Use Before Flight Training App: privacy policy

Last updated: 27 October 2026

This policy explains what personal data Use Before Flight collects when you use the Use Before Flight Training App, on iOS or on the web, why we use it, who we share it with, how long we keep it, and your rights. Our website, usebeforeflight.com, has its own privacy policy for its visitors and for people who contact us through it.

Who we are

Use Before Flight is a trading name of Northcote Technology Ltd, a company registered in England and Wales (company number 05497650). Our registered office is The Beehive, Ring Road, Gatwick Airport, RH6 0PA.

Northcote Technology Ltd is the controller of the personal data this policy describes. That means we decide how and why it's used, and we're responsible for looking after it. Our Spanish subsidiary, Use Before Flight SL, in Madrid, works with us on our products and services and handles personal data on our behalf where applicable.

For anything about this policy or your personal data, email privacy@usebeforeflight.com. This reaches our data protection officer.

What we collect, and why

When you create an account, subscribe and use the app, we collect:

• Account details: your first and last names, your email address and your password, stored in a hashed form that we cannot ordinarily reverse to recover your password.
• Subscription details: which aircraft types and add-ons you subscribe to, start and end dates, trial and renewal status, any discount code you've used, and your reason for cancelling and any comments, if you give them.
• Payment details: our payment provider collects and keeps your card details and billing address; we never see your full card details. We keep references to your customer record, subscriptions and invoices with our payment provider. When you subscribe, we also give our payment provider your IP address, which it may use and retain under its own privacy policy.
• Sign-in information: how many times you've signed in. Older versions of the app also recorded an identifier for the device you used, to apply the one-device limit in our terms. We retain any such identifier only for as long as necessary for that purpose or another applicable, documented purpose.
• Error reports: if the app or our servers hit an error, an automatic report goes to our error-monitoring service. It can include your device type, operating system and app version, your account number and, for some sign-in and account errors, your email address.
• Server logs: our servers record each request they receive, including your IP address, to keep the app working, troubleshoot problems and maintain security.
• Messages to our support team and our replies: these may include your contact details, the contents of your enquiry and information needed to answer questions, investigate technical problems, manage subscriptions or complaints, and establish, exercise or defend legal claims.

The web app uses cookies to manage sign-in sessions, including an optional “Remember me” feature that keeps you signed in for up to two weeks. The app keeps you signed in by storing your sign-in details on your device, where it also keeps your favourites and settings.

The app's videos play from our video host, which receives your IP address and information about your device when you play one. Our video host is responsible for its own processing under its own privacy policy.

If your airline or training organisation gives you access to the app, it gives us your email address so we can invite you. Its administrators see the email addresses and products they've ordered, and the dates; they don't see how you use the app.

Lawful bases: we process account and subscription data where necessary to provide the app under our contract with you. We retain payment and invoice records where necessary to comply with applicable legal obligations. We process support messages to provide customer support, administer subscriptions and, where appropriate, pursue our legitimate interests in resolving complaints, maintaining customer service history and establishing, exercising or defending legal claims. Error reports, server logs and security monitoring are processed where necessary for our legitimate interests in keeping the app working, troubleshooting problems and maintaining security. Where another lawful basis applies, we rely on it as appropriate.

Automated decision-making

We do not make decisions about you based solely on automated processing, including profiling, that produce legal or similarly significant effects.

Marketing

We don't send marketing emails.

Who we share your data with

We don't sell your personal data, and we don't share it for other organisations' marketing.

We use service providers to operate the app and provide its features, including:

• Web hosting and infrastructure providers, which host the web app and run the app's servers and database containing account and subscription details.
• Logging and error-monitoring providers, which help us troubleshoot problems and maintain security. Logs may include IP addresses and, in some error messages, email addresses. Error reports may include device and account information.
• Email providers, which deliver app emails, such as invitations, sign-in confirmations and password resets, and provide our support email service.
• Payment providers, which process payments and receive the payment information described above. They may also process personal data for their own purposes, such as fraud prevention and compliance with legal obligations, under their own privacy policies.
• Video hosting providers, which deliver videos in the app and receive information such as your IP address and device information when you play them.

Where these providers act as our processors, they process personal data on our behalf under contracts requiring them to protect it and use it only as instructed. Some providers may process personal data for their own purposes under their own privacy policies.

We may also share personal data:

• with our professional advisers, such as lawyers, accountants and auditors, including our ISO certification body, where they need it
• if the law requires it, or where necessary to protect our rights, our customers or others
• with a buyer or prospective buyer if our business, or part of it, is sold.

Transfers outside the UK and EEA

Some of our service providers may process personal data outside the UK or European Economic Area (EEA). Where applicable data protection law requires safeguards for an international transfer, we use an appropriate transfer mechanism.

Depending on the transfer and the law that applies, this may include an adequacy decision or regulations, the UK's International Data Transfer Agreement, the UK Addendum to the European Commission's Standard Contractual Clauses, or the European Commission's Standard Contractual Clauses.

You can contact us at privacy@usebeforeflight.com for further information about the safeguards used for relevant transfers, including how to obtain a copy where available.

How long we keep your data

We keep personal data only for as long as necessary for the purposes described in this policy, taking account of applicable legal obligations and the need to establish, exercise or defend legal claims. The periods below are our standard retention periods; specific records may need to be kept for a different period where justified.

We review our retention periods and may delete or anonymise personal data earlier where it is no longer needed. Where a legal obligation or an ongoing or reasonably anticipated legal claim requires longer retention, we retain only the information reasonably necessary for that purpose and review it when the obligation or claim ends.

Deleting your account does not necessarily delete records we must retain under applicable law or records we need to retain for legal claims. Where we retain data after account deletion, we limit its use to the relevant purpose and delete it when that purpose no longer applies.

How we protect your data

We're certified to ISO/IEC 27001, the international standard for information security management, by AENOR. Data is encrypted in transit and at rest, and access is limited to the staff who need it.

Your rights

Under UK data protection law, and EU law where it applies, you have the right to:

• ask for a copy of the personal data we hold about you
• ask us to correct data that's wrong or incomplete
• ask us to delete your data
• ask us to restrict how we use your data
• object to our using your data where we rely on our legitimate interests
• ask for data you gave us to be sent to you, or to another organisation, in a common electronic format, where the right to data portability applies
• withdraw your consent at any time, where we rely on consent.

These rights are subject to legal conditions and exceptions. For example, we may need to retain payment records to comply with legal obligations, or retain relevant records to establish, exercise or defend legal claims. Where an exception applies, we will explain this where appropriate.

To use any of these rights, email privacy@usebeforeflight.com. We'll normally reply within one month. Where permitted by law, this period may be extended in certain circumstances, and we'll let you know if an extension applies. There's normally no charge.

You can also delete your Training App account yourself, from your account page at app.ubf.io, once you have no active subscription.

Complaints

If you're unhappy with how we've handled your personal data, please tell us first at privacy@usebeforeflight.com. We'll acknowledge your complaint within 30 days, look into it, and tell you what we find.

You can also complain to the Information Commissioner's Office, the UK's data protection regulator: ico.org.uk/make-a-complaint, or 0303 123 1113. If you live or work in the European Union, you can complain to the data protection authority competent for your circumstances; in Spain, this may be the Agencia Española de Protección de Datos (aepd.es).

Children

The Training App is meant for professionals, not children. We don't knowingly collect personal data from anyone under 18.

Changes to this policy

We'll update this policy when how we use personal data changes, and change the "Last updated" date at the top. If a change affects you significantly, we'll tell you by email before it takes effect where appropriate or required by law.