Privacy Policy

Effective date: 10 November 2026 Version: 2.12 (section 2: drone flight applications)

This Privacy Policy explains what personal data Global Live Tracker ("the Service", "we") collects, why, how we use it, and the rights you have. This policy is written to comply with the EU General Data Protection Regulation (GDPR) and the UK GDPR.

1. Data controller

The controller of your personal data is Norwegian Product Solutions AS (org.nr. 929 491 645), Apeltunvegen 35C, 5222 Bergen, Norway, which operates Global Live Tracker. Contact: privacy@globaltrackers.app. Company details are on the imprint page.

2. What we collect

Account & profile

• email address, display name, language preference, plan tier
• authentication identifiers from your sign-in provider (Supabase Auth)

Usage & telemetry (only with consent)

• analytics events (page views, feature usage)
• aggregated performance metrics (no IP address, no precise location)

Trading data (only if you opt in to live trading)

• exchange API credentials, encrypted at rest with libsodium via Supabase pgsodium
• order audit trail (live_trading_audit), reconciliation drift events
• risk-disclosure acceptance log (timestamp, hashed IP, country, user agent fragments)

Support correspondence

• emails you send us and our replies

Phone and messaging alerts (only if you turn them on)

• your phone number (SMS or WhatsApp), your Telegram chat id, or your browser's push endpoint
• when and how you confirmed it (time, the consent wording version, a hashed IP address and your browser type)
• a log of the alerts we sent or skipped on these channels, with the provider's message id and cost

We use these only to send the alerts you set up, never for marketing. Reply STOP (SMS or WhatsApp), send /stop (Telegram) or remove the channel under Settings → Alerts to stop at any time. Alerts are information only and not for safety of life.

Drone pilot wallet (only if you use it)

• the drone operator registration numbers you enter, and an optional organisation name
• your drones (name, maker, model, serial and Remote ID serial, class, weight, registration mark)
• your pilot certificates and insurance details (type, number, issuer or insurer, dates, cover)
• your flight log (date, drone, country, place name, duration, highest height, purpose, notes)

You type all of this in yourself. Only you can see it: our staff have no access in the normal tools, and we never share it, sell it, offer it to AI agents, use it for AI training, ads or analytics, or match it against the aircraft and drone tracking data on our maps. We do not ask for your location coordinates, ID documents or photos of licences. The wallet keeps your own records only. It does not register you with an aviation authority or prove that a flight is allowed. "Remove" hides an entry and keeps an archived copy. "Delete permanently" erases it, and so does deleting your account.

If you use the application builder, we also keep the flight applications you prepare: planned date and time, the operating area you draw, the drone and certificates used, and the status and replies you record. We do not send applications for you. You can clear an area or delete an application at any time.

Cookies and browser storage

• strictly necessary storage for sign-in (Supabase auth) and your cookie choice
• optional first-party analytics — only after you accept analytics in the cookie banner
• full list in our Cookie & Storage Policy

We do not sell personal data. We do not use it for cross-context behavioural advertising.

3. Why we process it (legal bases)

4. Third-party processors

We share the minimum personal data needed with:

• Supabase — database, authentication, storage (EU region where available)

• OpenRouter and DeepSeek — AI inference (prompts may include the symbol or topic you asked about; never raw credentials)

  How AI features handle your data:

  • Placeholders first. Before any prompt leaves our systems, names and other personal data in it are replaced with placeholders.
  • Public information (news, markets, public registers, our module reports) may be processed by any of the AI providers above.
  • Your own input (for example your trading agents and positions, trade reviews, due-diligence requests, areas you draw on the map and console prompts) goes only to providers that are bound by a Data Processing Agreement and do not train their models on it.
  • Workforce safety customer data is processed only by our private model.

