LEGAL / PRIVACY POLICY
Privacy Policy
LAST UPDATED · 15 AUGUST 2026
VOLAR ("VOLAR", "we", "us") is an AI-powered study assistant for flight schools, available at volarstudy.com. This Privacy Policy explains what personal data we collect, why we collect it, how we protect it, and the rights you have over it.
VOLAR is operated by [registered legal entity name and address — to be confirmed at incorporation; until then, the individual operator]. For any privacy question or request, contact us at volarapp@outlook.com.
1. Who this policy applies to
This policy covers three groups of people:
- Students and school staff who use VOLAR through their flight school's account.
- School administrators who manage their school's VOLAR workspace.
- Visitors to volarstudy.com who are not logged in.
2. Our role: controller or processor
If you are a student or staff member, your flight school decides who is enrolled in VOLAR and directs how the platform is used for training. Under the EU General Data Protection Regulation (GDPR), your school is the data controller of your personal data, and VOLAR acts as a data processor on the school's behalf. We process your data under a Data Processing Agreement with your school. Requests to exercise your data rights can be made to us directly or through your school — see Section 9.
For website visitors and for limited operational data (such as service logs), VOLAR is the data controller.
3. What data we collect
Account data (provided by you or your school):
- Name and email address
- Student code / roster identifier assigned by your school
- Class cohort ("promotion") membership
- Account settings (for example, home airport)
Study activity data (generated as you use VOLAR):
- Questions you ask the AI study chat, and the answers given
- Quiz attempts, answers, and scores
- Briefing-simulator sessions and results
- Pinned documents and questions, study streaks, and usage activity
School content:
- Documents uploaded by your school (SOPs, manuals, briefings). These belong to your school and may incidentally contain personal data the school includes in them.
Technical data:
- Standard server logs (IP address, browser type, timestamps) kept for security and reliability
We do not collect payment details from students (billing is handled directly with schools), and we do not collect precise location data.
4. Why we process your data (purposes and legal bases)
| Purpose | Data used | Legal basis |
|---|---|---|
| Providing the study assistant: answering questions, generating and grading quizzes, running briefings | Account data, study activity, school documents | Performance of our contract with your school (processed on the school's instructions) |
| School analytics: knowledge gaps, quiz trends, cohort activity | Study activity, aggregated per class cohort | Performance of our contract with your school |
| Account management: invitations, login, password reset | Name, email | Performance of our contract with your school |
| Security, abuse prevention, and service reliability | Technical data | Legitimate interests (keeping the service secure and working) |
| Responding to enquiries from visitors | Whatever you send us | Legitimate interests / steps prior to a contract |
A note on analytics and student privacy: performance analytics shown to school staff (quiz insights, trends) are aggregated at the class cohort level, never per named student. This is enforced on our servers, including in data exports. Your instructors can see how a cohort is doing; they are not shown a ranked list of individual students' scores.
5. AI processing
VOLAR's study chat and quiz features are powered by the Anthropic Claude API. When you ask a question, your question and relevant excerpts of your school's documents are sent to Anthropic to generate the answer. Under Anthropic's standard commercial API terms, your data is not used to train Anthropic's AI models. Answers are generated only from your school's uploaded documents; VOLAR is designed to say "I don't know" rather than guess when the school's library doesn't cover a topic.
6. Who we share data with (subprocessors)
We never sell personal data. We share data only with the service providers required to run VOLAR:
| Provider | What they do | Where |
|---|---|---|
| Supabase | Database, authentication, and document storage | EU (Ireland) |
| Anthropic | AI processing of study questions | United States |
| Vercel | Application hosting and delivery | EU/US (global edge network) |
| Resend | Sending invitation and account emails | United States |
Your school's core data — accounts, chat history, quiz results, and uploaded documents — is stored in the European Union (Ireland).
Where a provider processes data outside the EU/EEA (Anthropic, Resend, and parts of Vercel's network), transfers are protected by recognised GDPR transfer mechanisms: the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses, as set out in each provider's data processing agreement.
We may also disclose data if required by law, or to protect the safety and rights of users or the public.
7. How long we keep data
- Active accounts: for as long as your school's contract with VOLAR is active and your account exists.
- When you delete your account: your name, email, student code, chat history, quiz scores, and pinned items are deleted immediately.
- When a school's contract ends: the school's data (accounts, activity, documents) is retained for 90 days so the school can export it or renew, then permanently deleted. Residual copies in encrypted backups are purged within a further 30 days.
- Server logs: kept for a short rolling period for security purposes, then deleted.
8. Security
All data is encrypted in transit (TLS) and at rest. Access to school data is isolated per school at the database level (row-level security), so one school can never access another school's documents, students, or activity. Authentication is rate-limited, backups are encrypted, and access to production systems is restricted.
No system is perfectly secure, but if we become aware of a personal data breach affecting you, we will notify your school (as controller) and, where required, you and the relevant authorities, in line with GDPR.
9. Your rights
Under GDPR you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate data
- Erase your data ("right to be forgotten") — students can do this directly via the delete-account option in the app
- Restrict or object to certain processing
- Data portability — receive your data in a usable format
- Complain to a supervisory authority — for students in Spain, this is the Agencia Española de Protección de Datos (AEPD, www.aepd.es)
Because your school is the controller of student data, some requests (for example, correcting your enrolment details) may need to be completed by your school. You can always start by emailing volarapp@outlook.com and we will either handle the request or route it to your school, without undue delay and at the latest within one month.
10. Students under 18
Some student pilots are under 18. VOLAR is made available to students only through their flight school, which is responsible for enrolment and for obtaining any consents required from parents or guardians under applicable law. We do not knowingly allow anyone to sign up for VOLAR outside of a school's roster, and we collect only the data described in this policy, regardless of age.
11. Cookies
VOLAR uses only essential cookies and local storage needed to keep you logged in and make the app work. We do not use advertising cookies or third-party analytics trackers. Because these are strictly necessary, no consent banner is required.
12. Changes to this policy
If we make material changes to this policy, we will update the date at the top and notify schools (and, where appropriate, users in the app) before the changes take effect.
13. Contact
VOLAR — [legal entity name and registered address — to be confirmed at incorporation]
Email: volarapp@outlook.com
[If required after incorporation: contact details of the appointed Article 27 EU representative]
See also: Terms of Service · volarstudy.com