Service Providers & Subprocessors

Hosting — Websupport

Purpose: application hosting, database, storage, backups and server infrastructure. Data: account, flight and application data stored on the XCInsight infrastructure as necessary for operation.

Payments — Stripe

Purpose: Checkout, recurring billing, Customer Portal, fraud prevention and payment events. Data can include name, e-mail, billing details, payment-method information handled by Stripe, customer/subscription identifiers and transaction metadata.

AI — OpenAI

Purpose: generation of requested flight debriefs, translations and weather narratives. Only context needed for the requested generation should be sent; passwords and full card data are excluded.

Maps — Google Maps Platform

Purpose: interactive mapping, terrain and 3D visualisation. Browser requests can disclose network/device data and map locations necessary to render the requested view.

Weather and geographic data providers

Open-Meteo, OpenStreetMap/Overpass, launch-site databases and similar providers may receive coordinates, dates or technical request data needed to return weather, terrain or site information. Some requests are made server-side.

E-mail infrastructure

Purpose: transactional messages such as email verification, legal confirmations and support. The exact transport provider can vary with the operator's configured mail service.

Changes to providers

Providers can change as infrastructure evolves. We update this page when a provider change materially affects personal-data processing.

Backups and terrain services

Amazon Web Services (Amazon S3): encrypted backup archives used for disaster recovery can include database, account, flight and stored-file data. The configured lifecycle currently expires weekly backups after 84 days and pre-deployment backups after 30 days.

Mapy.com: terrain elevation and optional map tiles used by LIVE can receive coordinates and technical request data needed to return the requested map or elevation information. Google Maps Platform continues to provide interactive mapping and 3D visualisation where used.

Integrations that are implemented but disabled in production do not receive production requests merely because their code exists. For example, the OpenAIP LIVE data integration remains disabled until the operator enables it after the required commercial and licensing review.

Authentication — Google

Purpose: optional Google OAuth/OpenID Connect sign-in. Data can include Google account identifier, verified e-mail address, display name, profile image, OAuth state and technical request data needed to authenticate the user. XCInsight does not request access to Gmail, Google Drive, contacts or the user's Google password.

The mobile app uses the same browser-based Google authentication flow as the web service. After successful authentication XCInsight issues a short-lived one-time exchange code and then its own mobile session token; a Google refresh token is not stored in the XCInsight mobile app.