Privacy Policy

This Privacy Policy describes how the IVAO United Kingdom & Ireland Division ("XU Division", "we", "us", "our") handles personal information when you use this website. It applies to all pages and services under xu.ivao.aero, including your member dashboard, the Training Management System, events and flight operations, and any optional integrations you enable.

We are a volunteer-run, non-commercial part of IVAO. We collect only what we need to provide division services, and we never sell your data.

The XU Division is the data controller for information processed through this website, operating within the wider framework and systems of the International Virtual Aviation Organisation. For any question about this policy or your data, contact our Web Department at xu-web@ivao.aero.

The table below sets out the categories of personal data we process, why we process them, where they come from and how long we keep them.

We do not knowingly process special-category data. Any dietary or accessibility information you provide for in-person events is optional, used only to support your attendance, and deleted once no longer needed.

• To authenticate you and provide your member dashboard, profile and services.
• To operate the Training Management System, events, flight operations and staff functions.
• To send you service communications such as booking confirmations, reminders and status updates.
• To keep the platform secure, maintain audit trails, prevent abuse and diagnose problems.
• To comply with applicable IVAO regulations and legal obligations.

We do not sell your data or use it for third-party advertising or profiling.

We rely on the following bases: performance of our service to you as an IVAO member (running your account, training and event participation); legitimate interests in keeping the platform secure and functioning; and your consent for optional features such as linking Discord or connecting Google Calendar, which you may withdraw at any time.

We use a single essential session cookie to keep you signed in and to protect forms against cross-site request forgery. We may use your browser's local storage to remember interface preferences (such as light or dark mode). We do not use advertising or third-party tracking cookies.

Your data is shared only where necessary to provide the service:

• IVAO HQ - as part of the wider IVAO systems your membership relies on.
• Discord - only if you link your account, to manage roles and messages.
• Google - only if you connect Google Calendar, to create your session events.

We may also disclose information where required by law or by IVAO regulations. We do not transfer your data to any party for their own independent use.

We keep your data for as long as your IVAO membership is active and you use division services, and for a reasonable period afterwards where needed for records, safety or dispute resolution. Security and activity logs are rotated routinely, and OAuth tokens for optional integrations are deleted when you disconnect them.

We take reasonable technical and organisational measures to protect your information:

• Encryption in transit: all traffic to and from the website is served over encrypted TLS (HTTPS) connections.
• Encryption at rest for sensitive data: credentials such as third-party OAuth tokens are stored in encrypted form and never exposed to other members or in client-side code.
• Access control: access to member data is restricted to authorised staff on a need-to-know, least-privilege basis, governed by the permissions attached to each account.
• Auditing: administrative actions are logged to support accountability, and we apply security updates as part of routine maintenance.

While no online service can be guaranteed completely secure, these measures are designed to protect your data against unauthorised access, disclosure, alteration and loss.

If you choose to connect Google Calendar, this website requests the sensitive Google OAuth scope https://www.googleapis.com/auth/calendar.events. We treat all data obtained through Google APIs as sensitive data and apply the specific safeguards set out below.

What we access and store

• The OAuth access token, refresh token and expiry time issued to us by Google;
• The identifiers of the calendar events we create on your calendar for your training sessions.
• We do not read, import or store any of your other Google Calendar events, contacts, email or profile data.

How we protect this sensitive data

• In transit: all communication with Google and between your browser and our servers is encrypted using TLS (HTTPS).
• At rest: OAuth tokens are stored encrypted in our database and are never exposed to other members or in client-side code.
• Access control: access is limited to the automated calendar-sync process and to authorised staff strictly where needed, on a least-privilege basis, with administrative actions logged.
• Limited use: we use this data only to create and update calendar events for your own training sessions. We never sell it, use it for advertising, or use it to develop, improve or train generalised artificial-intelligence or machine-learning models.
• Revocation & deletion: you can disconnect at any time, which deletes the stored tokens; you can also revoke access from your Google Account security settings at myaccount.google.com/permissions.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

You may request access to, correction of, or deletion of the data this website holds about you, and you may object to or restrict certain processing, by contacting xu-web@ivao.aero. You can withdraw consent for optional integrations at any time from your account. Some records must be retained by IVAO HQ under the wider IVAO Privacy Policy; requests concerning your core IVAO membership should be directed to IVAO.

Optional integrations are governed by their providers' own privacy policies: Discord and Google. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We recommend reviewing those policies before connecting an account.

We may update this policy from time to time. The date at the top of this page reflects the latest revision, and continued use of the website after changes take effect constitutes acceptance of the updated policy.

Questions about this Privacy Policy or your data can be sent to xu-web@ivao.aero. See also our Terms of Use.