Privacy Policy

Last updated: 8 July 2026

At NOTAMET we treat your personal data with the utmost care. This policy explains what data we collect, why, for how long, and what rights you have. We comply with the GDPR (EU 2016/679) and the Spanish Data Protection Act (LOPDGDD, LO 3/2018).

1. Data controller

  • Controller: José María Hontoria de la Esperanza
  • Tax ID (NIF): 48924606H
  • Address: Calle Doctor Antonio Cortés Lladó, 5, 41004 Seville, Spain
  • GDPR email: privacidad@notamet.com
  • General channel: hola@notamet.com

NOTAMET is a personal project of the controller acting as a self-employed individual (autónomo). There is no intermediary corporate entity. Processing is carried out under the figure of the individual controller.

2. Data we collect

Data you provide to us

  • First and last name
  • Email address
  • Operating zones: coordinates, radius and name of the configured zones
  • Payment data (processed by Stripe; we do not store it ourselves)

Data generated automatically

  • IP address, browser type and operating system
  • Pages visited, briefings generated, PDFs downloaded
  • Technical cookies (see the cookies section)

Data we do not collect

  • We do not collect data from persons under 16
  • We do not collect special categories of data (health, trade union membership, etc.)

Data re-used from public aeronautical sources

NOTAMET structures and re-uses public information from official aeronautical information sources (ENAIRE, DGAC Chile, Eurocontrol EAD, NOAA/NWS AWC) which may contain operational data (NOTAMs, weather). This processing relies on Art. 6.1(e)/(f) GDPR (public interest and legitimate interest in operational safety and transparency of aeronautical information) and on Spanish Law 37/2007 on the re-use of public sector information.

3. Purpose of processing

We use your data to:

  • Provide the pre-flight briefing service (NOTAMs, METAR, TAF, SIGMET)
  • Manage your account and authentication (Clerk)
  • Process payments and issue invoices (Stripe)
  • Send alerts about changes in weather conditions or NOTAMs within your zones
  • Generate and archive compliance PDFs with SHA-256 traceability
  • Send service communications (platform changes, maintenance)
  • Improve the platform on an aggregated and anonymous basis

We do not use your data or the results of your queries to train AI models.

4. Legal basis

  • Performance of a contract: Providing the contracted service (Art. 6.1(b) GDPR)
  • Consent: Alert communications (Art. 6.1(a))
  • Legitimate interest: Security, fraud prevention, service improvement (Art. 6.1(f))
  • Public interest / public-interest mission: Re-use of public aeronautical information for operational safety (Art. 6.1(e) GDPR + Law 37/2007)
  • Legal obligation: Regulatory compliance (invoicing, tax retention) (Art. 6.1(c))

5. Recipients and transfers

We share data only with the providers necessary for the service:

  • Clerk (USA — SCCs): Authentication and user management
  • Stripe (USA — SCCs): Payment processing
  • Resend (EU): Sending transactional emails
  • Cloudflare (USA — SCCs): CDN, DNS and security
  • Hetzner (EU): Server hosting

We do not sell or transfer your personal data to third parties for commercial purposes.

6. International transfers

Some providers process data outside the EEA. In all cases we rely on Standard Contractual Clauses (SCCs) approved by the European Commission and we assess the level of protection in the third country.

7. Data retention

  • Account data: For as long as the account is active. Deleted within 30 days of a deletion request.
  • Billing data: 6 years, in accordance with Spanish tax obligations.
  • Archived briefings and PDFs: For as long as the account is active. Deleted within 30 days of closure.
  • Access logs: 12 months.
  • Aeronautical source data (NOTAMs, METAR): Retained for as long as the original source publishes it. If the source corrects or removes it, we update our reflection at the next query.
  • Cookies: Depending on the type (see the cookies section).

8. Your rights (GDPR / LOPDGDD)

You may exercise the following rights:

  • Access: Know what personal data we hold about you
  • Rectification: Correct inaccurate data
  • Erasure: Request deletion of your data
  • Objection: Object to processing based on legitimate interest
  • Restriction: Restrict processing in certain circumstances
  • Portability: Receive your data in a structured format

To exercise these rights: privacidad@notamet.com. We will respond within a maximum of 30 days.

You may also lodge a complaint with the Spanish Data Protection Agency (AEPD) if you consider that the processing does not comply with the regulations: www.aepd.es.

9. Cookies

We use the following types of cookies:

Technical cookies (necessary)

  • __client: Authentication session (Clerk). Expires on sign-out.
  • __client_uat: Timestamp of the last authentication. Expires on sign-out.

Third-party cookies

  • Stripe: Cookies strictly necessary to process payments.
  • Clerk: Session cookies for authentication.

You can configure your browser to block all cookies, but this may affect the functionality of the service.

10. Security

  • Encryption in transit (TLS 1.3) and at rest (AES-256)
  • Secure authentication via Clerk with MFA available
  • Protection against common attacks (XSS, CSRF, SQL injection)
  • Periodic review of accesses and permissions
  • Infrastructure hosted at Hetzner (EU, ISO 27001)
  • SHA-256 traceability on every briefing for auditing

11. Children's privacy

Our services are not directed at persons under 16. We do not knowingly collect personal data from minors. If we detect that we have collected a minor's data, we will delete it immediately.

12. Changes

We may update this policy. We will notify significant changes by email or through a notice on the platform 30 days in advance. The last-updated date appears at the top.

13. Contact

By using the NOTAMET services, you acknowledge that you have read and understood this Privacy Policy.