Syndik8 Privacy Policy

Version: 20 October 2026

This notice explains how personal information is handled when you use Syndik8 (syndik8.app), or when a syndicate records information about you.

1. Who is responsible

Deltatek Software Limited, registered in England and Wales (Company No. 02975256), provides Syndik8. Our registered address is 122 Great Berry Lane, Basildon, Essex, SS16 6BY. Contact [email protected] about privacy, rights requests or complaints.

We are the controller for account administration, authentication, support, security, fault diagnostics, our subscription and fee records, and the optional personal pilot-document feature. This means we decide why and how information is used for those purposes.

For shared membership administration, bookings, usage logs, defects, votes, expenses, member accounts and syndicate or asset documents, we normally process information on the customer's instructions. The customer is the company or the person or persons responsible for the group's records, acting through authorised administrators; an app role alone does not decide legal responsibility. Our customer data processing terms cover this processing. The customer determines its purposes, lawful basis and notices where data protection law applies. A genuinely personal or household activity can be exempt for an individual, but that does not exempt our service.

Payment-account setup also involves the syndicate and the payment provider. We act on the syndicate's instructions for its setup information; where we use information for our own onboarding, security or administration of the provider connection, we are controller. Recipients, including syndicates and payment providers, have their own responsibilities for their uses of information.

2. Information handled by the service

Most information comes from you or your syndicate. It includes:

If requested, Flightradar24 aircraft-movement data can pre-fill a flight log. Companies House supplies public-register information; invitations and information about guests, inspectors or people named in documents come from the syndicate or the person entering the record. See section 7 for these services.

We need your name and email to create an account. Payment setup needs the relevant verification details, and other features need the information they record. These are service requirements, not a legal obligation on you to use Syndik8. Personal pilot documents and a profile photo are optional.

Location and biometric checks take place on your device. With your permission, location suggests nearby airfields from an on-device list; we store the airfield you select, not your position or biometric data. Camera, photo-library and other device permissions can be changed in your device settings.

3. Purposes and lawful bases

For processing where we are controller, our UK GDPR bases are:

For records processed on a customer's instructions, the customer selects the applicable lawful basis. Your acceptance of our Terms does not provide a contract basis for someone else's information. Customers must enter only relevant information and provide appropriate privacy information to people whose data they record. Our guest privacy guidance provides information they can share. Where we have our own notice duties, we remain responsible for meeting them, including through an appropriate invitation or syndicate delivery arrangement.

We do not profile people or make solely automated decisions with legal or similarly significant effects. The service applies operational rules, including billing calculations, discrepancy flags and inactivity deadlines; members and administrators can review the relevant records and contact support about problems.

4. Notifications

Most activity notifications can be configured in the app, including email digests. Essential messages about payments, disputes, deadlines, billing discrepancies, account or syndicate closure, subscription arrangements and Terms changes may be sent regardless of those choices. Our payment provider sends the Direct Debit advance-notice email; our accompanying notice is in-app and push, rather than a duplicate email.

If an administrator tries an action beyond a free-plan limit, we may email that administrator a factual notice of the refused action and a link to subscription settings, no more than once per syndicate in 24 hours. This is an account-administration message, not a promotional mailing. Existing preferences govern only the notification types they actually cover. We do not send advertising emails.

Most syndicate activity notifications stop when you leave. Messages about your own account, subscription responsibility, cancellation or unresolved payments can still be necessary after departure or account deletion.

5. Storage and retention

Supabase holds our primary database, authentication and files in Ireland. PowerSync's configured sync storage is in the EU. Other processing, support access and providers can be outside the UK and EEA; section 8 explains transfers. We use access controls, private file storage, short-lived authorised download links and encryption in transit and at rest. Device copies and exports have their own security limits.

Retention periods

Account deletion and syndicate closure

Profile → Delete account starts the ordinary deletion process. Outstanding balances, payments, unfinished bookings or being the only administrator can require resolution first; the app explains the applicable blockers. Contact [email protected] if you cannot resolve one, or to request erasure of particular information. A blocker does not automatically justify keeping unrelated optional data. We consider what can be removed and explain necessary retention. Account deletion and cancellation of a syndicate subscription are separate actions.

When a syndicate closes, ordinary member access ends after 30 days. Its initial retention period is normally 30 days, extended where recent payment activity or a live Direct Debit mandate requires a dispute/refund period: about 18 months from the relevant payment activity or closure. Administrators can normally reverse closure before that period ends. At its end, operational records are deleted. Where there were financial records, the current closure process retains the ledger and syndicate documents for up to seven years from closure; these can include personal information, identifiers and descriptions. Otherwise all records, including documents, are deleted. An over-limit syndicate whose paid subscription ends follows the same retention process if it does not resubscribe or reduce to the free-plan limits.

Retention of identifiable records requires a necessary purpose, appropriate access and an applicable period; it is not permission to retain irrelevant information indefinitely. Customer-controlled records are also subject to lawful return/deletion instructions under the customer processing terms. Contact us about information no longer needed. A known claim, accident or investigation can require relevant records to be preserved securely rather than deleted on the ordinary schedule.

Separately from deletion that you request, we remove unused free syndicates after around six months without a booking, flight, expense, maintenance entry or defect report. Signing in, reading, votes, documents and payments do not reset that period. We email members warnings ahead of removal; recording one of the qualifying activities before the date stops it. The syndicate and its records, including its ledger, are deleted; paid syndicates are exempt while the subscription is active. If you leave your last syndicate and do not join or create another, we do not delete your account. Around six months later, and once a year after that, we email you to say what we still hold and to remind you that you can delete your account at any time. These periods are operational settings that we may adjust.

