Privacy Policy

Last updated: August 2026. This policy covers the website roger.aero and the training platform app.roger.aero (the "app"). This is a translation for convenience; in case of doubt, the German version applies.

1. Privacy at a Glance

General Information

The following information provides a simple overview of what happens to your personal data when you visit this website or use the app. Personal data is any data that can be used to personally identify you. For detailed information on the subject of data protection, please refer to our privacy policy listed below.

The app in short: when you practise, you speak radio calls into your device. Your voice recording is transmitted to specialised service providers, converted into text there, and then assessed by AI systems so that you receive feedback. Some of these providers are located in the United States. We do not create voiceprints and do not perform speaker recognition. Section 8 lists every service involved.

Data Collection on This Website

Who is responsible for data collection on this website?
Data processing on this website is carried out by the website operator. You can find the operator's contact details in the "Controller" section of this privacy policy.

How do we collect your data?
Your data is collected in part when you provide it to us, for example, by entering information into a contact form. Other data is collected automatically or with your consent when you visit the website by our IT systems. This is primarily technical data (e.g., internet browser, operating system, or time of page access). This data is collected automatically as soon as you enter this website.

What do we use your data for?
Some of the data is collected to ensure the proper functioning of the website. Other data may be used to analyze your user behavior: we exclusively use privacy-friendly, cookie-free analytics tools for this purpose.

What rights do you have regarding your data?
You have the right at any time to receive information free of charge about the origin, recipient, and purpose of your stored personal data. You also have the right to request the correction or deletion of this data. If you have given consent to data processing, you can revoke this consent at any time for the future. You also have the right, under certain circumstances, to request the restriction of the processing of your personal data. Furthermore, you have the right to lodge a complaint with the competent supervisory authority.

2. Controller

The controller within the meaning of the GDPR is:

Anton Heuchert & Niklas Röthlingshöfer (GbR)
Regensburgerstraße 21a
85055 Ingolstadt
Germany

Email: crew@roger.aero

3. Data Collection on This Website

Server Log Files

The hosting provider automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:

• Browser type and browser version
• Operating system used
• Referrer URL
• Hostname of the accessing computer
• Time of the server request
• IP address

This data is not merged with other data sources. The collection of this data is based on Art. 6(1)(f) GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimization of their website: server log files must be collected for this purpose.

Contact Form

If you send us inquiries via the contact form, your details from the inquiry form including the contact data you provide there (name, email address, organization, message) will be stored by us for the purpose of processing the inquiry and in case of follow-up questions.

The processing of this data is based on Art. 6(1)(b) GDPR, if your request is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective processing of inquiries addressed to us (Art. 6(1)(f) GDPR).

The data you enter in the contact form will remain with us until you request deletion, revoke your consent to storage, or the purpose for data storage ceases to apply. Mandatory statutory provisions, in particular retention periods, remain unaffected.

Cookies and Local Storage

This website does not use cookies. The app only writes technically necessary entries to your browser's local storage in order to keep you signed in for the duration of a session and to remember your language and display settings. These entries are required to operate the signed-in area (Section 25 (2) no. 2 TDDDG) and do not require consent. No cross-site tracking takes place.

Fonts

This website and the app load all fonts locally from our own servers. When you visit, no connection is made to Google Fonts or any other external web font provider. Your IP address is therefore not transmitted to any such provider.

4. User Account and Sign-In

Using the app requires a user account. When you register we process your email address, a password of your choosing (stored only as a cryptographic hash, never in plain text), and the timestamps of registration and sign-ins.

User management runs on an open-source application that we host ourselves on our own servers in Germany. Your credentials are not transferred to third parties.

The legal basis is Art. 6 (1) (b) GDPR (performance of the user agreement). Optional details about your learning goal (such as the certificate you are working towards, the learning language, or the expiry date of a language endorsement) are processed on the same basis in order to personalise your practice plan.

5. Using the Training Platform

So that the app can track your progress and select suitable exercises, we process the data created while you practise:

• your answers to exercises, whether typed as text or transcribed from speech
• the corresponding assessment results, including the mandatory elements recognised and missing, and the feedback text
• time spent, timestamp, input mode (text or voice) and the exercise the answer belongs to
• derived learning-state data (repetition intervals, weakness profiles, progress figures)
• for LPT speaking sessions, the conversation transcript and the assessment on the ICAO scale

The legal basis is Art. 6 (1) (b) GDPR: without this data the contractually owed service, namely adaptive training with progress tracking, cannot be provided.

