Privacy policy

1. Data controller

Waypoint360 is published by Meridian Synergy SAS, data controller under the GDPR (EU 2016/679).

• Controller : Meridian Synergy SAS - 2 rue des Cages, 58200 Saint-Père
• Contact : legal@waypoint360.eu

2. Data we collect

We only collect what the platform needs to work:

• Account: first and last name, email address, and for professionals the operator details required by regulatory documents.
• Flights: the flight logs you import, with their metadata (duration, distance, take-off position, aircraft).
• Media: the derivatives you publish (thumbnails and web-sized versions). Your originals are never sent to us.
• Usage: a sign-in log, for account security.

This data is hosted in the European Union (Supabase, AWS eu-west-3, Paris) and is never sold nor passed to third parties for commercial purposes.

3. Google data

If you connect your Google Drive to deposit your documents there, the access requested is strictly limited:

• Scope requested: `drive.file` only. It grants access solely to files the application created itself, plus those you explicitly pick.
• We do not read, index or list the rest of your Drive: that scope technically does not allow it.
• We write there only the documents you publish from Waypoint360 (operations manual, SORA file, flight reports) and, if you ask for it, your media originals.
• Access tokens are encrypted (AES-256-GCM) and stored server-side; they are never exposed to your browser.
• No data coming from Google is passed to a third party, used for advertising, or used to train an artificial-intelligence model.

You can revoke this access at any time from your Waypoint360 settings, or from your Google account. Revoking deletes our tokens; files already deposited stay with you.

4. Processors

We rely on providers strictly necessary to the service: Supabase (database and authentication, EU), Hostinger (website hosting), Mailjet (transactional email), Stripe (payments). Each one only accesses the data its function requires.

5. Retention

Your data is kept for as long as your account exists. On deletion it is erased within 30 days, except for what the law requires us to keep (invoicing, accounting obligations).

6. Your rights

You have the right to access, rectify, erase, restrict, object to and port your data. You may also lodge a complaint with your data protection authority.

To exercise these rights, write to us at: legal@waypoint360.eu.

7. Cookies and legal information

Waypoint360 only uses technical cookies necessary for the platform to work (authentication, session). No advertising or third-party tracking cookie is set.

Legal notice