Privacy Policy

Last updated: 5 August 2026

This Privacy Policy explains how Nanotam (“Nanotam”, “we”, “us”, “our”) collects, uses, discloses, retains and otherwise processes personal data when you visit our websites, create an account, or use our applications and related services (collectively, the “Service”).

We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP), Regulation (EU) 2016/679 (GDPR) where it applies, and related EEA/UK privacy laws.

1. Data controller & contact

The data controller is:
RDI Cordier (Daniel Cordier)
St-Prex, Vaud, Switzerland

Privacy contact: privacy@nanotam.app
General contact: see our contact page and Legal Notice.

If a Data Protection Officer or an EU/UK representative is appointed, their details will be published on this page.

2. Scope

This Policy applies to:

• visitors to our websites and landing pages;
• users of Nanotam apps and accounts (pilots, operators and other authorised users);
• people who contact us, subscribe to updates, or interact with our commercial / partnership channels;
• individuals whose personal data may appear in content submitted to the Service (e.g. reports), to the extent we process that data.

It does not apply to third-party websites, EFBs, airline systems or services that we do not control.

3. Categories of personal data we process

Depending on how you use the Service, we may process the following categories:

3.1 Account & identity data

• name, display name, email address, password or authentication tokens;
• organisation / operator affiliation (if provided);
• licence or role information you choose to provide (e.g. pilot / ops / partner).

3.2 Aviation, flight & usage data

• imported or selected flight plans, departure / arrival / alternate airports and related preferences;
• in-app interactions, feature usage, alerts viewed, and settings;
• event reports you submit (e.g. ATC issues, birds, closures, emergencies) and related metadata;
• feedback, support messages and survey responses.

3.3 Location & device context

• precise or approximate location, where you enable location services, to show relevant airport / airside information;
• device type, OS, app version, language, time zone, IP address, diagnostics and crash logs.

3.4 Commercial & partnership data

• business contact details of airline, ops or technology partners;
• contract, billing and correspondence data related to enterprise or data partnerships.

3.5 Cookies & similar technologies

We use cookies and similar technologies as described in our Cookie Policy. Non-essential cookies are used on the basis of consent where required.

4. Sources of data

• You — when you register, import plans, submit reports, enable permissions or contact us;
• Your device / browser — technical and diagnostic data;
• Other users — collaborative reports and community contributions that may incidentally include information about third parties;
• Partners & providers — hosting, analytics, authentication, communications, payment or aviation-data providers, where applicable;
• Public / licensed sources — aeronautical, weather or traffic information used to operate the Service (which may be combined with personal data only as described in this Policy).

5. Purposes of processing

We process personal data for the following purposes:

• Service delivery — account management, authentication, flight-plan import, NOTAM interpretation, hazard visualisation, weather/wind layers, runway-in-use and event features;
• Safety & reliability of the Service — abuse prevention, integrity of reports, debugging, incident response;
• Product improvement & research — analytics, quality measurement, model/training and feature development using appropriate safeguards (including pseudonymisation where practicable);
• Communications — transactional messages (security, service changes) and, where permitted, product updates or marketing;
• Commercial operations — enterprise sales, partnerships, billing and customer success;
• Data products & insights — creating, licensing and commercially exploiting aggregated, anonymised and (where a lawful basis exists) other datasets and insights derived from Service usage and reports, including for airlines, operators and technology partners;
• Legal compliance — responding to lawful requests, enforcing terms, establishing or defending legal claims.

6. Legal bases (GDPR Art. 6)

We rely on one or more of the following legal bases:

• Contract (Art. 6(1)(b)) — to provide the Service you request and manage your account;
• Legitimate interests (Art. 6(1)(f)) — including securing and improving the Service, preventing fraud/abuse, understanding feature usage, B2B partnership development, and creating aggregated/anonymised insights, provided these interests are not overridden by your rights. You may object as described in Section 11;
• Consent (Art. 6(1)(a)) — for non-essential cookies, certain marketing communications, precise location (where required by device/OS rules), and any processing for which we specifically request consent (including, where used, disclosure of identifiable personal data to third parties for their own commercial purposes). You may withdraw consent at any time without affecting prior lawful processing;
• Legal obligation (Art. 6(1)(c)) — where we must retain or disclose data under applicable law.

Where we process special categories of data (generally not required for Nanotam), we will only do so with an applicable Art. 9 condition and additional notice.

7. Commercial use, sharing and “sale” of data

Nanotam’s business includes operating a collaborative aviation awareness platform and offering proprietary data products, event streams and insights to third parties (for example airlines, flight operations teams, and technology partners).