6. Voice Recordings and Speech Processing

In speaking exercises, your browser records your answer after you have started the recording yourself. The recording is transmitted to our server and from there to speech recognition providers, which turn it into text. For pronunciation assessment in LPT mode, the recording is additionally sent to a pronunciation analysis service that returns phoneme and fluency scores.

What we store permanently is the transcript and the assessment result, not the audio. We only store the recording itself in two cases:

• Scenario exercises: recordings from a session are kept for up to 48 hours for the debrief and deleted automatically afterwards. If you report a recording as incorrectly assessed, storage is extended to a maximum of 90 days so that we can review the case.
• Speech recognition quality assurance: to analyse recognition errors we store voice recordings together with the resulting transcript for a maximum of 90 days on our own servers in Germany and delete them automatically afterwards. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in troubleshooting and improving recognition quality). You may object to this processing at any time under Art. 21 GDPR, informally.

No biometric identification: speech processing serves only to convert speech into text and to assess pronunciation. We do not create voiceprints, do not perform voice matching, and do not use recordings to identify individuals. Processing of biometric data for the purpose of uniquely identifying a person within the meaning of Art. 9 (1) GDPR therefore does not take place.

7. AI-Assisted Assessment of Your Answers

Feedback on your answers is produced in several stages. First, a rule-based comparison checks whether the prescribed elements of a radio call are present. In addition, we transmit your answer together with the task and the model answer to AI language models operated by external providers, which produce a proposed assessment and an explanatory text. For speaking exercises, the pronunciation analysis is also taken into account.

On the logic involved (Art. 13 (2) (f) GDPR): the models do not answer freely. They receive a fixed task with predefined assessment criteria and compare your input against stored model answers and mandatory elements. The result is a score per criterion together with a justification. No data about you beyond the exercise at hand and your current learning state is fed into this process.

No automated decision with legal effect: the assessments are practice feedback. They produce no legal effect and do not similarly significantly affect you: no certificate, licence, examination decision or report to third parties follows from them. In our assessment, an automated individual decision within the meaning of Art. 22 (1) GDPR therefore does not occur. Independently of this, you can challenge any assessment: use the "report an error" function in the app or write to crew@roger.aero, and a person will review the case and correct it if the assessment was wrong.

No training on your data: the AI providers we use may only process the content transmitted to them in order to produce the respective assessment. Your input is not used to train models via the interfaces we use. Providers do, however, retain transmitted content to a limited extent for abuse monitoring, in some cases up to 30 days by default.

8. Categories of Recipients

The following categories of service providers process personal data on our behalf or receive data from us (Art. 13 (1) (e) GDPR). On request we will name the specific providers behind each row, as we will in response to an access request under Art. 15 GDPR. Enquiries to crew@roger.aero.

We do not pass your data on beyond these categories. In particular, there is no sale of data, no disclosure for advertising purposes and no transfer to public authorities unless we are legally obliged to do so.

Further functions run on open-source software on our own servers in Germany, with no data flowing to third parties: user management, error diagnostics, audience measurement and learning content management. No personal user data is stored in the content management system.

Data processing agreements under Art. 28 GDPR are in place with the processors in the categories above, or the providers' data processing terms are incorporated into the respective service agreements. The payment service provider additionally processes payment data as a controller in its own right; its own privacy policy, shown to you during checkout, applies in that respect.

9. Transfers to Third Countries

Some of the providers named in Section 8 process data in the United States. Personal data is therefore transferred to a country outside the EU for which a level of protection equivalent to the GDPR cannot be guaranteed; in particular, access by US authorities cannot be ruled out in every case, and legal remedies against such access are limited.

For each recipient, we base the transfer either on that recipient's certification under the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) or, where no such certification exists, on the European Commission's Standard Contractual Clauses pursuant to Art. 46 (2) (c) GDPR together with supplementary safeguards. On request we will tell you which basis applies to a particular recipient.

We limit transfers to what the respective assessment requires. Your name and email address are not transmitted to the AI services; they receive your answer or recording and the task description, but no contact details.

10. Purchasing Credit and Payment Processing

When you buy conversation minutes or exercise units, we process your order data, the time of purchase, the amount paid, your current credit balance, and your declaration regarding immediate commencement of the service under Section 356 (4) German Civil Code, including the time and version of that declaration. The legal basis is Art. 6 (1) (b) GDPR and, for tax and commercial retention obligations, Art. 6 (1) (c) GDPR.