• Resend — transactional and (with consent) marketing email

• Stripe — payment processing (we never see your full card number)

• Twilio (USA) — sends SMS and WhatsApp alerts and verification codes (your phone number and the alert text)

• Meta / WhatsApp (Ireland and USA) — delivers WhatsApp alerts sent through Twilio

• Telegram — if you connect our Telegram bot, Telegram delivers alerts to your chat; Telegram is an independent controller under its own privacy policy, and we store only your chat id

• Google, Apple, Mozilla push services — deliver browser notifications; they receive only an encrypted message and your browser's push endpoint

• Cloudflare — hosting, edge delivery, DDoS protection and fallback AI inference (Workers AI)

• Plausible Analytics — cookieless aggregated page statistics, only if enabled

• the brokerage / exchange API you choose to connect (Alpaca, Saxo, KuCoin, Polymarket, etc.) — only the credentials you supply, used solely to route your own orders

Each processor is bound by a Data Processing Agreement.

5. International transfers

We are established in Norway, which is part of the EEA. Where data is transferred outside the EEA / UK we rely on Standard Contractual Clauses or an adequacy decision.

6. Retention

When you delete your account we revoke exchange credentials immediately. After the 30-day grace period we delete your account, profile and all data you created, and keep only the records listed above that we must retain for legal reasons, linked to an internal id rather than your email. We then record that the deletion was completed.

7. Your rights (GDPR Articles 15–22)

You have the right to:

• access a copy of your data — request from /settings/privacy
• rectify inaccurate data — edit profile or contact us
• erase your data — /settings/privacy → Delete account (30-day grace)
• restrict or object to processing
• portability — JSON export from /settings/privacy
• withdraw consent at any time without affecting prior lawful processing
• lodge a complaint with a supervisory authority. Our lead authority is the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no); you can also complain to the authority where you live or work (e.g. CNIL in France, AP in the Netherlands, ICO in the UK)

We respond to requests within 30 days.

8. Security

• credentials encrypted at rest with libsodium (pgsodium)
• TLS 1.2+ in transit
• row-level security on every personal table
• per-user credential decryptors with full access logging
• secrets isolated to server runtime; never bundled to the browser (scripts/check-secrets.ts enforces this on every build)

No system is perfect. If you discover a vulnerability, please email security@globaltrackers.app.

9. Children

The Service is not intended for users under 18 for any feature involving live trading or paid plans. Do not provide personal data if you are under that age.

10. Geographic restrictions

Live trading is geo-blocked from certain jurisdictions per regulatory requirements (see country_venue_blocklist). Read-only public surfaces remain accessible.

11. People mentioned in our data (Art. 14 GDPR)

Some of the public datasets we show contain information about people who are not our users, for example names on official sanctions lists, owners or operators in aircraft and vessel registries, people named in news, conflict and OSINT sources, and subjects of due-diligence reports.

• Sources: official public lists and registries, open-data projects and news publishers, listed on our Data Sources page.
• Purpose and legal basis: providing public-interest risk, news and situational-awareness information, based on our legitimate interest and the public's interest in this information (Art. 6(1)(f) GDPR). We do not use this data for profiling for marketing.
• Retention: we keep it while the source publishes it and refresh it from the source; entries removed by the source are removed or marked historical at the next refresh.
• Your rights: if you are named in this data, you can ask for access, correction, restriction or erasure, or object to the processing, at privacy@globaltrackers.app. If the information is on an official list, we will usually also refer you to the authority that published it.

11a. Company officers and key people

For large companies in our intelligence modules (energy and infrastructure, aviation, maritime and markets) we show who chairs the board, who runs the company and who sits on the board. "Large" is a fixed rule, not a judgement call: listed companies, energy companies with 20 or more tracked assets, airlines and aircraft lessors with 10 or more aircraft, ship owners and managers with 5 or more vessels, and other companies with 250 or more staff or more than EUR 50 million revenue. Sole traders, one-person companies and private trusts never qualify. For smaller companies, for example most companies that own an aircraft, we show company facts by default.

• Smaller companies (UK and Norway): we may also show the directors, officers and registered owners of smaller UK and Norwegian companies, taken from UK Companies House and the Brønnøysund Register Centre, on that company's own page only. We assessed this use in a data protection impact assessment. These names never appear on aircraft or ship pages, live tracks, flight or voyage history, the map, hover cards, alerts, social media posts or news articles. Aircraft whose owners use an aircraft privacy programme (such as LADD or PIA) are never linked to an owner company or a person. Only signed-in paying users can see these names, each view is logged, and the number of lookups is limited to stop bulk copying. They are never offered to AI agents. Sole traders and one-person companies are never included.

