This policy explains what the Cumulus mobile application
(iOS and Android, package aero.cumulus.app) does with personal
data. It covers the mobile application specifically; the web application at
app.cumulus.aero is governed by the same practices.
1. Who is responsible for your data
Cumulus is supplied to your flight school, aero club or maintenance organisation. Under the GDPR that organisation is the data controller: it decides what is recorded about you, who inside the organisation may see it, and how long it is kept. Cumulus.aero acts as a data processor, handling the data on the organisation's documented instructions under a data processing agreement.
In practice this means: questions about your own records — and requests to access, correct or delete them — go to your organisation first. Cumulus assists the organisation in answering them, but cannot act on your records without its instruction.
Publisher
Service: Cumulus.aero
Operated by: STRATUS 4T SL
Company registration (CIF): B88767926
Registered address: Calle Sierra de Yeguas, 4 — 29016 Málaga, Spain
Contact: contact@cumulus.aero
2. There is no account creation in the app
You cannot sign up for Cumulus yourself. Accounts are created by your organisation's administrator, who enters your identity details and assigns your roles. The app only signs you in to an account that already exists. If you want your account closed, ask your organisation's administrator; the data attached to it is subject to the aviation retention rules described in section 7.
3. What the app collects, and why
| Category | What it is | Why |
|---|---|---|
| Identity & account | Name, alias, email address, professional roles, the organisation you belong to, language and display preferences. Where electronic signature by certificate is used, your national identity number, so that the certificate presented can be matched to you. | Signing you in, showing you the records you are entitled to see, and attributing the records you sign. |
| Operational and training records | Flights, logbook entries, pre-flight and post-flight data, training debriefings and grades, licences and validity expiry dates, safety and occurrence reports, maintenance work, technical log entries and certificates of release to service. | This is the purpose of the product: keeping the operational and training records your organisation is required to keep. |
| Working time (staff only) | Clock-in and clock-out times, and — see section 4 — the location of the device at the moment of each clock-in or clock-out. | Working-time records required by employment law in the countries Cumulus supports. |
| Messages and files | Announcements, channel posts, direct messages and the documents you open, upload or attach. | Internal communication and document sharing inside your organisation. |
| Photographs | Photographs you take or select — see section 4. | Evidence attached to a maintenance work card or a safety report. |
| Electronic signature | The fact that you signed, when, what exact content you signed (a cryptographic fingerprint of it), and — for certificate signatures — the signing certificate's data and its validity check. | Proving the authenticity and integrity of a regulatory record, as aviation and electronic-signature rules require. |
| Technical and security data | IP address, date and time, and the action performed, recorded in server and audit logs. Device platform and application version, sent when the app checks for an update. | Security, traceability of changes to regulated records, and delivering the right software update. |
4. Device permissions — what is actually accessed
Location
Location is used in two narrowly limited situations, both only while the app is open and in the foreground:
- When you clock in or out. A single position is read at that moment and stored with the time entry as proof of on-site presence. The app also checks whether the operating system reports a simulated position and refuses the punch if it does.
- While an aeronautical map or chart is displayed, to centre the map on where you are. This position is not recorded.
The app never tracks you in the background and never records your movements between those moments. It requests only foreground location permission; if you refuse it, everything works except clocking in and out from the phone.
Camera and photo library
Accessed only at the moment you choose to attach a photo to a maintenance work card, a technical log entry or a safety report. The app takes still photographs only; it does not record video and does not request microphone access. It never reads your photo library on its own.
Face ID, Touch ID and fingerprint
Used to unlock the app and to re-confirm your identity before you sign a regulatory record. Biometric verification is performed entirely by your device's operating system: your biometric data never leaves your device and is never transmitted to or stored by Cumulus. The app receives only "verified" or "not verified".
Files
Accessed only when you pick a document to upload or save one to your device.
5. What the app does not do
- No advertising, and no advertising identifier is read or transmitted.
- No analytics, attribution, crash-reporting or "user behaviour" SDK. The application contains no third-party tracking library of any kind.
- No personal data is sold, rented or shared for anyone else's marketing.
- No tracking across other companies' apps or websites.
- No automated decision producing legal effects about you. Operational indicators (for example flight-readiness status) are decision aids shown to qualified humans, who decide.
6. Who the data is shared with
Inside your organisation, according to the permissions your administrator assigns. Instructors see their students' training records; maintenance staff see aircraft records; salary, bank and social-security data are restricted to the human-resources and management roles and are encrypted.
Outside your organisation, only to the technical providers needed to run the service:
| Provider | Role | Location |
|---|---|---|
| Scaleway | Hosting of the application, the database and the outgoing service email | France (European Union) |
| Expo (EAS) | Building the application and delivering software updates to it. Receives the platform and application version at update check, not your records. | United States |
| Apple, Google | Distribution of the application through the App Store and Google Play, under their own privacy policies | Worldwide |
Where the Spanish electronic-signature scheme is used, the signing operation is performed by the AutoFirma application published by the Spanish public administration, using a certificate installed on your own device. Cumulus receives the resulting signature; it never receives your private key.
Your organisation may additionally be required to disclose records to a civil aviation authority, a court or another public body where the law obliges it.
7. Where the data is held, and for how long
Application data is hosted in the European Union (France).
Retention is set by your organisation and by the regulations that apply to it. Aviation records are deliberately long-lived: flight and training records, maintenance records and the signatures attached to them must be kept for the periods imposed by European aviation regulation and by national employment and accounting law. A signed regulatory record cannot be deleted or silently altered — corrections are made as a new, traceable version, and every modification is written to an audit log with its justification. That is a legal requirement, not a product choice.
Data held for the running of your account is kept while your account exists and for the period your organisation has defined afterwards.
8. Security
- All traffic between the app and the servers is encrypted with TLS.
- Your session credentials are stored in the secure storage provided by the operating system (iOS Keychain, Android Keystore), not in ordinary application files.
- Particularly sensitive fields — salary, bank account number, social-security number — are encrypted in the database in addition to the above.
- Access is controlled by role, and administrator accounts require two-factor authentication.
- Sensitive read operations and every change to a regulated record are logged and attributable.
9. Your rights
Under the GDPR you have the right of access to your personal data, and the rights to rectification, erasure, restriction of processing, portability, and objection, as well as the right to lodge a complaint with a supervisory authority (in France, the CNIL; in Spain, the AEPD).
Because your organisation is the controller, address these requests to it — its administrator can produce a full export of your file directly from Cumulus. If you cannot reach your organisation, write to contact@cumulus.aero and we will forward your request to the controller and assist in answering it.
Note that the right to erasure does not extend to records that aviation, employment or accounting law requires to be kept for a fixed period.
10. Children
Cumulus is a professional tool and is not directed at children. It is not intended for anyone under 16. Where a student pilot under 18 is enrolled, their account is created by the training organisation, which is responsible for obtaining the consent required by the applicable national law.
11. Changes to this policy
If this policy changes materially, the new version is published at this address with a new version number and date, and organisations using Cumulus are informed.
12. Contact
For any question about this policy, or about the personal data Cumulus holds: contact@cumulus.aero