Privacy Policy | CitadelAero

How CitadelAero collects, uses and protects personal data across our websites, products and services. Section 15 describes the cookies our sites use.

1. Who we are

CitadelAero is the trading name of JLEC Limited, a company incorporated in Jersey, Channel Islands (company number 165488) (“we”, “us”, “our”).

JLEC Limited is registered with the Jersey Office of the Information Commissioner (JOIC) under the Data Protection (Jersey) Law 2018, registration number 103711.

For data protection matters, contact privacy@citadelaero.com.

2. Scope of this policy

This policy applies to personal data we process in connection with:

visitors to citadelaero.com and its subdomains;
individuals who contact us or make an enquiry;
the SMS Platform, at each operator’s subdomain;
Chuck, at ai.citadelaero.com;
the billing portal; and
Professional Services — our aviation consultancy engagements.

Our products do not share infrastructure. The SMS Platform and Chuck run on entirely separate systems, in different countries, with different sub-processors. Where that matters we say which product we mean. Assuming that an answer about one applies to the other will usually be wrong.

3. Our roles: controller and processor

3.1

We are a controller in respect of: website visitor data; enquiry and marketing contact data; account administration and billing data; and our own business records. We decide why and how that data is processed, and this policy explains it.

3.2

We are a processor in respect of the data our customers put into our products, and the material they give us to carry out consultancy work. The customer is the controller. We act on their instructions under our Data Processing Agreement, and it — not this policy — governs that processing.

3.3

If you are an employee or crew member of an operator that uses our products, that operator is the controller of your data. Direct any request about it to them in the first instance. We will assist them, but we cannot act on their data without their instruction.

4. Personal data we process as controller

4.1 Website visitors

What: IP address, browser type and version, operating system, device type, pages viewed, referring source, and approximate location derived from IP address.

Why: to operate and secure the website, and — where you have consented — to understand how it is used.

Lawful basis: legitimate interests (Article 6(1)(f)) for operation and security; consent (Article 6(1)(a)) for analytics.

Retention: raw access logs up to 90 days.

4.2 Enquiries and contact form

What: name, email address, organisation, telephone number where given, and the content of your message; what you told us the enquiry is about; the page on our website you were on before the form, and whether the link you followed asked for pricing or a walkthrough; and the IP address the enquiry was sent from.

Why: to respond, and to follow up on a commercial conversation you started; to know which of our pages led to your enquiry; and to deal with abuse of the form. We record only a page on our own website: if you came to the form from another site, a bookmark or a typed address, we do not record where you came from.

Lawful basis: legitimate interests, and steps taken at your request prior to entering a contract (Article 6(1)(b)).

Where: stored in the database our website shares with the SMS Platform, in the European Union (clause 8.6), and sent to us by email.

Retention: up to 2 years from last contact, or longer if a customer relationship develops.

4.3 Account administration and billing

What: names, business email addresses, job titles, organisation details, billing contacts, subscription and invoice records. We do not receive or store payment card details — see section 7.

Why: to provide the services, administer accounts, invoice, and keep proper business records.

Lawful basis: performance of a contract (Article 6(1)(b)); legal obligation (Article 6(1)(c)) for financial records.

Retention: for the subscription and 6 years afterwards; financial records 7 years.

4.4 Security and audit logs

What: sign-in events, administrative actions, and security-relevant events.

Why: to detect and investigate unauthorised access and to protect our systems.

Lawful basis: legitimate interests.

Retention: up to 12 months.

4.5 Registering your interest in Chuck

What: your name, work email address and organisation; where you give them, your role, the type of organisation and your message; which option you chose (development updates, or the development partners); whether you asked for development updates by email, with the wording you agreed to, its version and when; and the IP address the registration was sent from.

Why: to confirm your registration and reply to it; to talk with you about the development partners, if you asked about them; to deal with abuse of the form; and, only if you ticked the box, to email you occasional updates on how Chuck is developing. We do not record which post or link brought you to the page.

Lawful basis: legitimate interests (Article 6(1)(f)) for handling and replying to your registration and for dealing with abuse; consent (Article 6(1)(a)) for development updates by email. The box is never ticked for you. You can withdraw consent at any time by replying “unsubscribe” to any update or by emailing sales@citadelaero.com; withdrawing does not affect anything sent before.