• What we keep: name, role (for example "Chair", "Chief executive", "Board member" or "Director"), the company, and the start and end dates of the role when the source gives them. We do not keep birth dates, home addresses, contact details or photos, and we never add email addresses or phone numbers.

• Sources (energy, aviation, maritime and markets alike): Wikidata (CC0), the Brønnøysund Register Centre's Central Coordinating Register for Legal Entities (NLOD 2.0), UK Companies House (Open Government Licence), the Czech commercial register via ARES (public register) and the US SEC's EDGAR system (public domain; the directors and officers named in insider filings, Forms 3 and 4, of the last 12 months). Contains data under the Norwegian Licence for Open Government Data (NLOD) made available by Brønnøysundregistrene.

• Owners (UK): for these companies we also show the UK register of persons with significant control (Companies House, Open Government Licence). For a person we keep only the name and the band of control (for example "Shares 75–100%"); we do not keep the date of birth, nationality, country of residence or address, and people whose details are protected on the register are never shown.

• Brazil (listed companies): for large Brazilian companies registered as publicly held with the Brazilian Securities and Exchange Commission (CVM), we show the members of the board of directors and the executive board named in the company's Reference Form (Formulário de Referência), taken from CVM's open data portal. We keep only the name, the role and the date the person took office. We do not keep the CPF (taxpayer number), date of birth, profession or career summary, and alternate members are not shown. We refresh this data every month. People in Brazil also have the rights in Article 18 of the Brazilian General Data Protection Law (LGPD), including confirmation, access, correction, anonymisation, blocking or deletion, information about sharing, and objection. Use them at privacy@globaltrackers.app. Under the LGPD our legal basis is legitimate interest (Art. 7, IX), applied to data the subjects or the law have made public (Art. 7, §3–§4). Contains data from CVM (dados.cvm.gov.br), Open Database License (ODbL).

• Company websites: when no register lists a company's leaders, we may show names and roles that an AI model read from the company's own public website. These are labelled "AI-extracted from the company website", may contain errors, and are replaced by register data when it becomes available. Our crawler (GlobalTrackersBot) follows robots.txt and text-and-data-mining opt-outs, and site owners can ask us to stop reading their site at privacy@globaltrackers.app.

• Purpose and legal basis: transparency about who runs and controls large companies in energy, aviation, shipping and the markets, as part of our intelligence modules. Our legal basis is our legitimate interest and that of our users (Art. 6(1)(f) GDPR). We weighed this against the interests of the people concerned: the data is professional and already public in official registers; for smaller companies the extra safeguards above apply; and we honour objections.

• Recipients: signed-in users of the intelligence modules, one company at a time. If we offer this data through our API, including to AI agents, it will be per company only, with the source link and this removal option, and our API terms forbid using it for direct marketing, profiling or training on individuals. There is no bulk download.

• Person search (from version 2.8): signed-in paying users can search for a person by full first and last name and see the companies where an official register lists that person in a role or as an owner. Each result shows only the company, the role or band of control, the role dates, the register and a link to it; it never shows aircraft, ships, other assets, tracks, map positions or addresses. Each search needs a reason chosen from a fixed list: due diligence or anti-money-laundering checks, sanctions or compliance checks, journalism, academic research, litigation, or another stated reason. Searches for private, harassment, stalking, marketing or HR-screening purposes are forbidden by our terms. Every search is logged with the account, the name searched, the reason, the time and the number of results; each account is limited to 50 searches a day and 500 a month, and we review unusual use every month. Only roles from official registers are searchable, never names read from company websites. People who objected or asked to be removed, people protected on the register and minors never appear. Records are never joined by name alone. AI agents and our API cannot search by person. You can ask us whether you were searched and for which reasons, and object to appearing in person search, at privacy@globaltrackers.app.

