U2 DATALINK PRIVACY POLICY ========================== Version 1.0 - effective [DATE] Applies to: the U2 Datalink web desktop (https://[SITE-DOMAIN]) and the U-2 aircraft telemetry reporter that sends data to it, including the apps IMINT, Flight History, Weather Survey, Land Survey, My Statistics, All Users Statistics, miltechRadar24 and miltagram. Items in [square brackets] must be completed by the controller before publication. 1. WHO IS RESPONSIBLE FOR YOUR DATA (CONTROLLER) ------------------------------------------------ [LEGAL ENTITY NAME] trading as Miltech Simulations [Postal address] [Country of establishment] E-mail for privacy requests: [contact@miltechsimulations.com] [If the controller is established outside the EU/EEA and offers this service to people in the EU, name an EU representative here (Article 27 GDPR).] We have not appointed a Data Protection Officer because the scale and nature of this processing do not require one. Privacy requests go to the e-mail address above. 2. WHAT THIS SERVICE IS ----------------------- U2 Datalink is a hobby flight-simulation companion site. Pilots who fly the Miltech U-2 add-on can choose to share telemetry from their simulator. The site shows that telemetry back to the pilot and, for some features, to everyone who visits the site. There are no user accounts, passwords, e-mail sign-ups or payments. 3. THE PERSONAL DATA WE PROCESS ------------------------------- Your gamertag is the only identifier we use. A gamertag is personal data because it can be linked to a real person through the Xbox / Microsoft account it belongs to. Everything below is stored together with the gamertag that sent it. 3.1 Data sent by the aircraft telemetry reporter (only when you enable it) - Flight samples about every 15 seconds: latitude, longitude, altitude (MSL and AGL), ground speed, heading, vertical speed, on-ground state, the aircraft title and ATC identifier set in the simulator, simulator date and time, and simulator weather readings (wind, temperature, pressure, precipitation, visibility, cloud and related environment values). - A live radar flag stating whether you opted into public radar. - IMINT capture records when you press the capture binding: position, altitude, camera zoom, lighting and colour settings and simulator time. The image itself is never uploaded; it is rebuilt from this metadata when viewed. - A random session identifier and a random record identifier per record. 3.2 Data you create on the site - Annotations you draw on IMINT captures (shapes, labels, colours). - miltagram posts: the capture you chose and the caption you wrote. - Likes on miltagram posts (which post, which gamertag). - The gamertag you type into the login popup, kept in your own browser's local storage so you do not have to type it again, together with unsaved annotation drafts and interface preferences. This never leaves your browser unless you save or post. 3.3 Technical data processed by our hosting providers When your browser or the reporter connects, the hosting providers (section 6) process your IP address, browser type and request logs for security and to deliver the service. We do not store IP addresses or browser details in our own database and we do not use analytics, advertising or tracking cookies. 3.4 What we do not collect Real names, e-mail addresses, Xbox account details, passwords, payment data, precise real-world location (positions are simulator positions) or the pictures from your screen. 4. WHY WE PROCESS IT AND ON WHAT LEGAL BASIS -------------------------------------------- Purpose Legal basis (GDPR Article 6(1)) ----------------------------------------- --------------------------------- Storing and showing your own flight, Consent (a): you turn telemetry on weather and capture history in the aircraft's EFB. Public live radar (miltechRadar24) Consent (a): separate opt-in that makes your gamertag and live position public. miltagram posts and likes Consent (a) / performance of the service you request (b). All Users Statistics and gamertag lookup Legitimate interest (f): providing a community leaderboard and history, limited to data you chose to share. Abuse prevention, rate limits, security Legitimate interest (f). Hosting logs Legitimate interest (f) of the providers and us in running a secure service. You can withdraw consent at any time (section 8). Withdrawal does not affect processing that happened before it. 5. WHO CAN SEE YOUR DATA (PUBLIC NATURE OF THE SERVICE) ------------------------------------------------------- Please read this section carefully. - Anyone who types your gamertag into the site can view the flight history, weather data, captures and statistics you shared. The gamertag is a label, not a login, so we cannot prevent other people from looking up a gamertag they know. - If you enable public radar, your gamertag and live position are shown to every visitor for up to 90 seconds after each report. - miltagram posts, captions and like counts are visible to every visitor. - All Users Statistics shows aggregate figures for every gamertag that shared data. - Because gamertags are not verified, someone else could upload data under your gamertag. If you see data that is not yours, contact us and we will remove it. We never sell personal data and we do not share it with advertisers. 