Privacy Policy for beyondXC.cloud

Protecting personal data is important to beyondXC.cloud. This Privacy Policy describes the data processed in operating the open beta and community platform, how we use it, the legal bases on which we rely and your rights. The legal framework includes, in particular, the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and section 165 Austrian Telecommunications Act 2021 (TKG 2021).

1. Controller and contact

Markus Schüssler
Sonnleitenweg 18
8062 Kumberg
Austria
Email: m.schuessler@airspace.at
Phone: +43 699 17998641

No data protection officer is currently appointed.

2. Purposes and legal bases

  • Providing the website, registration, login, user accounts, sessions, access protection, roles and security functions (Article 6(1)(b) and (f) GDPR).
  • Operating flight logbooks, profiles, community functions, statistics, the level system, rankings, competitions, club functions, applications and administration tools (Article 6(1)(b) GDPR).
  • Processing and analysing IGC files, including GPS/barometric data, flight paths, timestamps, take-off/landing locations, device information, weather references, airspace checks and map displays (Article 6(1)(b) GDPR).
  • Publicly displaying profiles, flights, stories, photos, comments, likes, follows, rankings or club affiliations, where you use these functions or share content (Article 6(1)(a), (b) and (f) GDPR).
  • Optional linking to XContest, automatic import of the last 24 hours, and manual batch imports from IGC ZIP archives and CSV/JSON files (Article 6(1)(b) GDPR).
  • Communication, support, bug reports, email notifications, the preference centre, moderation reports, abuse prevention, error analysis, technical logs, backups and operational security (Article 6(1)(b) and (f) GDPR).
  • Data-minimising audience measurement using Matomo without tracking cookies (Article 6(1)(f) GDPR).
  • Meeting statutory retention, documentation and legal defence obligations (Article 6(1)(c) and (f) GDPR).

Our legitimate interests include, in particular, secure operation, abuse prevention, error analysis, protection against manipulation, audience and usage statistics, moderation, and enforcement of rules and legal claims.

3. Categories of personal data

  • Basic and account data: username, display name, name, email address, password hash, activation status, language, roles, permissions and voluntary profile information.
  • Contact and organisation data: phone number, club or flight school affiliations, applications, admin roles, club administration data and competition assignments, where you use these functions.
  • Login and security data: session ID, remember-me token, login times, IP address, browser and device information, CSRF and security tokens, and technical error and access logs.
  • Flight, analysis and community content: IGC files, track points, altitude values, timestamps, take-off and landing sites, aircraft, flight logbook texts, stories, photos, comments, likes, follows, reports, moderation reports, notification rules, rule matches, hashed retrieval/view events, map filters, airspace and obstacle layers, and analysis results.
  • Integration data: XContest UUID, imported XContest flight information, import files, connection status, weather and mapping references, and metadata from external data sources.
  • Communication data: support enquiries, emails, feedback, bug reports, communication preferences, delivery logs, unsubscribe/preference tokens and other correspondence.
  • Donation-related data: transaction metadata, where you voluntarily use PayPal or comparable payment methods.

4. Data sources

Data generally comes from you, your use of the platform, community contributions, or integrations and uploads initiated by you. Data may also come from authorised club or flight school administrators, XContest, weather and mapping services, public aeronautical and obstacle data sources, and technical server and security logs.

5. Recipients and processors

  • Hosting and infrastructure providers for server operation, databases, backups, monitoring, email delivery and serving the platform.
  • A self-hosted Matomo instance at am-vs2.airspace.at for audience measurement without tracking cookies.
  • Meteostat via RapidAPI and MET Norway, where weather or pressure data is needed for IGC evaluations.
  • XContest and other services you actively connect, where you establish a connection or import data.
  • Map, tile, CDN and frontend library providers such as basemap.at, OpenStreetMap, Esri, Thunderforest, Google, jsDelivr, Cesium or OpenLayers when you open the corresponding views.
  • PayPal or other payment providers if you voluntarily use the donation function.
  • Clubs, flight schools, competition organisers, community areas or other users only to the extent that you share content or the respective function requires it.

Any further disclosure takes place only where legally required, for enforcement of legal rights or at your separate request.

6. Transfers to third countries

Where external providers outside the EU/EEA are used, transfers to third countries cannot be ruled out. This particularly concerns voluntarily used mapping, weather, payment, CDN or integration functions. Transfers take place only where necessary for the function you request, where an adequacy decision exists or where appropriate data protection safeguards are provided.

7. Cookies and local storage technologies

beyondXC.cloud uses technically necessary cookies and local storage where required to provide the functions you expressly request (section 165(3) TKG 2021). These include, in particular, session cookies, login status, optional persistent login, CSRF protection, language choice, dark mode, map and display settings, and storing the fact that a notice banner has been dismissed.

No tracking cookies are set for Matomo. The Matomo integration removes URL parameters and fragments, respects the browser’s “Do Not Track” setting and serves technical audience measurement and error analysis.

8. Retention periods

  • We generally retain accounts and basic data until the account is deleted or the purpose of use no longer applies.
  • We retain IGC files and flight logbook, statistics, competition, club and community data while the respective function is used, the content is intended to remain visible publicly, in community areas or within a club, or legitimate documentation purposes exist.
  • Import files and technical analysis artefacts are retained only as long as needed for importing, error analysis, traceability or recovery.
  • Server, login and security logs are retained only as long as necessary for operational security, abuse prevention and documentation purposes.
  • Notification rules, rule matches, moderation reports, delivery logs and hashed retrieval/view events are retained only as long as needed for the respective function, traceability, abuse prevention or documentation purposes.
  • Remember-me tokens are retained no longer than the respective persistent-login period; session cookies generally expire at the end of the session.
  • Documents relevant under commercial and tax law are retained within statutory retention periods.
  • Backups are overwritten on a rolling basis once they are no longer needed for recovery or security purposes.

Backups and technical safeguards serve exclusively to maintain the operational security of beyondXC.cloud and do not replace personal backups. Pilots are responsible for permanently backing up original IGC files, flight records, GPX files, photos, comments and other uploaded or imported content outside the platform. beyondXC.cloud is not an archiving or backup service and, to the extent permitted by law, accepts no responsibility for data loss, corrupted files, incomplete imports or accidental deletion of flights and IGC files.

9. Obligation to provide data

Data required for registration, login, security, roles, club affiliations or the requested processing of flights and content is necessary for contractual or functional reasons. Without this data, we cannot provide the respective account or requested function. Voluntary information, public sharing and optional integrations are identified as such.

10. Data security

We implement appropriate technical and organisational measures, including TLS/HTTPS, password hashing, role-based access rights, logging, update and backup processes, and separate development, integration and production environments. Nevertheless, completely flawless security of electronic communication cannot be guaranteed.

11. Your rights

Subject to the applicable statutory conditions, you have rights of access, rectification, erasure, restriction of processing and data portability, and the right to object to processing based on legitimate interests. You may withdraw consent at any time with effect for the future. Please contact m.schuessler@airspace.at.

12. No automated decisions

Statistics, rankings, levels and analysis notices are calculated technically but have no legal effect. No solely automated decision-making, including profiling within the meaning of Article 22 GDPR, takes place on beyondXC.cloud.

13. Right to lodge a complaint

If you believe that the processing of your data infringes data protection law, you may lodge a complaint with the Austrian Data Protection Authority: Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, www.dsb.gv.at.

14. Changes to this policy

This Privacy Policy is updated when functions, data flows, recipients or legal bases change materially. The version published on this page at the relevant time applies.

Last updated: 20 May 2026