Where: stored in the database our website shares with the SMS Platform, in the European Union (clause 8.6). Our notification of your registration, and the confirmation sent to you, go by email through Microsoft. If we move the updates to a mailing service, it will be named in this policy before any of your details are shared with it.

Retention: up to 2 years from last contact, or longer if a customer relationship develops. If you unsubscribe, we stop sending updates straight away and keep only the record that you did, so that you are not added again by mistake.

5. Personal data we process as processor

5.1

Our customers put personal data into our products. Depending on the product and how they use it, this can include employee and crew records, training and competency records, safety reports and investigations, audit findings, and documents they upload.

5.2

We process it only to provide, maintain and support the service, on the customer’s instructions. We do not sell it, and we do not use it for our own purposes.

5.3

We do not use customer data to train, fine-tune or evaluate artificial intelligence or machine learning models, and we do not permit our sub-processors to do so.

6. Protected occurrence data

The strongest protection in this policy. Occurrence reporting only works if reporters trust it. That trust is a regulatory requirement, not a courtesy, and we treat it as one.

6.1

Where a customer uses our products to record aviation occurrence reports, that data is protected under Regulation (EU) 376/2014 and its UK equivalent. The customer is the controller and is responsible for meeting its own just culture obligations.

6.2

We will not access, review, analyse, disclose or use occurrence report data for any purpose other than providing the service — including product development, benchmarking, or the training, fine-tuning or evaluation of AI models — without the customer’s express prior written consent. This is an absolute contractual prohibition, recorded at clause 10.2.3(c) of our Master Services Agreement, and it applies to every product and to our consultancy work.

6.3

We will not disclose occurrence report data to any third party, including a regulator, except where required by law or binding court order — in which case we will give the customer prior notice where we lawfully can — or where the customer instructs us in writing.

7. Sub-processors

7.1

We engage third parties to help deliver our services. The complete, current list — what each does, where it processes data, and the transfer mechanism that applies — is published in our Sub-processors Register at citadelaero.com/sub-processors.

7.2

In summary, and subject always to the register:

Used by

Sub-processor	Purpose	Used by
Supabase Inc.	Database and file storage	SMS Platform
Vercel Inc.	Application hosting and delivery	SMS Platform
OVHcloud	Dedicated server hosting	Chuck
WorkOS, Inc.	Authentication and identity	Chuck
Amazon Web Services	Language model inference	Chuck
Backblaze, Inc.	Encrypted off-site backup storage	Chuck
Microsoft Corporation	Email for the SMS Platform and for website enquiries; our company email and SharePoint	SMS Platform; website; company-wide (not Chuck)
Paddle.com Market Limited	Payment processing, merchant of record	All
Google LLC / Google Ireland	Website analytics (consent only)	Website
Microsoft Corporation (Clarity)	Website heatmaps and session recordings (consent only)	Website
Vercel Inc. (Analytics)	Website page-view statistics, cookieless (consent only)	Website

7.3

Every sub-processor is bound by a written contract with obligations no less protective than our own. We give customers at least 30 days’ notice before adding or replacing one, and they may object on reasonable data protection grounds.

8. Where your data is processed

8.1

SMS Platform data is stored at rest in the European Union, in Paris, France.

8.2

Chuck data is stored at rest in the United Kingdom and the European Union. Uploaded documents, the regulation corpus, the document index and the application database are held on dedicated hosting in the United Kingdom. Encrypted off-site backups of that data are held in the European Union, in Amsterdam, and are encrypted before they leave the hosting server.

8.3

Model inference for Chuck that uses an outside provider is performed in the European Union. When you ask a question, the text of the question and the material retrieved to answer it are sent to our inference provider for the duration of the request, through a geographic inference profile that keeps the request within the EU region set. The provider and the region are named in the Sub-processors Register.

8.4

Some processing runs on our own infrastructure in the United Kingdom rather than through an outside provider: building the search index over your documents, reading text out of the files you upload, and converting speech to text when you use dictation. No third party receives your data through any of these. If you use dictation, the audio is converted to text on our own UK servers while the request runs and is never stored — only the text it produces, which you edit before you send it.

