Privacy Policy

Last updated: 6 September 2026

1. Who We Are

ATC Trainer is operated by Wempe Works, registered address Kagerdreef 110, 2172 HM Sassenheim, the Netherlands (KVK: 42139457, VAT: NL004453574B53). This policy explains what personal data we process when you use the Service, and why.

2. What We Collect

• Account data: display name, email address, and password (stored as a salted hash via ASP.NET Core Identity, never in plain text). Optionally, a phone number if you provide one. If you sign in with Google or Microsoft instead of a password, your name and email come from that provider rather than a form you fill in yourself.
• Payment data: if you subscribe to a paid tier, our payment processor (Stripe, see below) collects your payment method and billing details directly — we never see or store your full card number ourselves. We keep a record of your subscription status and billing history.
• Voice recordings: audio you record to issue simulated ATC commands. Transcription (speech-to-text) and readback synthesis (text-to-speech) run locally on our own server — recordings are not sent to any third-party speech API.
• Simulation data: the areas, airports, routes, and scenarios you build, and the multiplayer sessions, replays, and scores they produce.
• Organization data: if you belong to an organization, the assignments given to you and your resulting scores/session history are visible to that organization's administrators.
• Usage data: basic activity timestamps used for account and organization administration.

3. Third-Party Processing

A small number of features involve external services:

• Stripe — payment processing, subscription billing, and invoicing for paid tiers. See Stripe's Privacy Policy.
• Google / Microsoft — if you choose to sign in with a Google or Microsoft account instead of a password, that provider authenticates you and shares your basic profile (name, email) with us.
• Cloudflare Turnstile — bot-protection check during signup.
• SMTP email delivery — for account-related emails (e.g. welcome messages).

We do not sell your personal data, and we do not share it with third parties for advertising.

4. Why We Process This Data

• To provide and operate the Service (account access, running simulations, generating readbacks).
• To enforce tier limits and manage subscriptions.
• To let organization administrators assign and evaluate training for their own members.
• To maintain the security of the Service (e.g. bot protection).

5. Data Retention

Account and simulation data is retained for as long as your account is active. You can download or permanently delete your account and associated data at any time via My Account → Personal Data.

6. Your Rights

If you are located in the EU/EEA, you have rights under the GDPR, including the right to access, correct, or delete your personal data, and to object to or restrict certain processing. You can exercise the right to access and to erasure directly from My Account → Personal Data; for anything else, contact us directly.

7. Cookies

The Service uses only strictly necessary cookies: one to keep you signed in, and a couple of short-lived technical ones (e.g. CSRF protection, carrying a one-time status message across a page redirect). We do not use tracking or advertising cookies, and none of these require consent under applicable law since they're necessary to provide the Service you've asked for.

8. Data Security

Passwords are hashed, not stored in plain text. Database credentials and other secrets are managed via Docker secrets rather than embedded in the application, and traffic to the Service is encrypted in transit (HTTPS). No method of transmission or storage is 100% secure, but we take reasonable technical measures to protect your data.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

10. Contact

Questions about this Privacy Policy can be sent to info@atc-trainer.com.