Privacy Policy — Part-66 Prep: EASA & UK CAA

Publisher: Bisai Technologies (Bisai Technologies, LLC, a Delaware limited liability company), 131 Continental Dr, Suite 305, Newark, DE 19713, United States Contact: contact@bisaitechnologies.com Effective date: 28 September 2026 · Version: 1.0 Hosted at: https://bisaitechnologies.com/legal/part66_pro/privacy

Part-66 Prep: EASA & UK CAA ("the app") is an independent study aid for the EASA Part-66 and UK CAA Part-66 basic knowledge examinations. This policy explains what data the app processes, why, for how long, and what rights you have. It is written for the app as it is built: there is no account, no login and no email address anywhere in the app.

1. Who is responsible

Bisai Technologies is the data controller for the processing described here.

You can reach our Privacy Officer at contact@bisaitechnologies.com. Put "Privacy" in the subject line.

2. The short version

• The app never asks for your name, email address, phone number, photo, licence number or location.
• Your only identifier is an anonymous app user ID created on your device by the RevenueCat SDK when you first open the app (it looks like $RCAnonymousID:…). It is not linked to your identity.
• Your study progress (answers, scores, flashcards, notes, exam dates, attempt log, essay marks, streak) is stored on your device only. You can erase it at any time in Settings > Data > Reset app data.
• Data leaves your device for exactly seven purposes: subscriptions, usage analytics, crash reports, question problem reports, the "explain it differently" AI feature, the essay trainer's AI marking, and exam outcome logging for the pass guarantee. Each is described in section 4.
• We do not sell personal data, we do not show ads, and we do not use advertising trackers.

3. Your anonymous ID

When you first open the app, the RevenueCat SDK generates a random identifier and stores it on your device. This ID:

• is sent with every request to our server (header X-User-Id) so that daily limits, rate limits and the pass guarantee can work without an account;
• is the identifier under which your subscription is recorded by RevenueCat;
• is the identifier under which analytics events are recorded by PostHog.

If you delete the app and reinstall it, a new ID is generated. Use Restore purchases to re-attach an active subscription to the new ID. You can view and copy your current ID in Settings > About > Your anonymous ID; you will need it if you ask us to delete server-side data (section 8).

4. What we process, why, and on what legal basis

4.1 Study data — on your device only

Answers given, per-module and per-sub-topic scores, spaced-repetition schedule, mock exam sessions and results, diagnostic results, flagged questions, notes, chosen category (A, B1.1, B1.2, B1.3, B2, B2L or B3), chosen regulator (EASA or UK CAA), module exam dates, reminder time, streak, exam-day checklist state, readiness status per module, essay drafts and their marks, and settings.

Attempt tracker. The dates of your real module sittings, the module and category sat, and the pass/fail result you log are stored on your device. The app computes the 90-day waiting period after a fail and the three-consecutive-attempt limit from this local log. Nothing in the tracker is sent to us except the exam-outcome record described in 4.9.

Parametric calculation questions. Numbers in mathematics, physics and electrical questions are generated by templates that run on your device. No request is made to any server.

• Where: a local SQLite database and local preferences on your device. Included in your device's normal OS backup if you have backups enabled (Apple iCloud backup / Google backup), under Apple's or Google's terms.
• Legal basis: performance of the contract (providing the study features you asked for). This data is not transmitted to us except as described in 4.4 (aggregated answer statistics), 4.8 (essay marking) and 4.9 (exam outcome).
• Retention: until you reset app data or uninstall the app.

4.2 Subscriptions and purchases

Payments are made through Apple's App Store or Google Play. We never see your card number, bank details or billing address. Subscription state is managed for us by RevenueCat.

• Data: anonymous app user ID; store receipt or purchase token; product identifier (part66_pro_weekly or part66_pro_monthly); price, currency and store country; purchase, renewal, cancellation and refund dates; entitlement status; device platform, OS version and app version.
• Recipients: Apple Inc. or Google LLC (as independent controllers of the payment, under their own privacy policies); RevenueCat, Inc. (our processor, United States); our server, which checks your entitlement when you use the AI features and caches the result for ten minutes.
• Legal basis: performance of the contract (Art. 6(1)(b) GDPR / UK GDPR).
• Retention: subscription records are kept by RevenueCat while your anonymous ID exists and are deleted on request (section 8). Our entitlement cache expires after ten minutes. Aggregated revenue reports contain no personal data and are kept for accounting purposes for 10 years.