8.5

Jersey and the United Kingdom both hold European Commission adequacy decisions, and the UK treats Jersey as adequate. Movement of data between the EEA, the UK and Jersey therefore needs no additional safeguard. Transfers to the United States are covered by the EU Standard Contractual Clauses and, for UK personal data, the UK International Data Transfer Agreement or Addendum. Copies are available on request.

8.6

Enquiries and registrations of interest made on citadelaero.com are stored at rest in the European Union, in Paris, France, in the database our website shares with the SMS Platform. They are not held in Chuck. Each one is stored before it is emailed to us, so that an email that fails to send does not lose it.

9. Data security

9.1

We take appropriate technical and organisational measures to protect personal data, including: separation of each customer’s data at database level; encryption in transit using TLS and at rest at the storage layer; password hashing with bcrypt, with no plain-text storage; session controls with HTTP-only cookies and expiry; role- and capability-based access controls; cross-site request forgery protection on state-changing requests; rate limiting on authentication; and audit logging.

9.2

A fuller description, including our backup position for each product, is in our Security & Trust Overview, available on request.

9.3

No system is completely secure. If you become aware of a security concern or suspected breach, contact us immediately at security@citadelaero.com.

9.4

Where a personal data breach is likely to result in a risk to individuals’ rights and freedoms, we will notify the relevant supervisory authority without undue delay and, where required, affected individuals. Where we act as processor, we notify the customer.

10. How long we keep data

Category	Retention
Website access logs	Up to 90 days; aggregated anonymised data indefinitely
Enquiries and registrations of interest	Up to 2 years from last contact, longer if a relationship develops; a record that you unsubscribed from development updates is kept
Account and commercial records	Duration of the subscription, plus 6 years
Financial and transactional records	7 years
Security and audit logs (as controller)	Up to 12 months
Customer data (as processor)	30 days after termination, then permanently deleted
Consultancy engagement records	Duration of the engagement, plus 6 years

11. Professional Services

11.1

Where we carry out consultancy work, we may receive personal data from the client — for example in the course of audits, safety management system implementation, incident-investigation support, flight data monitoring work, or personnel selection.

11.2

The client is the controller of that data and we act as processor, under the Data Processing Agreement. Where an engagement involves flight data or occurrence data, the additional protections in section 6 and the client’s own gatekeeper and de-identification arrangements apply, and we will agree them in the Statement of Work before the work begins.

11.3

We return or delete client material at the end of an engagement, subject to the professional records we are required to retain.

12. Your rights

Where we act as controller of your personal data, you have the right to:

be informed about how we use it — this policy;
request a copy of it;
have inaccurate data corrected;
request erasure, in certain circumstances;
restrict processing, in certain circumstances;
data portability, where processing is by consent or contract and carried out automatically;
object to processing based on legitimate interests, and to direct marketing at any time; and
withdraw consent at any time, where processing relies on it.

You can stop development updates at any time by replying “unsubscribe” to one, or by emailing sales@citadelaero.com.

12.1

We do not make decisions producing legal or similarly significant effects by automated means alone. Chuck generates draft answers and suggestions for a person to review; it does not decide anything about you, and its output is not a determination of compliance.

12.2

To exercise a right, contact privacy@citadelaero.com. We may need to verify your identity. We respond within four weeks, which may be extended by up to eight further weeks for complex requests — we will tell you if that applies. Four weeks is the deadline set by Article 28 of the Data Protection (Jersey) Law 2018, and it is shorter than the one month the UK and EU GDPR allow, so it is the one we work to for everyone.

12.3

If your data is held by an operator using our products, that operator is the controller — contact them. If you approach us, we will tell you so and, where we can identify the operator, let them know.

13. Complaints

Please raise any concern with us first at privacy@citadelaero.com. You also have the right to complain to a supervisory authority:

Jersey — Office of the Information Commissioner (jerseyoic.org)
United Kingdom — Information Commissioner’s Office (ico.org.uk)
EU/EEA — the supervisory authority in your country of residence or work

14. Evaluation environments

14.1

Where we provide an evaluation environment on request, it may hold fictional data and may be reset, and anything entered into it may be deleted when it is. Unless your Order Form says otherwise, do not enter real personal data, occurrence data or production data into it.