7.1 Aggregated and anonymised data

We may create, retain, use, license, publish and otherwise commercialise information that has been aggregated and/or anonymised so that it no longer identifies you (directly or indirectly) under applicable standards. Such data is outside the scope of the GDPR as personal data and may be used for analytics, research, product development and commercial licensing without restriction under this Policy, subject to our contracts and applicable law.

7.2 Sharing of personal data

We may share personal data with:

• Processors / service providers who host, analyse, communicate or support the Service under written agreements and our instructions;
• Business and technology partners, where needed to deliver joint features or enterprise deployments you participate in;
• Professional advisers (legal, accounting, insurance) under confidentiality;
• Authorities where required by law or necessary to protect rights, safety or security;
• Successors in connection with a merger, acquisition, financing or sale of assets, with appropriate safeguards and notice where required.

7.3 Commercial disclosure of identifiable personal data

We do not sell personal data in the informal sense of undisclosed trading of contact lists. However, where we disclose personal data to a third party for that party’s own purposes (including commercial purposes), we will do so only where:

• you have given consent for that disclosure; or
• another GDPR legal basis applies and we have provided the required transparency information; or
• the disclosure is required or permitted by law.

You can refuse or withdraw consent for such disclosures where consent is the basis, without losing access to core Service features that do not depend on that consent (unless the feature itself cannot operate without it).

7.4 Reports and community content

Content you submit (including collaborative event reports) may be visible to other users of the Service and used to operate, improve and commercialise Nanotam features and derived insights. Do not include unnecessary personal data about yourself or others in free-text fields.

8. International transfers

Your personal data may be processed in countries outside the EEA/UK. Where we transfer personal data internationally, we implement appropriate safeguards, such as:

• an adequacy decision by the European Commission / UK government; and/or
• Standard Contractual Clauses (SCCs) and, where needed, supplementary measures; and/or
• other transfer tools recognised under Chapter V GDPR.

Details of specific transfer mechanisms for key vendors are available on request at privacy@nanotam.app.

9. Retention

We retain personal data only for as long as needed for the purposes set out in this Policy, including:

• Account data — for the life of the account, then deleted or anonymised within a reasonable period after closure, unless longer retention is required;
• Operational / report / telemetry data — for as long as needed to operate, secure and improve the Service and derived products, then deleted or irreversibly anonymised;
• Support and legal records — as required by statutory limitation periods and compliance obligations;
• Marketing consents / suppression lists — as needed to honour your choices.

When personal data is anonymised for data products, the anonymised outputs may be retained indefinitely.

10. Security

We implement appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration or disclosure (including access controls, encryption in transit where appropriate, logging and vendor due diligence). No system is perfectly secure; please use a strong unique password and notify us of suspected incidents.

11. Your rights

Subject to conditions and exceptions under the GDPR, you may have the right to:

• access your personal data;
• rectify inaccurate data;
• erase data (“right to be forgotten”);
• restrict processing;
• data portability;
• object to processing based on legitimate interests (including profiling based on those interests);
• object to direct marketing at any time;
• withdraw consent at any time where processing is consent-based;
• lodge a complaint with a supervisory authority — in particular with the Swiss Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch), or with an EU/EEA supervisory authority in your country of residence or work (e.g. CNIL in France).

To exercise these rights, email privacy@nanotam.app. We may need to verify your identity before responding. We aim to respond within one month, extendable where permitted by law.

12. Automated decision-making

Nanotam uses automated systems (including AI) to interpret NOTAMs, rank relevance, detect events and surface alerts. These features support situational awareness and do not produce legal or similarly significant decisions about you solely by automated means within the meaning of Art. 22 GDPR. If that changes, we will update this Policy and provide any required notices or choices.

13. Children

The Service is intended for adults capable of entering into a contract and for professional / aviation use. We do not knowingly collect personal data from children under 16 (or the lower age permitted by local law between 13 and 16). If you believe we have collected such data, contact us and we will delete it.

14. Third-party links & integrations

The Service may link to or integrate with third-party tools (for example EFBs, authentication or analytics providers). Their processing is governed by their own policies. Review those policies before enabling integrations.

15. Changes to this Policy

We may update this Privacy Policy from time to time. The “Last updated” date will change accordingly. Material changes will be notified via the Service or by email where appropriate. Continued use after the effective date constitutes acknowledgment of the updated Policy, to the extent permitted by law. Where changes require fresh consent, we will request it.

16. Contact

Questions about this Policy or our data practices:
privacy@nanotam.app · Contact page · Legal Notice