4.3 Usage analytics (PostHog)

We measure how the app is used so we can fix confusing screens, balance question difficulty and decide what to build next.

• Data: event names (for example app_started, diagnostic_completed, practice_answered, mock_completed, paywall_viewed, purchase_completed); event properties (category, regulator, module, sub-topic, question ID, whether an answer was correct, time taken, screen name, paywall variant shown, plan selected); person properties (app ID, whether you are a subscriber, plan, category, exam date); device model, OS version, app version, app language, time zone and screen size; a session identifier; your anonymous app user ID. Your IP address is received by PostHog to deliver the request and to derive a country-level location; PostHog is configured to discard the IP address itself.
• Feature flags: PostHog also decides at random which paywall layout you see (paywall_variant) and records which variant was shown.
• Recipient: PostHog, Inc. (our processor), hosted on PostHog Cloud EU in Frankfurt, Germany.
• Legal basis: our legitimate interest in understanding and improving the app (Art. 6(1)(f) GDPR / UK GDPR). Analytics is switched on by default. You can turn it off at any time in Settings > Privacy > Share usage analytics; from that moment no further events are sent.
• Retention: 12 months from collection, then deleted.

4.4 Aggregated answer statistics

To calibrate question difficulty, the app sends batches of {question ID, correct or not, time taken, mode} to our server.

• Data stored: per-question totals only (attempts, correct answers, average time). The batch is processed and not kept; your anonymous ID appears in the request header for rate limiting and remains only in server access logs (30 days).
• Legal basis: legitimate interest in maintaining accurate content.

4.5 Crash reports

If the app crashes or hits an unexpected error, a report is queued on the device and sent to our server when a connection is available.

• Data: error message, stack trace, app version, platform, OS version, the last screens and actions before the error (breadcrumbs), and your anonymous app user ID.
• Legal basis: legitimate interest in keeping the app working.
• Retention: 90 days.

4.6 Question problem reports

Every question has a Report a problem button.

• Data: question ID, content pack ID and version, the reason you select, any free text you type, app version and your anonymous app user ID. Please do not include personal data in the free-text field; if you do, we delete it when we process the report.
• Legal basis: legitimate interest in correcting content, based on a report you choose to send.
• Retention: until the report is resolved, then 12 months, and never longer than 24 months.

4.7 "Explain it differently" (AI explanations)

Subscribers can ask for an alternative explanation of a question. The request is served by our server, which uses Google Cloud Vertex AI (Gemini models) to generate the text.

• Data sent by the app to our server: question ID, content pack ID, requested mode (simpler, different), language, and your anonymous app user ID (used to enforce the daily cap and check your subscription).
• Data sent by our server to Google: the question text, answer options and existing explanation, loaded from the content pack by question ID. No user identifier and no personal data is sent to Google. Google Cloud processes this as our processor and does not use it to train its models.
• Data stored by us: a daily counter per anonymous ID (deleted after 30 days) and, optionally, the generated explanation cached against the question ID with no user link.
• Legal basis: performance of the contract (a feature you request).

4.8 Essay trainer (AI marking)

Subscribers can write timed practice essays for Module 7 (EASA) and Modules 7, 9 and 10 (UK CAA) and have them marked against a key-points list. This is the only feature in which text you write leaves your device.

• Data sent by the app to our server: the essay text you typed, the essay prompt ID, and your anonymous app user ID (used to enforce the daily cap and check your subscription).
• Data sent by our server to Google: your essay text together with the marking key-points for that prompt. No user identifier is sent to Google. Google Cloud processes this as our processor and does not use it to train its models.
• What to avoid: write about the technical subject only. Do not include your name, employer, licence number or any other personal data in an essay; if you do, it is transmitted with the essay. We do not read essays; they are processed automatically.
• Data stored by us: the essay is held in memory only for the duration of the marking request and is not stored on our server. The mark and feedback are returned to your device and stored there only. The daily counter per anonymous ID is deleted after 30 days.
• Legal basis: performance of the contract (a feature you request).

4.9 Exam outcome and the pass guarantee

After a real module sitting you can log the result (pass or fail) in the app's attempt tracker. This is optional.

• Data sent to our server: module, category, regulator, exam date, pass or fail, the readiness status the app had assigned for that module before the exam, and your anonymous app user ID.
• If you make a guarantee claim by email, you will send us your official result sheet. It contains your name and result. We use it only to verify the claim, store it in our support mailbox, and delete it 90 days after the claim is closed.
• Legal basis: performance of the contract (the pass guarantee in our Refund Policy).
• Retention: 24 months.