6. RECIPIENTS AND PROCESSORS ---------------------------- We use the following service providers, who process data on our behalf under their data-processing agreements: - Supabase Inc. - database and API hosting. Our database is located in the AWS ca-central-1 region (Montreal, Canada). - Vercel Inc. - hosting of the website (USA / global edge network). The site also loads content directly from third parties. When your browser requests these resources, those providers receive your IP address and standard request headers: - OpenStreetMap Foundation - map tiles for the maps in Flight History, Weather Survey, Land Survey, FIX/Waypoints and miltechRadar24. - Google LLC - satellite imagery tiles used to rebuild IMINT captures. - Google LLC (Google Fonts) - the wordmark font in miltagram. - unpkg (Cloudflare) - the Leaflet map library. The embedded INS Planner, Documentation and Bug Tracker apps load insplanner.miltechsimulations.com, docs.miltechsimulations.com and bugs.miltechsimulations.com in frames; each has its own privacy terms. 7. INTERNATIONAL TRANSFERS -------------------------- Data is stored in Canada, which the European Commission recognises as providing adequate protection. Vercel and Google may process request data in the United States; these transfers rely on the EU-U.S. Data Privacy Framework where the provider is certified and otherwise on the European Commission's Standard Contractual Clauses. 8. HOW LONG WE KEEP DATA ------------------------ - Live radar positions: shown for 90 seconds after the last report and then no longer displayed. - Flight samples (position, flight data, weather and sensor readings, sent every 15 seconds): retained for 90 days after receipt and then deleted automatically by a nightly job. - Capture records (IMINT camera metadata): until you ask us to delete them. - Annotations, miltagram posts and likes: until you delete them or ask us to. - Local browser storage: until you clear it or sign out of the gamertag. - Hosting logs: as set by the providers, typically no more than 30 days. 9. YOUR RIGHTS -------------- Under the GDPR you have the right to: - access the data we hold about your gamertag and receive a copy (Article 15); - have inaccurate data corrected (Article 16); - have your data erased (Article 17); - restrict processing while a request is handled (Article 18); - receive your data in a machine-readable format (Article 20) - the CSV export in Flight History and the JSON records behind IMINT already provide this; - object to processing based on legitimate interest (Article 21); - withdraw consent at any time (Article 7(3)); - lodge a complaint with a supervisory authority, in particular in the EU member state where you live or work. A list is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en. How to exercise them: - Stop sharing: turn off "Telemetry + miltechRadar24" in the aircraft EFB. No further data is sent and your radar position disappears within 90 seconds. - Delete posts: use the delete control on your own miltagram posts. - Everything else: e-mail [contact@miltechsimulations.com] with your gamertag. Because gamertags are not authenticated, we will ask you to prove control of the Xbox account (for example by sending the request from the Microsoft account e-mail or by a short verification exchange). We answer within one month. 10. CHILDREN ------------ This service is not directed at children under 16. Do not share telemetry if you are under 16 (or under the age of digital consent in your country) unless a parent or guardian agrees. If we learn that data from a child was shared without such agreement we will delete it. 11. SECURITY ------------ All connections use HTTPS. The database denies direct table access and accepts data only through validated server functions with size, rate and content limits. Only a public API key is embedded in the site. No secret keys or credentials are published. Because the service is public by design (section 5), do not share anything through it that you would not want others to see. 12. AUTOMATED DECISIONS ----------------------- We do not use automated decision-making or profiling that produces legal or similarly significant effects. 13. CHANGES TO THIS POLICY -------------------------- We will post any changes on this page with a new version number and date. Material changes will be announced in the U2 Datalink Welcome window. 14. CONTACT ----------- [LEGAL ENTITY NAME] / Miltech Simulations [Postal address] [contact@miltechsimulations.com]