Privacy Policy

This is a courtesy translation. The legally binding version is the German Datenschutzerklärung.

1. Controller

The controller for data processing on this website within the meaning of the GDPR is:

2. Overview

This website is essentially informational. We do not set cookies and do not use analytics or tracking services. We embed third-party content in one place only: a YouTube video on the vRAAS² page, which is loaded only after you click it (see section 5). All fonts and images are served from our own hosting. The only feature with a login is the optional linking of Discord roles (see section 7). Personal data is only processed to the extent described below.

3. Hosting and server log files

This website is hosted on Firebase Hosting, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). When you visit the website, Google processes technically necessary data that your browser sends automatically:

• IP address
• date and time of access
• requested page or file and amount of data transferred
• HTTP status code
• referrer URL (previously visited page)
• browser type and version, operating system (user agent)

This processing serves to deliver the website and to keep it stable and secure (for example to fend off attacks). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and reliable operation of the website. We do not analyse this data for any other purpose and do not combine it with other data sources.

We have a data processing agreement with Google under Art. 28 GDPR. Processing by Google LLC in the USA cannot be ruled out. Google LLC is certified under the EU-US Data Privacy Framework; transfers are based on the European Commission's adequacy decision (Art. 45 GDPR). More information: firebase.google.com/support/privacy.

4. Contacting us

If you contact us by email, we process your email address and the content of your message in order to answer your request. The legal basis is Art. 6(1)(b) GDPR where your request relates to a contract or pre-contractual steps, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). We delete the data once it is no longer needed to handle your request and no statutory retention obligations apply.

5. YouTube videos

The vRAAS² page embeds a video from YouTube, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). We use YouTube's privacy-enhanced mode (youtube-nocookie.com) and a two-click solution: opening the page does not connect to YouTube. Only a preview image is shown, served from our own hosting.

Only when you click the preview image does your browser load the YouTube player from Google's servers. This transfers in particular your IP address, the page you are on and technical information about your browser to Google. YouTube may also store or read cookies or similar technologies on your device. If you are signed in to a Google account, Google may associate the request with your account.

The legal basis is your consent, given by clicking the preview image (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). The consent applies to that page view only; after reloading the page, the video again loads only after a click. You can withdraw your consent at any time with effect for the future by not starting the video again or by leaving the page. Processing by Google LLC in the USA cannot be ruled out; Google LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). More information: policies.google.com/privacy.

6. Customer reviews

The vRAAS² and Cockpit2Ground pages quote a selection of customer reviews published on the Contrail Shop (contrail.shop), with the Contrail Shop's permission. For each review we show the display name the reviewer chose there, the star rating, the date, the reviewed product version and the review text. We do not show profile pictures and do not receive any other data about the reviewers. The reviews are part of our page itself; no data is loaded from Contrail when you view them.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in presenting genuine customer feedback on our products). If you wrote one of these reviews and want it removed from our website, email us and we will remove it.

7. Linking Discord roles (Linked Roles)

On /discord/link you can optionally link your Discord account to your vRAAS licence and/or your SimAtlas account. Our Discord server "LAND3 Simulations" then offers you matching roles (for example "vRAAS", "SimAtlas+" or "SimAtlas"), which you claim in Discord via the "Linked Roles" menu. If you do not use this feature, none of the following data is processed.

Data processed:

• Discord login: after clicking "Connect Discord" you are redirected to Discord. Once you agree, we receive your Discord user ID and access tokens for the permissions "identify" and "role_connections.write". We store only the user ID and the tokens (encrypted), no username, no profile picture and no email address.
• vRAAS: we check the activation key you enter against our licence system. We store only the key's internal number, not the key itself. The licence system logs each check with a cryptographic hash of the key. We check once a day whether the key is still valid. So that a key cannot move freely between accounts, we also store which Discord user ID last linked it and when, even after you unlink it.
• SimAtlas: you confirm the link on simatlas.net using your existing login there ("Connect with SimAtlas"), or log in here with your email address and password. Credentials go directly to SimAtlas's login service; we store neither the email address nor the password. For the confirmation, simatlas.net shows your Discord display name; it is only carried briefly (at most 30 minutes) in a signed session value and not stored. We store the association between your SimAtlas account and your Discord user ID. Whether you have an active subscription or complimentary access is determined from the subscription data held by SimAtlas.
• Abuse protection: to limit attempts, we store for each attempt the Discord user ID, a non-reversible hash of your IP address, the time and the result.
• In your browser: for the duration of the session, the page stores a session key (valid for 30 minutes) and a security value for the Discord login in your browser's sessionStorage. Both are deleted when you close the tab. No cookies are set.

Data sent to Discord: we send Discord only the label "LAND3" and three yes/no values (vRAAS licence, SimAtlas+ subscription, SimAtlas account). Discord uses these values to assign the roles; the link may be visible on your Discord profile. For users in the EEA, Discord Netherlands BV is the controller for Discord's processing, and Discord's privacy policy applies (discord.com/privacy). Discord processes data in the USA and bases transfers on Standard Contractual Clauses and the EU-US Data Privacy Framework.

Processors: the links are processed in the database of our SimAtlas service, the licence check in the database of our licence system. Both run on Supabase (Supabase Pte. Ltd., 65 Chulia Street, Singapore). We have a data processing agreement with Supabase under Art. 28 GDPR; transfers to third countries are safeguarded by Standard Contractual Clauses (Art. 46(2)(c) GDPR).

Purpose and legal basis: we process the data to provide the role assignment you request and keep it up to date (for example removing a role when a subscription ends or a licence is deactivated). The legal basis is Art. 6(1)(b) GDPR. Abuse protection is based on Art. 6(1)(f) GDPR; our legitimate interest is preventing activation keys from being guessed. Storing data in sessionStorage is strictly necessary for the feature you request (Section 25(2) no. 2 TDDDG).

Retention: the link is kept until you remove it on /discord/link or revoke the "LAND3" app's access in Discord (User Settings, Authorized Apps). We detect a revocation during one of the next daily checks and then delete the link. If you disconnect everything, we delete the data immediately; if Discord is unreachable at that moment, the daily check completes it, at the latest after 7 days. If your SimAtlas account is deleted or scheduled for deletion, the SimAtlas association is dropped immediately. We delete the record of which account last linked a vRAAS key, and the logs of attempts, after 30 days, and logs of licence checks after 90 days.

Using this feature is optional. Without this data we cannot assign the roles; it has no effect on buying or using our products.

8. Links to external websites

This website links to external services such as SimAtlas, Contrail Shop, AviationLads and Discord. These are plain links: no data is sent to the respective provider until you click a link and visit their website. From then on, that provider's privacy policy applies. Purchases of our products are handled exclusively by the respective shops.

9. Your rights

You have the following rights regarding your personal data:

• access (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)
• withdrawal of consent with effect for the future (Art. 7(3) GDPR)

To exercise your rights, simply send an email to contact@land3simulations.com.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany, www.baden-wuerttemberg.datenschutz.de.

10. No automated decision-making

No automated decision-making, including profiling (Art. 22 GDPR), takes place.

11. Changes

We update this privacy policy when the website or the legal requirements change. The version published here applies.