4.10 Redeem codes

If you enter a promotional code, the code and your anonymous app user ID are recorded to prevent reuse. Retention: 36 months.

4.11 Remote configuration and content updates

The app periodically downloads its configuration and updated question packs from our server. Each request carries the app ID, your anonymous app user ID, app version, platform and preferred language. Our web server keeps standard access logs (IP address, time, requested path, user agent) for 30 days for security and troubleshooting.

4.12 On-device features that involve no data transfer

• Daily reminder: a local notification scheduled on your device. We do not use push notifications and hold no device token.
• Audio (text-to-speech): questions are read aloud by your device's own speech engine, subject to your device settings. We send nothing.
• Formula sheet, unit-conversion trainer, diagrams: bundled with the app; no network use.
• Offline use: every study feature except the two AI features works without a network connection.

4.13 Links to other websites

The app links to official pages (EASA, the UK CAA, EUR-Lex, legislation.gov.uk, FAA handbook downloads, exam booking pages of national authorities) and to the sources of each question. These open in your browser and are governed by those sites' own privacy policies.

5. Who receives data (processors)

We have a data processing agreement with each processor. We do not sell personal data and we do not share it with advertisers or data brokers.

6. International transfers

RevenueCat and PostHog are US companies; Google Cloud is a US group. Where personal data leaves the European Economic Area or the United Kingdom, we rely on the European Commission's Standard Contractual Clauses (with the UK International Data Transfer Addendum where applicable) and on the providers' technical safeguards. Copies of the relevant clauses are available on request.

7. Retention summary

8. Your rights

Under the GDPR and the UK GDPR you have the right to access, rectify, erase, restrict and port your personal data, to object to processing based on legitimate interest, and to withdraw consent where processing is based on consent. Because we hold no identity data, we handle requests using your anonymous app user ID:

1. Erase data on your device: Settings > Data > Reset app data. This deletes the local database and preferences, including the attempt tracker and essay marks.
2. Erase data on our systems and at our processors: copy your ID from Settings > About > Your anonymous ID and email it to contact@bisaitechnologies.com with the subject "Delete my data". We delete the matching records at RevenueCat, PostHog and on our server within 30 days and confirm by reply. Deleting the RevenueCat record ends access to any active subscription on that ID; cancel the subscription in your store settings first if you do not want to be billed again.
3. Access or portability: email your ID and we send you the data we hold against it in a machine-readable format within 30 days.
4. Stop analytics: Settings > Privacy > Share usage analytics.

We do not verify identity beyond possession of the ID, because the ID is the only link between you and the data.

You may lodge a complaint with the data protection supervisory authority of the EU country where you live (directory: https://edpb.europa.eu/about-edpb/about-edpb/members_en). UK residents may complain to the Information Commissioner's Office (ico.org.uk, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF).

9. Users in California (CCPA/CPRA)

In the past 12 months we have collected these categories of personal information: identifiers (anonymous app user ID), commercial information (subscription purchase records), internet or other electronic network activity (in-app interactions, crash data), and, if you use the essay trainer, the text you write. We collect them for the business purposes described in section 4. We do not sell personal information and we do not share it for cross-context behavioural advertising. We do not collect sensitive personal information. You have the right to know, delete and correct, and the right not to be discriminated against for exercising these rights. Exercise them by emailing contact@bisaitechnologies.com with your anonymous ID.

10. Children

The app is intended for adults preparing an aircraft maintenance licence. It is not directed to anyone under 16, and we do not knowingly process data from children under 16. If you believe a child under 16 has used the app and data has been sent to us, email us with the anonymous ID and we will delete it.

11. Security

All traffic between the app and our server, RevenueCat and PostHog uses TLS. Content packs are signed (Ed25519) and hash-verified before use. Our server is protected by rate limits per anonymous ID, and administrative access requires authentication. No system is perfectly secure; if a breach affecting your data occurs, we will notify the competent authority and, where required, affected users through the app.

12. Changes to this policy

When we change this policy we update the version number and effective date at the top, publish the new text at the URL above, and, for material changes, show a notice in the app. Continued use after the effective date means the new version applies.

13. Contact

Bisai Technologies — Privacy Officer 131 Continental Dr, Suite 305, Newark, DE 19713, United States contact@bisaitechnologies.com