Data Processing Agreement (flight schools)
Draft — not legal advice — pending review by a lawyer. This page describes how the product works today; the reviewed text will replace it before the service is sold.
A template of the data processing agreement between a flight school (controller) and us (processor) under Article 28 GDPR. It is published so schools can review it early; the signed version will be agreed with each school after legal review.
On this page
1. Parties and roles
Controller: the flight school or organisation that subscribes to an organisation plan (“the School”), for the personal data of its students and staff it manages in the service.
Processor: Readback Labs SRL, [registered address to be confirmed] (“the Provider”).
This agreement is part of the School's subscription terms (Terms of Service) and applies for as long as the Provider processes personal data for the School. Where it conflicts with the terms on personal data, this agreement prevails.
2. Processing only on documented instructions
The Provider processes the School's personal data only to provide the service described in Annex 1 and on the School's documented instructions (this agreement, the School's use of the service's settings, and written instructions), including for transfers to third countries, unless EU or Member State law requires otherwise; in that case the Provider informs the School first unless the law forbids it. The Provider tells the School if, in its opinion, an instruction infringes data protection law.
3. Confidentiality
Everyone authorised by the Provider to process the data is bound by confidentiality.
4. Security (Art. 32)
The Provider implements at least the technical and organisational measures in Annex 2 and keeps them up to date.
5. Sub-processors
The School gives general authorisation for the sub-processors in Annex 3. The Provider informs the School of an intended addition or replacement at least 30 days in advance (notice period to be confirmed); the School may object on reasonable data-protection grounds, and if the parties cannot resolve the objection the School may terminate the affected service. The Provider imposes the same data-protection obligations on each sub-processor and remains liable for them.
6. Assistance with data subjects' rights and compliance
The service lets each user download their own data and delete their own account. The Provider assists the School, by appropriate technical and organisational measures, with other requests from data subjects, and with the School's obligations on security, breach notification, impact assessments and prior consultation, taking into account the nature of the processing.
7. Personal data breaches
The Provider notifies the School without undue delay, and where feasible within 48 hours (period to be confirmed), after becoming aware of a personal data breach affecting the School's data, with the information the School needs for its own notification.
8. End of the service
At the end of the service the Provider deletes or returns the School's personal data, at the School's choice, and deletes existing copies unless law requires storage; data in rolling backups expires within the backup period stated in Annex 2.
9. Information and audits
The Provider makes available the information necessary to demonstrate compliance with Art. 28 and allows for and contributes to audits, including inspections, by the School or an auditor it mandates, on reasonable notice.
Annex 1 - Details of the processing
| Subject matter and purpose | Radiotelephony practice with a simulated controller; deterministic checking of readbacks; debriefs, progress and instructor visibility; lesson assignments; seat management. |
|---|---|
| Nature | Collection of voice audio in transit (speech recognition, not stored), transient transcription and interpretation (not stored), storage of check results and training records, display to the School's instructors and admins. |
| Data subjects | The School's students, instructors and administrators. |
| Categories of data | Account (e-mail), display name, membership and roles, preferences, training records and check results, progress, lessons assigned and instructor notes, content-free technical records. Voice audio and transcripts are processed transiently and not stored. No special categories of data are intended. |
| Duration | For the term of the School's subscription; retention as in the Privacy Policy. |
Annex 2 - Technical and organisational measures
- Encryption in transit (TLS) for every connection; the database provider encrypts data at rest.
- Tenant isolation enforced by database row-level security on every organisation-scoped table, with automated cross-tenant tests.
- Least privilege: the realtime service and the web server's privileged functions run as dedicated database roles with no direct table access; no service-role key in the browser.
- Voice audio held in memory only, per transmission; transcripts not persisted; logs redact content fields.
- Signed, single-use realtime admission tickets; signature-verified payment webhooks; rate limits on sign-in, sign-up and public forms.
- Immutable audit log of membership, role and session changes.
- Backups and restore as documented in the operations runbook (backup period to be confirmed with the database plan).
Annex 3 - Authorised sub-processors
| Provider | What for | What it receives | Where | Agreement |
|---|---|---|---|---|
| Supabase | Database and sign-in (authentication) | Your account (e-mail address, hashed password), profile, preferences, organisation memberships, training record, billing status mirror, security audit entries | Hosting region to be confirmed before launch (an EU region is intended) | To be signed before launch |
| Railway | Hosting the website and the realtime training service | Web requests, your voice audio in transit while you transmit, short-lived server logs (no audio, no transcripts) | Region to be confirmed before launch | To be signed before launch |
| AssemblyAI | Speech recognition | The audio of each transmission (at most 60 seconds) and a list of expected aviation words for the exercise; no name or e-mail | EU endpoint (sync.eu.assemblyai.com) - the only endpoint the adapter uses; the provider's retention of that audio is to be confirmed in the DPA | To be signed before launch |
| Cartesia | The controller's synthetic voice | The controller's words only - which include your aircraft callsign (for example a registration you chose); never your audio or what you said | Region and retention to be confirmed in the DPA | To be signed before launch |
| Google Cloud (Vertex AI, Gemini) (when enabled) | Understanding unusual phrasing of your calls, where the deployment enables it | The recognised text of a call, your callsign, and the exercise context (expected phrases, stations); no audio, no name or e-mail | EU multi-region endpoint (aiplatform.eu.rep.googleapis.com) when configured with location "eu" | To be signed before launch |
| Stripe (when enabled) | Payments, subscriptions, invoices and VAT calculation | Your e-mail, name and billing address, VAT or tax id if given, payment details (entered on Stripe's page, never seen by us), and the plan you buy | Stripe's EU entity for EU customers; transfers under Stripe's own safeguards (to be confirmed) | To be signed before launch |