Privacy Statement

This Privacy Statement explains how personal information is handled in Altivy Learning, Altivy's training platform for aviation-training organisations ("organisations"). It applies to every Altivy application that links to it. It is written to comply with the New Zealand Privacy Act 2020, and the GDPR section below applies to people in the EU or UK.

Who is responsible

Altivy (www.altivy.com, Auckland, New Zealand) is responsible for the personal information in Altivy Learning: the agency under the Privacy Act and the controller under the GDPR. Unicloud Limited (www.unicloud.co.nz) develops and operates the platform for Altivy and acts as its service provider (processor). An organisation that uses Altivy Learning manages its own members, their access and the training records it enters.

Information we collect

• Account details: name, username, email, and authentication credentials (passwords are stored only as argon2id hashes; passkeys store public keys only).
• Training information your organisation records: lessons and assessments, flight time and previous hours, licences, ratings and validity dates, and documents uploaded to your record.
• Technical data needed to operate and secure the service: sign-in attempts (timestamp, IP address, user agent, outcome), including rejected attempts.
• Usage data for signed-in users: the in-app pages you visit (path, timestamp, time on page), so your organisation's administrators can understand how the system is used. This is not collected for signed-out visitors.
• Email records: the emails the system sends on your organisation's behalf, such as lesson reports, are logged with the recipient, subject, message content and delivery outcome.
• Feedback you submit through the app: your name and email, the report text and any screenshots, so we can reply.
• Retention: the sign-in, usage and email records above are kept for a period set by an administrator (by default 365 days) and then deleted automatically. Training records may be kept for as long as your organisation needs them, subject to the record-keeping minimums of the Civil Aviation Rules.

How we use it

To deliver and record training, provide and secure the service, authenticate users, enforce access controls, send the notifications your organisation asks for, and meet legal obligations. We do not sell personal information and send no marketing. AI features (optional) process only the material needed to produce the requested output and are unavailable unless enabled by the platform operator.

Information Privacy Principles (Privacy Act 2020)

We handle personal information consistently with the 13 Information Privacy Principles, including lawful and limited collection (IPP 1–4), secure storage (IPP 5), access and correction (IPP 6–7), retention limits (IPP 9), use and disclosure limitation (IPP 10–11), and controls on cross-border disclosure (IPP 12).

Storage & security

Data is hosted on PostgreSQL and S3-compatible object storage on Railway in Singapore; encryption in transit (TLS) and at rest is provided by that platform. Access is controlled by organisation membership and role. See the Security & Compliance documentation for detail.

Your rights

You may request access to, or correction of, your personal information. Contact admin@unicloud.co.nz or www.altivy.com/contact; Unicloud Limited answers privacy requests for Altivy, and your organisation's administrator can also correct your training records. We respond within 20 working days. If you are not satisfied, you may contact the Office of the Privacy Commissioner (www.privacy.org.nz).

AI features & automated processing

Optional AI features are powered by the Google Gemini API, an external processor. Nothing is sent to it unless the platform operator configures an API key; without one, every AI feature is unavailable and the rest of the system is unaffected.

The AI features read material, not people: a document you upload and ask about, an hours summary you paste or a logbook you upload, a lesson's text for quiz drafting, a support ticket for a summary. Fields that exist only to identify a person are left out of a request, and typed or pasted text has email addresses, phone numbers and long identifying numbers removed before it is sent. A file you upload is sent as it is, so a name inside a scanned logbook or a PDF would be included; no automated process can reliably detect names in prose or images.

Training records, results and reports are unaffected: they are calculated on our servers from your own data and never involve a third party. Each AI request sends only the minimum needed, is protected by centrally-enforced instructions that prohibit the model from fabricating information or sharing data outside the response, and under the paid Gemini API terms prompts and outputs are not used to train Google's models. AI never makes automated decisions about individuals; parsed hours, drafted questions and summaries are reviewed by a person before they are used.

Your rights under the GDPR (EU/UK)

If you are in the EU or UK, in addition to the rights above you have the rights of access, rectification, erasure ("right to be forgotten"), restriction of processing, objection, and data portability, and the right not to be subject to solely-automated decisions with legal or similarly significant effects. Contact admin@unicloud.co.nz; Unicloud Limited answers privacy requests for Altivy. Your organisation's administrator can also help with your training records. We respond without undue delay and within one month. You may also lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner's Office, ico.org.uk).

Who processes your information

Cross-border disclosure

Your information is held outside New Zealand: the platform is hosted in Singapore, AI requests (when an AI feature is used) go to Google in the United States, and email passes through Cloudflare's global network. Where personal information is disclosed overseas we take reasonable steps consistent with IPP 12; the safeguard for each provider is recorded in the Security & Compliance documentation.

Retention schedule (IPP 9)