Privacy Policy
Last updated: 27 April 2026
1. Data Controller
AviaCoach (the "Platform") acts as the data controller. For users located in the European Union, the General Data Protection Regulation (GDPR) applies; for users in Türkiye, Law No. 6698 on the Protection of Personal Data ("KVKK") applies.
2. Data We Collect
- Identity data: first name, last name, email address, phone (optional).
- Account data: password (hashed), session tokens, registration date.
- Usage data: questions answered, lesson progress, simulator hours, forum activity.
- Payment data: plan, amount, transaction ID. Card details are never stored on our Platform; they are processed by iyzico (for payments from Türkiye) and Paddle (for international payments) — both PCI-DSS compliant.
- Technical data: IP address, browser type, device information, cookies.
3. Purposes & Legal Bases of Processing
- Membership and subscription management (performance of a contract)
- Provision of training services and progress tracking (performance of a contract)
- Processing of payments (performance of a contract; legal obligation)
- Compliance with legal obligations (invoicing, tax) (legal obligation)
- Improving service quality and detecting errors (legitimate interest)
- Marketing communication where consent is given (consent)
4. Sharing with Third Parties
Your data is shared with the following service providers only to the extent necessary:
- iyzico (iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş., Türkiye) (payment infrastructure for Türkiye)
- Paddle.com Market Limited (international payment — Merchant of Record) — United Kingdom
- Cloud hosting provider — server infrastructure
- Email delivery service — notification and verification emails
Your data is never sold to third parties for advertising or marketing purposes. Where data is transferred outside your jurisdiction, appropriate safeguards (e.g. standard contractual clauses) are applied.
5. Cookies
The Platform uses cookies for session management, preference storage and statistics. You can reject cookies in your browser settings; in that case some features may not work properly.
6. Data Retention
Your data is retained while your account is active. After account closure, financial records are kept for the statutory retention period (10 years under the Turkish Tax Procedure Law); other data is anonymised or deleted within 30 days.
7. Your Rights (GDPR Art. 15-22 / KVKK Art. 11)
- To learn whether your personal data is being processed
- To access, rectify or erase your data
- To object to processing
- To request data portability (GDPR)
- To lodge a complaint with the relevant authority (your EU data protection authority / the Turkish DPA)
For requests: kvkk@aviacoach.com
8. Security Measures
Data is transmitted over an encrypted channel (HTTPS/TLS). Passwords are hashed with bcrypt. Access to servers is restricted by multi-factor authentication. Periodic backups are performed.
9. Children's Privacy
The Platform does not serve users under the age of 18 and does not knowingly collect data from users under 18. Parents who become aware of unauthorised registration by their child should contact us.
10. Changes to This Policy
When this Policy is updated, the date is revised; users are notified of material changes.
11. Contact
General: destek@aviacoach.com
GDPR/KVKK requests: kvkk@aviacoach.com