Privacy policy · 737 Knowledge

This policy explains how 737 Knowledge (737knowledge.com) handles your personal data. 737 Knowledge and A320 Knowledge are run by the same company and share one account system: if you have an account on either site, the same email and password (or Google) sign you in on both, and your plan on each site is separate. You can reach us about anything in it at hello@737knowledge.com.

What we collect

Your account. Your name and email address, and your password, which we store only as a one-way hash we can't read. If you sign in with Google, we receive your name, email address and Google account identifier, and nothing else from your Google account.
Your profile, if you add it. Your role (for example cadet, first officer or captain), your airline and your type rating course date. All optional.
Your training progress. Your answers, scores, flags and notes in the training tools. Without an account these stay in your browser only. With an account we keep a copy so your progress follows you between devices.
Payments. Payments are taken by Stripe. We never see or store your card details. Stripe tells us your name, email address, billing country and what you bought, so we can give you access and keep the records the law requires.
Emails. Your email address and your email choices: news, if you've asked for it. We also keep a note of which account emails we've sent you, such as a receipt or a reminder, so none is sent twice.
Emails you send us. When you email hello@737knowledge.com we keep your message so we can answer it, and delete it when it is no longer needed.
Technical data. Our hosting keeps short-lived logs of requests (such as the time, the page and your IP address) to keep the site secure and working. We don't use any other analytics, advertising or tracking cookies, and we don't sell your data.
Our own records. When we change an account by hand (for example to give access or to delete it), we keep a note of what we did and the account's email address, so we can account for it later.

Why we use it, and our legal basis

To provide your account, the training tools and the plan you've chosen, and the emails your account needs (confirming your email, receipts, reminders and security notices): performing our contract with you.
To take payments, keep accounts and meet tax law: our legal obligations.
To keep the site secure, prevent abuse and fix problems: our legitimate interests.
To send news you've asked for: your consent, which you can withdraw at any time.

You can stop news emails at any time in your account settings.

Cookies and storage on your device

We set two cookies, each only for something you've asked the site to do:

Signing in keeps you signed in, for up to 30 days.
Google sign-in lasts the ten minutes it takes to sign in with Google.

Your browser's own storage holds your settings and your progress. None of this is used for analytics or advertising, so we don't ask for consent: the site can't do these things without them.

Our pages load their typefaces from Google Fonts, so your browser connects to Google, which sees your IP address.

Who processes your data for us

We use a small number of trusted services, each only for its part:

Cloudflare: hosting the site, storing your account and keeping the request logs.
Stripe: payments, tax and invoices.
Resend: sending our emails.
Google: signing you in, if you choose Google, and the site's typefaces.

Some of these services process data outside the UK, including in the United States. Where they do, the transfer is protected by the UK's approved safeguards, such as the International Data Transfer Addendum or the UK-US data bridge.

How long we keep it

Your account and progress: while your account is open. Delete your account and we delete them straight away; copies in our host's backups are gone within 30 days.
Our own weekly backup of the accounts (so they can be restored if something goes wrong): kept privately by us, and each copy deleted within 90 days. It never holds passwords.
After you delete your account we still keep: payment and tax records (with Stripe and in our accounts) for six years, as UK law requires; the note of which account emails we sent, under a random number with no name or email address; and our own record of changes we made to your account by hand, with its email address.
Being signed in: up to 30 days at a time. Links in our emails stop working after one hour to 14 days, depending on the link.
Server logs: up to 7 days.

Your rights

Under UK data protection law you can ask for a copy of your data, ask us to correct or delete it, object to or limit how we use it, and take it elsewhere. You can delete your account yourself on Your account (it is the one account for both sites, so it goes from both), or email us for a copy of your data or any of these. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk, though we'd like the chance to put it right first.

Children

737 Knowledge is for pilots and people training to be pilots. It isn't meant for children under 16, and we don't knowingly collect their data.

Changes

If we change this policy in a way that matters, we'll update the date at the top and tell account holders by email.

Who we are

737 Knowledge is a trading name of Nebula Ventures Ltd, a private limited company registered in England and Wales, company number 16509781. Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. Nebula Ventures Ltd is the controller of the personal data described in this policy.