Privacy policy

Flightglass is provided by company name to be confirmed, a company registered in England and Wales with company number number to be confirmed, whose registered office is at address to be confirmed. For the personal data described here we are the controller under UK data protection law (the UK GDPR and the Data Protection Act 2018).

Questions or requests about your data: contact email to be confirmed.

Your account. When you sign in to Flightglass, we decide how your account data is used, so we are its controller. This policy covers that.

Data in assessments. When a firm uploads a customer’s collector file or enters details about its customers, the firm decides what is processed and why. We process that data for the firm, as its processor, under our data processing agreement. If you work for a company that has been assessed and want to ask about that data, please contact the consulting firm that assessed you; we’ll help them answer.

• Account details: your name, work email address, your firm’s name and your role (admin or consultant).
• Firm details for reports: the contact name, email and phone number, logo and colours your firm chooses to show on its reports.
• Billing: your firm’s Stripe customer reference, plan, subscription status, and the amounts and dates of payments. Card details are entered on Stripe’s own page and never reach us.
• Activity: a record of significant actions in your firm’s account (for example uploads, exports, approvals, invitations and deletions), with who did them and when, so your firm has an audit trail. We also count AI usage per assessment.
• Sign-in and security records: our sign-in provider records sign-in events, including IP address and browser, to keep accounts secure.
• Customer upload links: to stop the links being misused, we count requests from each network using a scrambled form of the IP address (a keyed hash that can’t be turned back into the address), and delete the counts within a day.
• Operational records: whether server tasks such as evaluations and payments worked and how long they took. These never contain your customers’ data.
• Launch news list: if you ask to be told when Flightglass opens, your email address, optionally your firm’s name, and when you signed up and confirmed.
• Messages you send us, for example support or privacy requests.

Cookies: we only use cookies that are needed to keep you signed in. We don’t use analytics, advertising or tracking cookies. Your light or dark theme choice is stored in your own browser. The demo keeps its sample data in your browser only and sends nothing to us.

• To provide Flightglass (accounts, sign-in, assessments, reports, billing and support): to perform our contract with your firm, and our legitimate interest in providing the service to the people your firm invites.
• To keep Flightglass secure and working (preventing misuse, investigating problems, measuring reliability): our legitimate interests.
• To run our business (understanding how many firms use Flightglass and which features they use, in aggregate): our legitimate interests.
• To tell you when Flightglass opens, if you joined the launch news list: your consent, which you confirm by email and can withdraw at any time with the unsubscribe link in every email.
• To meet legal obligations, for example keeping tax and accounting records.
• To tell you about important changes to the service or these terms: our contract and legitimate interests. We don’t send marketing email without your permission.

We don’t sell personal data, use it for advertising, or use it to train AI models. Flightglass scores are calculated from cloud configuration settings by fixed rules; we don’t make automated decisions about people.

We use these providers to run Flightglass. Each is bound by a contract to protect the data and use it only to provide its service to us.

Flightglass stores its data in the United Kingdom. Where a provider processes data outside the UK, the transfer is protected by UK adequacy regulations or by the UK International Data Transfer Agreement or Addendum, as offered by that provider. We may also share data if the law requires it, or with a company that takes over Flightglass, in which case we’ll tell you.

• Account and firm details: while your firm’s account is open, and deleted within 30 days of it closing.
• Uploaded collector files: deleted automatically 90 days after upload. The findings and scores worked out from them stay with the assessment until your firm deletes it or closes its account.
• Activity records: for as long as the account is open, so your firm keeps its audit trail.
• Operational records: deleted after 90 days.
• Invoices and payment records: six years, as UK tax law requires.
• Launch news list: until you unsubscribe, and no later than 12 months after Flightglass opens. Addresses that are never confirmed are removed then too.

Data is encrypted in transit and at rest. Each firm’s data is kept apart by database rules that are tested automatically, so one firm can never see another’s. Files are private and opened only through short-lived links. Sign-in uses one-time email links, so we never store passwords. Access by Flightglass staff is limited to support and operations.

You have the right to:

• get a copy of the personal data we hold about you;
• have it corrected if it’s wrong;
• have it deleted, or its use restricted, in some circumstances;
• object to our use of it where we rely on legitimate interests;
• receive it in a portable format, where that applies.

To use any of these rights, email contact email to be confirmed. We’ll reply within one month. If you’re unhappy with how we’ve handled your data, please tell us first; you can also complain to the Information Commissioner’s Office at ico.org.uk.

We’ll update this policy when what we do changes, and change the date at the top. If a change matters to you, we’ll tell your firm’s admins by email before it applies.