• Accuracy and history: each name shows its role dates, a link to the source and the date the source last listed it, and a "Report an error" link. We never join people across companies by name alone. We refresh large companies about every 30 days and smaller companies at least every 3 months. People the source no longer lists are kept as history and marked "No longer listed", not shown as current.

• Retention: we keep this data while the company is part of our intelligence modules; we do not delete it on a fixed schedule. Removal requests are always honoured (see below). Logs of who viewed the names of people at smaller companies, and of person searches, are kept for at least 12 months.

• Your rights: you can object to this processing (Art. 21 GDPR) or ask for erasure, access or correction at privacy@globaltrackers.app or legal@globaltrackers.app. When we remove you, you stay removed: later updates from the registers skip you.

• Notice: we do not contact each person individually, as this would involve disproportionate effort (Art. 14(5)(b) GDPR); this section and the source link next to each name make the information public instead.

11b. Our social media pages

We run Global Tracker pages on Instagram, Facebook, X, LinkedIn, Telegram and Bluesky, where we post newsroom stories and Global Tracker Risk Index updates that an editor has reviewed.

• Meta (Instagram and Facebook): when you visit or interact with our Facebook Page or Instagram account, Meta Platforms Ireland Ltd. creates statistics for us ("Page Insights"). For Page Insights, we and Meta are joint controllers (Art. 26 GDPR) under Meta's Page Insights Controller Addendum, and Meta has agreed to take primary responsibility for that processing and for handling your rights. We only see aggregated statistics, not who you are. For everything else, Meta is an independent controller under its own privacy policy.
• X: X Corp. / Twitter International Unlimited Company is an independent controller for data it processes when you use X, under its own privacy policy.
• LinkedIn: when you visit or interact with our LinkedIn Page, LinkedIn Ireland Unlimited Company creates statistics for us ("Page Analytics"). For those, we and LinkedIn are joint controllers (Art. 26 GDPR) under LinkedIn's Page Insights Joint Controller Addendum, and LinkedIn takes primary responsibility for that processing and for handling your rights. We only see aggregated statistics. For everything else, LinkedIn is an independent controller under its own privacy policy.
• Telegram: Telegram is an independent controller for data it processes when you use Telegram or join our channel, under its own privacy policy. Our channel is one-way: we post, and we do not export the subscriber list.
• Bluesky: Bluesky Social PBC is an independent controller for data it processes when you use Bluesky, under its own privacy policy. Posts and interactions on Bluesky are public by design.
• What we do with it: we read public comments and messages sent to our pages so we can answer them. We do not export follower lists or build profiles of people who interact with our pages. Our legal basis is our legitimate interest in communicating about our service (Art. 6(1)(f) GDPR).
• Comments on our posts: when you comment on our posts on Facebook, Instagram or Bluesky, we store your public display name, handle, the comment and its time, so that we can read and answer comments (legitimate interest, Art. 6(1)(f) GDPR). We use this only to answer comments: never for profiling, marketing lists or resale. You can ask us to erase it at privacy@globaltrackers.app.
• Your rights: you can use your rights against us or against the platform. Contact us at privacy@globaltrackers.app and we will pass on requests that only the platform can handle.

11c. Public tenders and contract awards

Our Tenders and projects feature shows public procurement notices published by official tender portals (for example TED, UK Find a Tender and Contracts Finder, and AusTender). Supplier names from published contract award notices are shown, and individual suppliers are shown without a name. We never keep personal ID numbers or home addresses from these notices, we do not build contact lists from them, and contract awards are not searchable by person. To ask for a correction or removal, write to privacy@globaltrackers.app.

12. Changes to this policy

We will notify you in-product and by email of material changes and will re-prompt consent where required. The version number and effective date at the top of this page always reflect the current revision.

13. Contact

• General privacy questions: privacy@globaltrackers.app
• Data Protection Officer: dpo@globaltrackers.app
• Postal: Norwegian Product Solutions AS, Apeltunvegen 35C, 5222 Bergen, Norway

This is version 2.2. Older versions are kept in the privacy_policy_versions table and available on request.