Privacy policy

Your employer (the airline) decides that FlyTrivia is used for training and is the controller of your training data. ByteTech OÜ (registry code 17558441, Sepapaja tn 6 15551 Tallinn, Harju Maakond Estonia) operates the app and processes the data on the airline's behalf as a processor, under a data-processing agreement.

For privacy questions or requests, contact your airline's training department or info@bytetech.ee.

• Account: your name, work email address, department and role (employee, admin).
• Training activity: the questions you answered, your answers, scores, points, streaks, games and duels, with dates and times.
• Security: login sessions (a secure cookie), and for administrators a log of admin actions (for example uploading or deleting a manual).

We do not use advertising or tracking cookies, and we do not sell personal data.

• To give you access to the app and keep your account secure.
• To run quizzes and games, show your progress, points, rank and the leaderboards.
• To let the airline's training department see training activity and which topics need attention.
• To prevent misuse (for example rate limits and blocking accounts of people who left the company).

The legal basis is the airline's legitimate interest in training its staff and, where applicable, its legal obligations for crew training (Art. 6(1)(f) and (c) GDPR).

Airline manuals are stored in a private file store (Cloudflare R2) and their text in our database. To write quiz questions and extract procedures, excerpts of manual text are sent to Google's Gemini API (paid service). No personal data about you is sent to the AI. Under Google's terms for paid services, this content is not used to train Google's models; Google keeps it only for a limited time for abuse monitoring.

• Supabase — database and login (servers in the EU, Ireland).
• Cloudflare — storage of the manual PDF files.
• Google — Gemini API for generating questions from manual text (no personal data).
• Resend — sends notification emails (your name and email address only), if enabled.
• Hosting provider — runs the web app (Vercel).

For ByteTech OÜ's accounting and legal compliance, contract and billing data about the airline (not your training data) is handled by Xolo OÜ, Estonia.

Where a provider processes data outside the EU/EEA, the transfer is protected by the EU Standard Contractual Clauses or an equivalent safeguard.

• Account and training data: as long as your account is active.
• Accounts that are blocked or deleted: training history is removed within 12 months, unless the airline must keep training records longer by law.
• Admin action log: 24 months.

You can ask to access, correct, delete or export your data, restrict or object to its processing. In the app, under My profile, you can download your data and delete your account yourself. For other requests, contact the airline or info@bytetech.ee.

You may also complain to a data protection authority — in Estonia the Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee), or the authority in your country.

Data is encrypted in transit (HTTPS) and at rest by our providers. Access is limited by role, correct answers are checked on the server, and administrators' actions are logged. Manual files are private and only reachable through the app.

When this policy changes in a meaningful way, we update the date above and ask you to confirm it the next time you open the app.