LEGAL / PRIVACY POLICY

Privacy Policy

LAST UPDATED · 6 September 2026

VOLAR is an AI study assistant for student pilots and flight schools, available at volarstudy.com. This policy explains what personal data we collect, why, how we protect it, and the rights you have over it.

VOLAR is operated by Juan-Pierre de Villiers, trading as VOLAR, of Dubai, United Arab Emirates.

For any privacy question or request: juanpierre@volarstudy.com

1. Who this policy applies to #

1. Personal subscribers. You signed up yourself at volarstudy.com on a Free, Pro or Elite plan.
2. Students and staff at a flight school. Your school enrolled you.
3. School administrators who manage a school's workspace.
4. Visitors to volarstudy.com who are not logged in.

2. Our role: controller or processor #

For personal subscribers, VOLAR is the data controller. We decide what data is collected and why, and you deal with us directly for all your rights.

For students and staff at a flight school, your school is the data controller and VOLAR acts as a data processor on the school's behalf under a Data Processing Agreement. Your school decides who is enrolled and how the platform is used. You may make requests to us directly or through your school. See Section 10.

For website visitors and for operational data such as server logs and abuse prevention, VOLAR is the controller.

3. What data we collect #

Account data

• Name and email address
• Password (stored only as a salted hash, never in readable form)
• Your training authority, training stage and country, if you tell us
• The name of your flight school, if you tell us, so we can tell you when it joins
• For school accounts: student code and class cohort ("promotion") assigned by your school
• Account settings such as home airport and chosen aircraft

Study activity data

• Questions you ask the AI, and the answers given
• Quiz and knowledge check attempts, answers, scores, the syllabus sections covered, and spaced-repetition state
• Briefing simulator sessions and results
• Instrument and radiotelephony trainer sessions, grades and skill progress
• Cockpit trainer usage
• Pinned documents and questions, study streaks and usage activity

Voice data The radiotelephony trainer records your voice while you hold the transmit control. Audio is sent to a speech-to-text provider, converted to a transcript, and the transcript is stored with your session so you can review it and so the trainer can grade you. We do not retain the audio recording after transcription. Synthesised controller audio is cached in a form that cannot be traced back to you. Microphone access is requested only when you press to talk and the microphone is released when you leave the trainer.

Documents

• Documents uploaded by your school. These belong to your school and may incidentally contain personal data the school included in them.
• Files you upload yourself to a briefing session, such as a navigation log or chart.

Payment data We do not see or store your card details. Payments for personal subscriptions are processed by Paddle, which acts as merchant of record. Paddle collects your payment and billing details directly and shares with us only your subscription status, plan, term and country. Paddle's own privacy policy governs the data it collects.

Technical and anti-abuse data

• Standard server logs: IP address, browser type, timestamps
• A device signature: a one-way hash derived from your browser and device settings, used to detect people creating many accounts to obtain repeated free trials
• A one-way hash of a normalised form of your email address, used for the same purpose
• A Cloudflare Turnstile check at signup to block automated signups

We do not collect precise location data and we do not use advertising or third-party analytics trackers.

4. Why we process your data, and our legal basis #

A note on student privacy in schools. Performance analytics shown to school staff are aggregated at class cohort level, never per named student. This is enforced on our servers, including in exported files. Your instructors can see how a cohort is doing. They are not shown a ranked list of individual students' scores.

You can object to processing based on legitimate interests. See Section 10.

5. AI processing #

When you ask a question, run a quiz or a knowledge check, fly a trainer or run a briefing, your input and the relevant excerpts of the source documents are sent to an AI provider to generate the response. We use Google (Gemini) as our primary provider and Anthropic (Claude) for certain features and as a fallback.

Your data is not used to train these providers' AI models. This is governed by their standard commercial API terms, which exclude training on customer data.

For school accounts, answers are generated only from that school's uploaded documents, and VOLAR is designed to say it does not know rather than guess when the library does not cover a topic. For personal accounts, answers are generated from published reference material.

6. Who we share data with #

We never sell personal data. We share it only with the providers required to run the Service.

Core account data, activity and documents are stored in the European Union.

Where a provider processes data outside the EU or EEA, transfers are protected by recognised transfer mechanisms under the GDPR: the EU-US Data Privacy Framework and the European Commission's Standard Contractual Clauses, as set out in each provider's data processing agreement.

We may also disclose data if required by law, or to protect the safety and rights of users or the public.

7. How long we keep data #

• Active accounts: for as long as your account exists and, for school accounts, while your school's contract is active.
• When you delete your account: your name, email, chat history, quiz and knowledge check results, trainer sessions, voice transcripts and pinned items are deleted immediately. Residual copies in encrypted backups are purged within 30 days.
• When a school's contract ends: the school's data is retained for 90 days so the school can export or renew, then permanently deleted, with backups purged within a further 30 days.
• Voice audio: deleted immediately after transcription. Transcripts follow your account.
• Billing records: Paddle retains transaction records for the period required by tax law. We retain your subscription history for the same reason.
• Server logs and anti-abuse hashes: kept for a short rolling period, then deleted.

8. Security #

Data is encrypted in transit and at rest. Access to school data is isolated per school at the database level so one school cannot access another school's documents, students or activity. Authentication is rate limited, backups are encrypted, and access to production systems is restricted.

No system is perfectly secure. If we become aware of a personal data breach affecting you, we will notify you and, where required, your school and the relevant supervisory authority, in line with the GDPR.

9. Age #

You must be 18 or over to create a personal account at volarstudy.com. We do not knowingly collect data from anyone under 18 through self-signup. If you believe someone under 18 has created a personal account, contact juanpierre@volarstudy.com and we will close it and delete the data.

Some student pilots at flight schools are under 18. Those students access VOLAR only through their school, which is responsible for enrolment and for obtaining any consent required from a parent or guardian under applicable law.

10. Your rights #

Under the GDPR and equivalent laws you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate data
• Erase your data. Personal subscribers can do this directly with the delete account option in the app
• Restrict or object to processing, including processing based on legitimate interests
• Data portability: receive your data in a usable format
• Withdraw consent where processing is based on consent
• Complain to a supervisory authority. You may complain to the data protection authority in the country where you live.

For personal accounts, email juanpierre@volarstudy.com. For school accounts, some requests such as correcting enrolment details may need to be completed by your school. You can still start with us and we will handle it or route it, without undue delay and within one month at the latest.

We do not make decisions with legal or similarly significant effects about you by automated means. Quiz and knowledge check grades, trainer scores and readiness verdicts are practice output and have no official standing.

11. Cookies and local storage #

VOLAR uses only what is strictly necessary: a session token to keep you logged in, local storage to hold your preferences and to make the app load quickly, and a Cloudflare Turnstile cookie at signup to block automated signups.

We use no advertising cookies and no third-party analytics trackers. Because these are strictly necessary, no consent banner is required.

12. Changes to this policy #

If we make material changes we will update the date at the top and notify you in the Service and by email before the changes take effect.

13. Contact #

VOLAR Juan-Pierre de Villiers, trading as VOLAR Dubai, United Arab Emirates juanpierre@volarstudy.com

See also: Terms of Service · volarstudy.com