1. Who is responsible for your data
AeroCBT is operated by AeroETR, Polimska 10, Podgorica, Montenegro. For any question about this policy or about your data, write to ivan@aeroetr.com.
AeroCBT is used by approved training organisations to deliver and record aviation training. Your training organisation decides who gets an account, which courses you are assigned and how long records are kept. If you are a learner, that organisation is your first point of contact.
2. What the app does
The AeroCBT app gives learners access to their assigned courses, their progress and their certificates. Courses can be downloaded to the device and completed without an internet connection; results are sent to the server once the device is back online. There is no public sign-up — accounts are created by your training organisation.
3. What data we process
Account data
- Your name.
- Your email address, which is also your sign-in name.
- An internal account identifier.
- Your employee number and training group, where your organisation records them.
- Your role in the platform and whether the account is active.
Your password is never stored in readable form. Authentication is handled by Supabase Auth, which stores only a cryptographic hash of it.
Training data
- Courses assigned to you, their due dates and their status.
- Your progress: pages read, reading time, video position and which parts of a course you have acknowledged.
- Assessment attempts, answers and scores.
- Completion records and the certificates issued to you.
Because AeroCBT keeps regulatory training records, actions that change a record — issuing a certificate, approving a course version, changing an assignment — are written to an internal audit log together with who performed them and when.
What we do not collect
- No advertising identifiers and no advertising of any kind.
- No analytics or tracking software. The app contains no analytics SDK, no tag manager and no third-party tracking script.
- No tracking of you across other companies’ apps or websites. For this reason the app never shows the iOS “Allow tracking” prompt.
- No location data, no contacts, no camera or microphone access, no health data.
- No IP addresses or device fingerprints in our application logs.
4. Why we process it, and on what basis
All of the above is processed for one purpose: to deliver training and to keep a correct training record. Aviation training records exist because your organisation is required to keep them, so processing rests on your organisation’s legal obligations and on its legitimate interest in running the training it is responsible for. We do not use your data for any other purpose, and we do not sell it.
5. Where your data is stored
Account data, training records and course files are stored with Supabase (database, authentication and file storage), in the region eu-west-1 (Ireland). The application itself is hosted on Vercel. Both act as processors on our behalf and hold the data under contract; neither uses it for its own purposes.
Connections between the app and the server always use HTTPS. Access to records is enforced on the server: you can only reach data belonging to your own account and your own organisation, and every result is validated again on the server before it becomes an official training record.
6. Email
AeroCBT sends email through Resend, which receives your email address and the content of the message so it can deliver it. Email is sent only for:
- welcoming a new account and setting the first password;
- resetting a password;
- telling you a course has been assigned to you;
- confirming a course was completed, with the certificate attached;
- reminding you that training is due.
We never send marketing email.
7. Data stored on your device
When you download a course for offline use, the course files and your offline progress are stored inside the app on your device so they work without a connection. This data:
- stays on the device and is sent to our server only to record your progress;
- belongs to the signed-in learner, and is cleared when a different account signs in on the same device or when you sign out completely;
- can be removed at any time by deleting the downloaded course in the app, or by deleting the app.
If you turn on the optional six-digit offline PIN, only a cryptographic hash of the PIN is stored on the device. The PIN itself is never stored and never sent to the server.
The app also keeps a small technical log on the device to help diagnose problems. It stays on the device and is not transmitted anywhere.
8. Cookies
AeroCBT uses only strictly necessary cookies: one to keep you signed in, and one to record that you are using the mobile app rather than a browser, so the app shows the learner interface. There are no advertising or analytics cookies, so there is no cookie consent banner to accept or reject.
9. How long data is kept
Training records, completion records and certificates are retained for as long as your training organisation is required to keep them, and are not deleted or overwritten in the meantime — that is what makes them usable as evidence of training. Your training organisation sets the retention period; contact it, or write to ivan@aeroetr.com, to find out what applies to you.
10. Your rights, and deleting your account
You can ask for access to your data, for a correction, for a copy, or for deletion, and you can object to processing or ask for it to be restricted.
Accounts cannot be created or deleted from inside the app.They are managed by your training organisation’s administrator, because training records have to stay under the organisation’s control. To have your account removed, contact your training administrator, or write to ivan@aeroetr.com and we will pass the request to the administrator responsible for your organisation. Note that completed training records may have to be kept even after an account is closed, where aviation regulations require it.
You also have the right to complain to your national data protection authority.
11. Children
AeroCBT is a workplace training tool. It is not directed at children and accounts are issued only to staff of the training organisations that use it.
12. Changes to this policy
If this policy changes, the new version is published on this page with a new effective date. Where a change materially affects how your data is used, your training organisation will be informed.
13. Contact
AeroETR
Polimska 10, Podgorica, Montenegro
ivan@aeroetr.com