Privacy Policy
This policy describes how PreflightAI processes personal data in accordance with Regulation (EU) 2016/679 (GDPR).
Last updated: 30 June 2026
1.Data controller
The data controller for the PreflightAI service (website at preflight.bot and Telegram bot @PreflightAI_bot) is:
Francesco Lazzarotto
Italy
Email: francescolazzarotto93@gmail.com — for data subject requests and GDPR inquiries.
Responses to data subject requests will be provided within 30 days (Art. 12(3) GDPR).
2.Personal data we process
PreflightAI operates two front-ends (the website and the Telegram bot) that process different data.
2a. Website (preflight.bot)
| Data | Purpose | Legal basis (Art. 6 GDPR) | Retention |
|---|---|---|---|
| ICAO codes, aircraft type, dispatch text / files you submit | Generate your preflight briefing | Art. 6(1)(b) — contract performance | Not stored — processed in real time and discarded immediately after the response |
| Page paths, referrer domain, browser type, OS, country (no cookies, no IP address stored) | Understand how the service is used to improve it | Art. 6(1)(f) — legitimate interests | 90 days (Vercel Analytics aggregated retention) |
2b. Telegram bot (@PreflightAI_bot)
| Data | Purpose | Legal basis (Art. 6 GDPR) | Retention |
|---|---|---|---|
| Telegram chat ID (pseudonymous numeric identifier) | Rate limiting — preventing abuse and ensuring fair usage | Art. 6(1)(f) — legitimate interests | Max 7 days (rolling Redis keys with TTL) |
| Dispatch files and documents you send, AI briefing output, follow-up Q&A | Generate your briefing, enable Expand / Flight Tips / Q&A buttons | Art. 6(1)(b) — contract performance | 2 hours (Redis TTL), then automatically deleted |
| Files you forward for processing (PDF, images, documents) | Build the dispatch context before generating a briefing | Art. 6(1)(b) — contract performance | 1 hour (Redis TTL), then automatically deleted |
| Flight schedule data you upload via /roster (dates, ICAO routes, times) linked to your chat ID | Send you daily weather digests for upcoming flights at 18:00 UTC | Art. 6(1)(b) — contract performance at your explicit request | 60 days, or deleted immediately when you send /clearroster |
Rate-limit counters contain only the numeric chat ID and a date — no message content, no username, no personal identifiable information beyond the ID itself. Roster and session data are deleted automatically at the end of their TTL even if you never send /clearroster.
3.Sub-processors and international transfers
To deliver the service, your data is transmitted to the following sub-processors. All are located in the United States; transfers are covered by the mechanisms indicated (Art. 46 GDPR).
| Processor | Purpose | Country | Transfer mechanism |
|---|---|---|---|
| Anthropic, Inc. | AI processing of briefing, dispatch extraction, roster extraction, Q&A | US | EU–US Data Privacy Framework (DPF) + Standard Contractual Clauses (SCCs). API inputs are not used to train Anthropic models. |
| Vercel, Inc. | Website hosting, serverless functions, anonymised web analytics (Vercel Analytics + Speed Insights) | US | EU–US Data Privacy Framework (DPF) + SCCs |
| Upstash, Inc. | Redis storage for sessions, rate limits, roster and pending files | US | Standard Contractual Clauses (SCCs) |
| Telegram Messenger Inc. | Bot messaging platform (routes messages between users and the bot) | UAE / global | See Telegram's Privacy Policy. Telegram processes messages as part of its platform infrastructure. |
| aviationweather.gov (NOAA / FAA) | Weather data (METAR, TAF). No personal data is transmitted. | US | No personal data transferred |
No other third parties receive your personal data. We do not sell, rent or share personal data for advertising purposes.
4.Analytics and performance monitoring
The website uses Vercel Analytics and Vercel Speed Insights to collect anonymised usage and performance statistics.
- No cookies are used for analytics.
- IP addresses are not stored; country is inferred from the IP at request time and the IP is discarded.
- Data collected: page paths, referrer domain, browser type, operating system, device type, country, and Core Web Vitals performance metrics.
- Legal basis: Art. 6(1)(f) GDPR — legitimate interests in understanding how the service is used and improving its performance.
5.Third-party data sources
Weather and NOTAM data are retrieved from third-party sources (aviationweather.gov, OurAirports public dataset). These are public datasets; no personal data is sent to or received from them. The accuracy, timeliness and completeness of this data are not guaranteed — see the Disclaimer for full details.
6.Your rights under the GDPR
You have the following rights under Arts. 15–22 GDPR:
- Right of access (Art. 15) — you may request a copy of the personal data we hold about you.
- Right to rectification (Art. 16) — you may ask us to correct inaccurate data.
- Right to erasure (Art. 17) — you may ask us to delete your data. For the Telegram bot, send /clearroster to delete your roster immediately; all other bot data (sessions, pending files) deletes automatically within 1–2 hours. For complete erasure of all data linked to your chat ID, email us at francescolazzarotto93@gmail.com.
- Right to restriction (Art. 18) and right to object (Art. 21) — you may ask us to restrict processing or object to processing based on legitimate interests.
- Right to portability (Art. 20) — where processing is based on your consent or a contract and carried out automatically, you may request your data in a structured format.
To exercise any right, email francescolazzarotto93@gmail.com. We will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the Italian supervisory authority:
Garante per la protezione dei dati personali
Piazza Venezia 11, 00187 Roma
Web: www.garanteprivacy.it
7.Security measures
We apply the following technical and organisational measures (Art. 32 GDPR):
- All data in transit is encrypted via TLS (HTTPS).
- Redis data at rest is encrypted by Upstash (AES-256). Access is token-authenticated.
- Automatic TTL expiry ensures data is not retained beyond the periods stated in Section 2.
- API keys and secrets are stored as environment variables, not in code.
- Uploaded files are processed in memory by the AI model and are not written to disk or object storage.
8.Children
PreflightAI is intended for pilots, student pilots and aviation professionals. It is not directed at persons under 16 years of age. We do not knowingly collect personal data from minors (Art. 8 GDPR).
9.Changes to this policy
We may update this policy to reflect changes in our processing activities or applicable law. Material changes will be announced via the Telegram bot and on the website. The “Last updated” date at the top of this page always reflects the current version.
10.Aviation disclaimer
This Privacy Policy covers data protection only. For the aviation educational disclaimer, pilot responsibilities, AI content limitations and liability exclusions, see the separate Disclaimer & Privacy Notice.