Payments are handled by a specialised payment service provider whose name and privacy policy are shown to you during checkout. You enter your payment details (such as a card number) directly with that provider; we do not receive them, only the confirmation of payment and the details needed for invoicing. If you redeem a licence code, we additionally store the code, the time of redemption and its assignment to your account.

11. Error Diagnostics

Our web app uses open-source software for error diagnostics. When a technical error occurs in the app, information about that error is transmitted to and stored on our own server. This may include: browser type and version, operating system, IP address, time of the error, the affected page, and technical details about the error itself (such as the error message and program state). For signed-in users, the internal user identifier may also be recorded so that recurring errors can be attributed.

The software is self-hosted by us on our own servers in the EU; no data is transferred to third parties or third countries. The data is used exclusively to detect and fix technical errors and is not merged with other data sources. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in the technically error-free provision of our application). Error reports are deleted as soon as they are no longer required for troubleshooting.

12. Error Reports from the App

In the app you can report a faulty exercise or assessment via the "report an error" function. The form is provided by an external form provider based in the European Union and is loaded from that provider's servers when you open it. In doing so, your IP address and technical details about your browser are transmitted to that provider, along with whatever you enter into the form.

The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in correcting faulty learning content and assessments). The provider's servers are located in the European Union. Please do not enter anything into the form that you do not wish to share with us.

13. Analytics Tools

Cookie-Free Audience Measurement

This website uses privacy-friendly, open-source web analytics software. It is self-hosted by us on our own servers, and no personal data is collected or stored.

Specifically:

• No cookies are set.
• No IP addresses are stored.
• No personal data is collected.
• There is no cross-site tracking and no cross-device tracking.
• The collected data is aggregated and anonymous: individual visitors cannot be identified.

The analysis is performed without cookies and without storing personal data. Consent is therefore not required. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in analyzing website usage to optimize the service).

14. Hosting

The website, app, database and all self-hosted services run in the data centre of a German provider. We will disclose that provider's name and address on request.

This use is based on Art. 6(1)(f) GDPR. We have a legitimate interest in the most reliable presentation of our website possible. If consent has been requested, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR.

A data processing agreement (DPA) in accordance with Art. 28 GDPR is in place with the operator. This ensures that the personal data of our website visitors is only processed according to our instructions and in compliance with the GDPR.

All servers are located exclusively in Germany.

15. Retention Periods

We store personal data only for as long as the respective purpose requires or statutory retention periods demand:

• Account data, practice data, transcripts, assessments and learning state: until your account is deleted. Your progress is derived from the history of your answers, which is why we keep it for the duration of the user relationship.
• Audio recordings from scenario exercises: 48 hours, or a maximum of 90 days if you report an incorrect assessment.
• Audio recordings for speech recognition quality assurance: a maximum of 90 days.
• Error reports from error diagnostics: until the error is fixed, at most 90 days.
• Purchase, invoice and payment data: ten years after the end of the calendar year in which the contract was concluded (Section 147 German Fiscal Code, Section 257 German Commercial Code).
• Contact form enquiries: until the enquiry has been dealt with conclusively and no follow-up questions are to be expected.
• Server log files: for as long as required to ensure secure operation.

You can have your account deleted at any time by sending an informal message to crew@roger.aero. Deletion removes your account and practice data including transcripts, except for data subject to a statutory retention obligation, in particular invoice data. Unused credit expires when the account is deleted.

16. Your Rights

Within the framework of applicable legal provisions, you have the following rights at any time:

• Right of access (Art. 15 GDPR): You may request information about your personal data processed by us.
• Right to rectification (Art. 16 GDPR): You may request the correction of inaccurate or the completion of your data stored by us.
• Right to erasure (Art. 17 GDPR): You may request the deletion of your personal data stored by us, unless the processing is necessary for exercising the right of freedom of expression, for compliance with a legal obligation, or for reasons of public interest.
• Right to restriction of processing (Art. 18 GDPR): You may request the restriction of the processing of your personal data.
• Right to data portability (Art. 20 GDPR): You may request that we provide you with your data, which we process on the basis of your consent or in fulfilment of a contract, in a structured, commonly used, and machine-readable format, or that we transmit it to another controller.
• Right to object (Art. 21 GDPR): If your personal data is processed on the basis of legitimate interests pursuant to Art. 6(1)(f) GDPR, you have the right to object to the processing.

To exercise your rights, please contact: crew@roger.aero.

17. Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work, or the place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR.

A list of data protection officers and their contact details can be found at: https://www.bfdi.bund.de/DE/Service/Anschriften/Laender/Laender-node.html.