Deleted live data can remain in restricted backups until the provider's backup cycle removes it. Backups are used for recovery; restored data remains subject to applicable deletion and access restrictions. Contact us for the applicable backup period.

6. Information on your device

The app stores authentication information, settings and the syndicate records you can access so it works offline. It can cache eligible shared documents and your own pilot documents in private device storage. Other members do not receive your personal pilot files; administrators can receive the limited document summary described below. Removing data from the server reaches an offline device on its next sync. Copies someone has independently downloaded or exported are under that person's or organisation's control.

Home-screen widgets and Apple Watch keep a small snapshot of bookings, balances, payments, availability and the flight being logged in shared app storage. Signing out clears the snapshot. Local account data is cleared when another person signs in or you choose "Clear data & sign out"; uninstalling removes the app's local data.

Browser and mobile storage support authentication, offline operation, requested preferences and necessary fault detection. Firebase Crashlytics automatically stores and sends crash, error and app-session diagnostics, including sessions without a crash, to detect, investigate and prevent faults. Reports can include device/app details, installation and session identifiers, technical error context and your account identifier to connect a fault with the affected account. We do not use advertising trackers or behavioural analytics. There is no web Crashlytics or web push reporting.

7. Who can receive information

Your syndicate: members see shared records according to their roles and the group's privacy settings. Administrators see email addresses, financial records, expenses, mandate status and the limited pilot-document summary. For licences this is whether one is recorded and its upload date; for medicals it includes the recorded expiry while consent is current. The files themselves are owner-only. Payment-account verification details are visible to administrators and the other directors/owners named on that account. Each recipient is responsible for its own lawful use and exports.

Service providers: Supabase stores and authenticates the service data; PowerSync receives authorised records and streams them to devices; Resend receives recipient details and email content; Cloudflare serves the websites and web app and receives IP addresses, browser information and requested URLs. Google Firebase and the device's push service, including Apple APNs on iOS, receive notification tokens, installation identifiers and notification content. Firebase Crashlytics receives the diagnostics described in section 6. Provider roles and contractual arrangements depend on the particular service and purpose; they are not all controllers or all processors for every activity. The customer processing terms list providers used for instructed customer records.

Meter photo reading: if you photograph a meter while logging a flight, we may send the photo to third-party AI services to suggest the reading. Only the photo and the expected reading are sent, not your name or contact details. The suggested figure is filled in for you to check, and the figure you log is the one that counts.

Stripe: receives payment and verification information for subscriptions and connected syndicate accounts. It has its own controller purposes, including payment security and verification, and can also process information on instructions. Its privacy information explains these uses. Syndicate administrators may see connected-account payment and verification information in Stripe's dashboard.

Reference services: Companies House receives a company-number lookup from our server. Flightradar24 receives an aircraft registration and time window from our server, rather than your account or IP address. Frankfurter receives the currency pair and date for a receipt exchange-rate lookup, together with your device's IP address; it receives no account data and states that it keeps no request/IP logs.

Your calendar provider: if you subscribe to the personal feed, it fetches bookings and events using a private tokenised address. Anyone with that address can read the feed. You can replace the address from Subscribe to calendar on the Bookings tab, or contact support to stop the feed.

We may disclose relevant information to authorities, advisers or others where necessary to meet legal duties, handle a claim or protect rights and safety, with an appropriate lawful basis and safeguards.

8. International transfers

EU storage does not mean all processing takes place in the UK or EU. Provider support, email, payments, web delivery, meter photo reading, push notifications and diagnostics can involve other countries, including the US. For transfers subject to UK GDPR we use the applicable UK adequacy regulations, the UK-US Data Bridge where the recipient's certification covers the transfer, or appropriate contractual safeguards such as the ICO's International Data Transfer Agreement or the UK Addendum to EU standard contractual clauses, with any required assessment and supplementary measures. Ask [email protected] which safeguard applies to a recipient and for a copy of the relevant terms.

9. Your rights and complaints

Depending on the processing and applicable conditions, you can request access, correction, erasure, restriction and a portable copy of your data, and object to processing based on legitimate interests. We consider an objection and stop that processing unless we can demonstrate overriding compelling grounds or need it for legal claims. Withdrawing consent does not affect earlier lawful processing. Delete your medical in Profile → My documents to withdraw that consent; administrators' offline summaries update on their next sync.

Profile → Download my data provides a personal export, including your own documents. It may not include every customer-controlled record, withheld closed-syndicate information or independently retained provider record. Contact [email protected] for other rights requests, missing information or help identifying the relevant customer controller; we handle our own responsibilities and assist with customer-controlled records.

We respond without undue delay and normally within one month. Where the law permits identity verification, clarification, or a complexity/multiple-request extension, we explain what is needed or the extension and its reason within the applicable period. We explain any lawful limits or necessary retention rather than treating ordinary account-deletion blockers as a blanket refusal of your rights.

You have the right to complain to us about our handling of personal information at [email protected]. We acknowledge privacy complaints within 30 days, investigate, provide appropriate updates and communicate the outcome without undue delay. You can also complain to the Information Commissioner's Office, or your applicable data protection authority.

10. Other information

Account holders must be at least 18. Shared records can contain information about guests who have no account, including children; customers must consider their privacy and enter only necessary information. Contact us if a child has created an account or inappropriate information has been entered.

For breaches affecting information for which we are controller, we notify the ICO without undue delay and, where feasible, within 72 hours where the breach is likely to risk people's rights; high-risk breaches are also notified to affected people without undue delay. For customer-controlled data, we notify and assist the customer under the processing terms.

The current notice is available at https://syndik8.app/privacy.html. We notify you of significant changes by email or an appropriate in-app notice. This notice explains processing; it does not itself request consent or alter the Terms of Service.