SkyRoster Legal

v2026-08-08

How we use data

What we process, why, tenancy isolation, retention, and your rights.

1. Controller

For platform account and billing data: HEINAK YEVHEN (Гейнак Євген), private individual.

For crew / ops data inside a tenant: the airline Customer is typically the controller; the Provider acts as processor under the Subscription Agreement.

2. What we process

  • Identity & access: display name, email (optional), WhatsApp number, Passkey credentials, role, locale/theme prefs.
  • HR / crew: ranks, bases, leave, layovers, document metadata and uploaded scans (as entered by Customer).
  • Ops: roster duties, FSTD sessions, flights, flight plans, loadsheets, runway analyses, NOTAM notes, weather cache keys.
  • Logbook: pilot logbook entries derived from duties/flights for export.
  • Billing: tenant code, fleet counts, invoices, agreement acceptance records.
  • Technical: Host-based tenancy, cookies for locale/theme/session, server logs (IP, User-Agent, timestamps).

3. Purposes & legal bases

  • Provide and secure the Service (contract / legitimate interest).
  • Bill and collect subscription fees (contract).
  • Optional AI assists (e.g. departure advisory) — only when enabled; prompts may include flight/weather/NOTAM context; not used to train public models by the Provider beyond the AI vendor’s terms.
  • WhatsApp OTP / notifications via Meta WhatsApp Cloud API when configured.
  • Legal compliance and dispute handling.

4. Tenancy isolation

Tenant is resolved only from the HTTP Host ({iata}.skyroster.net). Each airline has a separate SQLite database file. Platform reference data (airports, airlines, aircraft types, FTL catalogs) is shared read-only. Customer A cannot read Customer B’s database through the application.

5. Sharing

We do not sell personal data. We share with:

  • Infrastructure / hosting providers under contract.
  • WhatsApp / Meta (OTP and notifications when used).
  • Optional AI vendor (Gemini) when Customer triggers AI features.
  • Public weather/NOTAM sources (ICAO lookups; not personal data).
  • Authorities when legally required.

6. Retention

Tenant data is retained while the subscription/tenant is active and for up to 30 days after termination for export, then deleted or anonymised unless longer retention is required by law or unresolved invoices/disputes. Billing records may be kept per Ukrainian accounting rules (typically up to 3+ years).

7. Rights

Depending on applicable law (incl. GDPR where it applies), individuals may request access, correction, deletion, restriction, or portability via the Customer admin or the contacts below. Crew should first contact their airline admin for tenant-held records.