation of whether we process your data and obtain a copy of that data.
• Right to Rectification: You can request correction of inaccurate or incomplete personal data.
• Right to Erasure ("Right to be Forgotten"): You can request the deletion of your personal data where statutory grounds apply.
• Right to Restriction of Processing: You can request that we temporarily restrict the processing of your data under certain conditions.
• Right to Data Portability: You can request to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to Object: You can object to processing based on our legitimate interests.
• Right to Lodge a Complaint: You have the right to lodge a complaint with a competent data protection supervisory authority. If you are located in Portugal, the competent authority is the Comissão Nacional de Proteção de Dados (CNPD), or the national data protection authority of your EU Member State of residence.

To exercise any of these rights, please contact us at [EMAIL].

8. Data Security

We implement reasonable and appropriate technical and organizational measures to safeguard your personal data:

• All traffic to and from the site is encrypted using Transport Layer Security (TLS/HTTPS).
• The av_access cookie uses HttpOnly, Secure, and SameSite=Lax flags to protect session data against cross-site scripting and unauthorized client-side tampering.
• The cookie payload is cryptographically signed using a server-side secret key to prevent forgery.

9. Children's Privacy

The "FlyLegal Portugal" website and digital guide are not directed to, intended for, or marketed to individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe that an individual under 18 has provided personal data to us, please notify us at [EMAIL], and we will promptly delete such information.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or technical implementations.

When changes are made, the "Effective Date" at the top of this document will be updated. We encourage you to review this page periodically to stay informed about how we protect your information.

11. Contact Information

If you have any questions, requests, or concerns regarding this Privacy Policy or our data handling practices, please contact us at:

• Email: [EMAIL]
• Data Controller: AltVision / [ПРОДАВЕЦ]