4fly

Data Protection Policy

Introduction

4fly is committed to protecting the privacy of the users of its flying club management platform (the 4fly.io website, the web app and the Android and iPhone mobile apps). This policy explains what data we collect, why, who it is shared with, how long it is kept and how to exercise your rights.

Data controller

  • 4fly is published by MELBA CAPITAL, a French SASU registered with the Saint-Étienne Trade and Companies Register under number 840 514 913, 5 route de Cussieux, 42400 Saint-Chamond, France.
  • Data protection contact: [email protected].
  • For the website, the app and the services provided directly by 4fly, MELBA CAPITAL is the data controller. For the data your club manages in 4fly (member records, flights, billing, training), the club is the data controller and MELBA CAPITAL acts on its behalf as a processor. You can contact your club or [email protected].

Data Collected

Depending on how you use 4fly, we collect:

  • Identity and contact details: last name, first name, email, phone number, date of birth, postal address.
  • Aviation data: licences, ratings, medical certificate (type and expiry date) and the documents or photos of these that you add.
  • Club activity: bookings, flights (hours, aircraft, hour meter), logbook, availability, event registrations.
  • Training: progress, assessments, student and instructor signatures.
  • Payments and billing: balances, invoices, flight packs and transactions. Card numbers are entered with our payment provider and are never stored by 4fly.
  • Messages: club messaging and conversations with our support team.
  • Flight safety: occurrence reports, which can be submitted anonymously, and aircraft remarks with their photos.
  • Discovery flights: for each passenger, name, contact details, date of birth or age, weight (for weight and balance), acceptance of the terms and signature; for a minor, the name and signature of the legal guardian. This data is entered by the passenger, the club or the pilot.
  • Club information, for verification and payouts: SIREN or RNA number, board members, IBAN (stored encrypted).
  • Website forms (contact, demo): name, email, phone number, club and message.
  • Phone GPS location and flight tracks (mobile app, see the dedicated section).
  • Technical data: IP address, device and browser type, connection logs and crash reports.

Data Usage

Your data is used to:

  • Manage reservations and flights
  • Ensure aircraft maintenance tracking
  • Manage training and student progression
  • Process payments
  • Communicate important club-related information
  • Send emails, text messages and notifications related to your activity (confirmations, reminders, document expiry alerts)
  • Prepare, at your club's request, the returns required by federations (for example the FFA AERAL report)
  • Keep the service secure, prevent fraud and fix errors
  • Measure website traffic and the effectiveness of our ads (see the Cookies section)
  • Meet our legal obligations (accounting, aviation regulations)

Legal bases

Each processing operation relies on one of the following bases:

  • Performance of the contract: account, bookings, flights, training, payments, messaging.
  • Legal obligation: retention of accounting records, passenger information sheets required by regulations.
  • Legitimate interest: service security, fraud prevention, improving 4fly, answering contact requests.
  • Consent: location, notifications, camera and photo access, audience measurement and advertising cookies. You can withdraw it at any time.

Mobile app: location and other data

The 4fly mobile app (Android and iPhone) accesses your phone's precise location (GPS) only if you allow it. Here is how it is used:

  • Purpose: showing your position on the navigation map and 3D view, finding the nearest airfield for weather and NOTAMs, and recording your flight tracks.
  • Background: your location is read with the app closed or the screen locked only during a recording you started, or if you turn on automatic flight detection (off by default; the "Allow all the time" permission is then requested explicitly).
  • Flight track: it stays on your phone. It is sent to the 4fly server only when you log or attach the matching flight; it is then stored with that flight and visible according to your club's sharing settings or the public link you choose to create. Recordings shorter than 5 minutes are ignored and deleted.
  • Weather and NOTAMs: the app sends the 4fly server an area of about 1° around your position (without any account identifier) or the airfields and area of your route. The server queries weather and NOTAM sources without passing on your identity.
  • No advertising or sale: your location is never sold or used for advertising or ad tracking. It is stored only by our hosting provider on our behalf. The base map is loaded from IGN (or OpenFreeMap as a fallback), which receives your IP address and the area displayed, without any account identifier.
  • Legal basis: performance of the service you request and your consent, given through the system permission. You can withdraw it at any time in your phone settings; showing your position and recording flights then stop working.
  • Deletion: you can delete a recording in the app, or request deletion of your account and associated data in the app (Account and settings > Delete my account) or by email to [email protected].
  • Notifications: if you allow them, the app registers a device token to send you club notifications; it is removed when you log out.
  • Camera and photos: the camera is only used when you yourself photograph a document (licence, medical certificate) or an aircraft remark, never in the background. Only the images you choose (documents, remarks, flights, listings) are uploaded; they are visible to the relevant members of your club.
  • Diagnostics: crash reports are sent to our self-hosted error tracking server, without personally identifying data.
  • What the app does not do: no advertising or analytics tools, no access to the phone's microphone, contacts or calendar.

