Privacy Policy

This Privacy Policy explains how VirtualDispatch ("VirtualDispatch", "we", "us") collects, uses and protects personal data when you use the service at virtualdispatch.app (the "Service").

1. Data controller

VirtualDispatch is currently operated by an individual based in Italy, not yet through a registered company. For the purposes of the EU General Data Protection Regulation (GDPR), the operator of virtualdispatch.app acts as the data controller for personal data processed through the Service. You can contact us at privacy@virtualdispatch.app for any privacy-related request.

2. What data we collect

• Account data: the email address and password you provide when creating an account. Passwords are never stored by us in readable form — account authentication is handled by our identity provider, Supabase Auth, which stores only a salted hash.
• Profile data: optional profile fields you choose to fill in (first name, last name, birth date, nationality, preferred base, the aircraft you own in the simulator) and, if you upload one, a profile photo. If you enter a SimBrief username, it is kept in your browser and sent to our server only when we fetch your flight plan from SimBrief.
• Service usage data: the PIREPs you file (times, fuel, delay codes and the dispatch data of each flight), the flight you are currently working on (kept on our servers so you can continue it on another device), your generation settings (which delays, defects and last-minute changes are enabled, and their chances), and the flying statistics derived from your PIREPs — all tied to your account and visible only to you. Profile photos are stored in a storage bucket whose files can be opened by anyone who has the link.
• Waitlist and invitations: if you join the waitlist on our website, we keep your email address with the consent you gave and when, and use it only to invite you to the Service. When we invite you, your address moves to our list of invited pilots, which decides who can create an account while the Service is invitation-only. You can ask us to delete it at any time.
• Problem reports: when you use Report a problem, we keep your message with your account email, the page you were on, your browser and screen size, recent errors on that page and, if you choose to attach it, your active flight, so we can investigate. Reports are read only by the people who run the Service and are deleted with your account.
• Connected services: if you choose to connect them in Account settings, your Hoppie ACARS logon code, your SayIntentions API key, and the name of your Navigraph account with the sign-in tokens Navigraph issues for it. They are stored encrypted on our servers and are never sent back to your browser. From your Navigraph account we keep only its name, to show you which account is connected. Removing a code or key, or disconnecting Navigraph, deletes it.
• Technical data: standard web server logs (IP address, browser user agent, request timestamps) collected automatically by our hosting provider for security and reliability purposes.
• Error reports: when something breaks, on our server or in our pages' own code in your browser, we record the error and where it happened in our code, the page address without its parameters, your browser type and, if you are signed in, your account's internal identifier. We use them only to find and fix faults.
• Cookies: see our Cookie Policy for details.

3. Why we process your data

• To create and manage your account, and to provide the core functionality of the Service (contract performance).
• To send you account-related emails: email verification, password reset, and important service notices (contract performance / legitimate interest).
• To connect the Service to SimBrief (Navigraph), Hoppie's ACARS network and SayIntentions when you ask it to, and to act on them only when you press the corresponding button (contract performance).
• To investigate the problems you report and to detect and fix errors in the Service (legitimate interest in providing a working service).
• To maintain the security and integrity of the Service, including preventing abuse (legitimate interest).
• With your consent, to understand how the Service is used through analytics, where enabled (consent — see our Cookie Policy).

4. Who we share data with

We use the following sub-processors to operate the Service. Each processes data on our behalf under their own data processing terms:

• Supabase — hosts our database and provides account authentication/email verification.
• Render — hosts the application itself.
• Resend — delivers transactional account emails (verification, password reset).
• Cloudflare Turnstile — checks that sign-in and sign-up requests come from a person, not a bot, where enabled.
• Sentry — receives error reports when something in the Service breaks: the error and where it happened in our code, the page address without its parameters, your browser type and your account's internal identifier. It never receives your email, what you typed, your flights, or any sign-in code or credential.

Some features also contact third-party services that act independently of us:

• SimBrief (Navigraph) — when you send a flight to SimBrief, your browser opens simbrief.com with the flight's details, and we fetch your latest flight plan from SimBrief using the SimBrief username in your profile. If you sign in with Navigraph instead, Navigraph gives us your account name and sign-in tokens that let our server create and read your SimBrief flight plans when you ask it to; we store the tokens encrypted, and disconnecting in Account settings deletes them.
• Hoppie's ACARS network (hoppie.nl) — if you add your Hoppie logon code, we store it and our server uses it to send the messages you choose, such as your loadsheet, to your aircraft through hoppie.nl.
• SayIntentions.AI — if you choose SayIntentions for ACARS and add your SayIntentions API key, we store it and our server uses it to send the messages you choose, such as your loadsheet, to your aircraft through SayIntentions.
• OpenStreetMap — serves map tiles only if our own built-in map cannot be loaded.

Weather is fetched by our server from the US National Weather Service (aviationweather.gov) by airport code only; no personal data is sent.

These providers may process data on infrastructure located outside the European Economic Area. Where this is the case, they provide appropriate safeguards (such as Standard Contractual Clauses) for the transfer. We do not sell your personal data to third parties, and we do not share it for third-party advertising purposes.

5. How long we keep your data

We keep your account and associated data for as long as your account remains active. If you delete your account (or ask us to), we will delete your associated data within a reasonable time, except where we are required to retain certain records by law. Deleting your account also deletes your problem reports, any connected-service credentials, and your email on our invitation list and waitlist. A waitlist entry is kept until you are invited or ask us to remove it, by writing to privacy@virtualdispatch.app.

Error reports are kept by Sentry for a limited period (no more than 90 days) and then deleted automatically; they are not removed when you delete your account, but they contain no email address or other details that identify you directly. Server logs are kept by our hosting provider for a short period for security and troubleshooting.

6. Your rights

Under the GDPR, you have the right to access, correct, delete, restrict, or port your personal data, and to object to certain processing. To exercise any of these rights, contact us at privacy@virtualdispatch.app. You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali, or with your own country's supervisory authority.

7. Changes to this policy

We may update this Privacy Policy from time to time. We will update the "Last updated" date above when we do. Continued use of the Service after a change constitutes acceptance of the updated policy.

8. Contact

Questions about this policy? Reach us at privacy@virtualdispatch.app.