15. Cookies

15.1

This section describes the cookies and similar technologies our sites and products use. It replaces our separate Cookie Policy, which was withdrawn on 1 October 2026. Cookies are small text files a site places on your device. They may be first-party (set by us) or third-party (set by a provider we use), and may last for one visit or remain until they expire or you delete them. “Similar technologies” includes local storage and comparable mechanisms that store or read information on your device.

15.2

It covers these sites:

Site	What it is
citadelaero.com	Our public website, the billing portal (citadelaero.com/account) and the payment page (citadelaero.com/pay)
[operator].citadelaero.com	An operator’s SMS Platform environment
ai.citadelaero.com	Chuck

15.3

Analytics are used on the public website only, and never in the billing portal. We do not run analytics or session-recording tools inside the SMS Platform or Chuck.

15.4

The cookies and similar technologies we use:

Consent

Where each is set, and whether consent applies
Provider	Purpose	Where	Consent
CitadelAeroFirst-party	`cc_consent` — remembers your cookie choice (“Accept all” or “Essential only”) for a year, so we do not ask on every visit.	Website	Not required — strictly necessary
CitadelAeroFirst-party	`account_session` — keeps you signed in to the billing portal. Scripts on the page cannot read it, and it expires after eight hours.	Billing portal	Not required — strictly necessary
CitadelAeroFirst-party	Authentication session and cross-site request forgery protection — keeps you securely signed in and protects against forged requests.	SMS Platform	Not required — strictly necessary
WorkOS, Inc.First- and third-party	Authentication session for Chuck. Maintains your signed-in state after magic-link sign-in.	ai.citadelaero.com	Not required — strictly necessary
Paddle.com Market LimitedThird-party	Securely processing payments and preventing fraud. Loaded only on our payment page, when you open an invoice to pay it.	Payment page only	Not required — set only if you open a payment
Google LLCThird-party	Google Analytics 4 — aggregate site usage. Sets the `_ga` identifier.	Website only; never the billing portal	Required — loaded only after “Accept all”
Microsoft CorporationFirst- and third-party	Microsoft Clarity — heatmaps and aggregate session recordings. Sets first-party `_clck` and `_clsk`, plus third-party identifiers on Microsoft domains (`MUID`, `ANONCHK`, `CLID`, `MR`, `SRM_B`, `SRM_I`) shared across Microsoft properties including Bing and Microsoft Ads.	Website only; never the billing portal	Required — loaded only after “Accept all”
Vercel Inc.Third-party	Vercel Analytics — aggregate page-view and visit statistics. Cookieless: it sets nothing in your browser and identifies a visit by a hash of the request that is discarded daily, so it cannot follow you between days or across sites.	Website only; never the billing portal	Required — loaded only after “Accept all”

Worth knowing about Microsoft Clarity. Clarity sets Microsoft advertising identifiers that are shared with other Microsoft services. We call this out specifically rather than describing it as ordinary analytics, because a reasonable person would want to know. It is set only if you accept analytics cookies, and declining costs you nothing.

15.5

On your first visit to our website we ask whether you accept analytics cookies. Until you choose “Accept all”, no analytics tool is loaded and no analytics cookie is set. Choosing “Essential only” means we set nothing beyond what is strictly necessary.

15.6

You can change your choice at any time with “Cookie preferences” in the website footer. Withdrawing consent is as easy as giving it.

15.7

Strictly necessary cookies do not require consent because the service cannot be provided without them. If you block them, you will not be able to sign in.

15.8

You can also control cookies in your browser settings, including deleting existing ones. Doing so may affect how our sites work.

15.9

Where a third party sets a cookie through our sites, that provider processes the resulting data under its own privacy policy as well as our agreement with it. Each is listed in our Sub-processors Register, with the transfer mechanism that applies.

16. Other sites, and children

16.1

Our sites may link to third-party sites. We are not responsible for their privacy practices.

16.2

Our services are business tools sold to organisations in the aviation sector. They are not directed at children and we do not knowingly collect children’s personal data.

17. Changes to this policy

17.1

We may update this policy. Where a change is material we will notify customers by email and update the date at the top. Previous versions are available on request.

18. Contact

Subject	Address
Data protection, rights requests, this policy	privacy@citadelaero.com
Security incidents	security@citadelaero.com
Everything else	help@citadelaero.com

JLEC Limited, incorporated in Jersey, Channel Islands. Company number 165488. Our registered office address is available on request.