Recipients and service providers

Your data is never sold. It is accessible only:

  • Within your club, according to roles: managers, instructors and mechanics see what they need for their tasks; other members see only what the club chooses to share.
  • Hosting: OVH servers located in France; Cloudflare delivers and protects the website.
  • Payments: Stripe (gift vouchers, discovery flights, account top-ups, club payments).
  • Emails: Mailjet. Text messages: Twilio. Notifications: Expo, which delivers them through Apple and Google services.
  • Maps: IGN (GĂ©oplateforme), OpenFreeMap and MapTiler receive your IP address and the map area displayed.
  • Weather and NOTAM: our server queries MĂ©tĂ©o-France, the French civil aviation authority (SOFIA), aviationweather.gov (NOAA) and Open-Meteo, without passing on your identity.
  • Optional AI features (4fly assistant, reading a photo of a logbook): the content you submit is sent to AI model providers (OpenAI, Anthropic), solely to produce the answer.
  • Calendar: if an instructor connects their Google calendar, their availability and bookings are synchronised with Google Calendar.
  • Federations: at your club's request, some data (name, date of birth, licence number, flight activity) is sent to the relevant federation, for example the FFA for the AERAL report.
  • Website audience measurement: Google Analytics and Google Ads (see the Cookies section).
  • Authorities: only when required by law.
  • Transfers outside the European Union: Stripe, Twilio, Expo, Google, OpenAI, Anthropic and Cloudflare may process data in the United States. These transfers are covered by the European Commission's standard contractual clauses or the Data Privacy Framework.

Retention periods

We keep your data for as long as necessary, then delete or anonymise it:

  • Account and profile: as long as your account is active. If you delete your account, your personal data is erased; flights and accounting entries that must be kept are separated from your identity.
  • Accounting records (invoices, payments): 10 years, as required by the French Commercial Code.
  • Documents (licences, medical certificates): as long as you are a member, or until you or the club delete them.
  • Flight tracks: kept with the flight they are attached to. Recordings that are not attached stay on your phone until you delete them.
  • Discovery flight passenger information sheets: kept with the flight file, for at least 3 months after the flight as required by regulations.
  • Club messages: until they are deleted, or the account or club is deleted.
  • Deleted club: its data is erased 30 days after the request, unless the law requires otherwise.
  • Notification tokens: deleted when you log out or as soon as they are no longer valid.
  • Crash reports: 60 days. Audit logs: 7 days.
  • Contact and demo requests: as long as needed to handle the request, and no more than 3 years after the last exchange.

Cookies and audience measurement (website)

The 4fly.io website and the web app use:

  • Technical cookies and storage needed for operation (login, language, display preferences), which do not require consent.
  • Google Analytics, to measure traffic statistically, and Google Ads, to measure the effectiveness of our ads. These tools set cookies and send Google your IP address and the pages you visit.
  • These measurement and advertising cookies require your consent. You can refuse or delete them at any time in your browser settings, or install the Google Analytics opt-out add-on.
  • The mobile app uses none of these tools.

Minors

4fly is not aimed directly at children. However, data about minors may be processed: student pilots registered by their club, and minor passengers on discovery flights, for whom the name and signature of a legal guardian are required. This data is limited to what the flight, training and regulations require. A legal guardian can exercise the minor's rights by writing to [email protected].

Data Protection

We implement technical and organizational security measures to protect your data:

  • Encryption of sensitive data
  • Restricted access to personal data
  • Regular and secure backups
  • Continuous security monitoring

Your Rights

In accordance with GDPR, you have the following rights:

  • Right of access to your personal data
  • Right to rectification of inaccurate data
  • Right to erasure of your data
  • Right to limitation of processing
  • Right to data portability
  • Right to object to processing
  • Right to withdraw your consent at any time
  • Right to give instructions on what happens to your data after your death
  • Right to lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr)

Contact

For any question or to exercise your rights: [email protected], or by post to MELBA CAPITAL, 5 route de Cussieux, 42400 Saint-Chamond, France. We reply within one month.

Update

This data protection policy may be updated periodically. The last update was on 11/3/2026.