www.737ng.com - B737 NG Type Rating Preparation Platform
Effective Date: [27 September 2026]
Last Updated: [27 September 2026]
TABLE OF CONTENTS
- Who We Are
- Scope
- Personal Data We Collect
- How and Why We Use Your Data
- Advertising Measurement (Meta and OpenAI)
- Who We Share Data With
- International Data Transfers
- Cookies and Similar Technologies
- Emails
- Data Retention
- Your Rights
- Data Security
- Children
- Changes to This Policy
- Complaints
- Contact
1. WHO WE ARE
1.1 Data Controller
The data controller responsible for your personal data is:
- Business Name: www.737ng.com (Commercial Name)
- Legal Form: Auto-entrepreneur (Sole Proprietorship)
- SIRET Number: 800 142 515
- Registered Office: 5ème Avenue, 60260 Lamorlaye, France
- Email: cgautoentreprise@gmail.com
1.2 Data Protection Officer
As a sole proprietorship, we are not required to appoint a Data Protection Officer (GDPR Article 37). All data protection matters are handled directly by the data controller at the contact details above.
1.3 Applicable Law
This policy is written to meet the General Data Protection Regulation (GDPR) - Regulation (EU) 2016/679, the French Data Protection Act (Loi Informatique et Libertés), and the ePrivacy rules on cookies as applied by the CNIL.
2. SCOPE
This policy applies when you:
- Visit www.737ng.com or use it as an installed web app (PWA)
- Take the free lead-magnet quiz
- Create an account and use the question bank, study notes, quizzes and exams
- Buy an access plan
- Receive our emails or contact us
It does not cover third-party websites we link to. Where a partner acts as an independent controller (for example Stripe for fraud prevention, or Meta and OpenAI for advertising, see Section 5), their own privacy policy also applies.
3. PERSONAL DATA WE COLLECT
3.1 Account Data
- Full name and email address
- Password, stored only as a salted hash by our authentication provider (Supabase). We never see it.
- If you sign in with Google: your Google account email, name and profile picture URL, as authorised on Google's consent screen
- Account creation and last sign-in dates
3.2 Onboarding and Profile Data (Optional)
- Primary aircraft type
- Experience level (e.g. first type rating, recurrent)
- Study goals
3.3 Study and Progress Data
- Questions answered, answers given, correctness and time taken
- Quiz, mock exam and Smart Test sessions and scores
- Study streaks, progress by system and weak areas
- Study notes you open
- Monthly question count (for free-plan limits)
3.4 Purchase Data
- Plan bought (Second Officer, First Officer, Examiner or Lifetime), price, date and access end date
- Stripe customer and checkout session identifiers
- Whether you had accepted analytics cookies when you started checkout (used only to decide whether a purchase may be reported to advertising partners, see Section 5)
We never receive or store card numbers or security codes. Payment is handled entirely by Stripe.
3.5 Lead-Magnet Quiz Data
If you take the free quiz and ask for your results by email:
- Email address and first name
- Your pilot profile (e.g. initial qualification, upgrade, transition, recurrent), quiz score and score badge
3.6 Email Preferences
- Your choices for study reminders and product/offer emails
- A record of emails sent to you (type and date), used to avoid duplicates
3.7 Technical Data
- IP address and browser user agent (device, operating system, browser)
- Pages visited and in-app events (only with analytics consent, see Section 8)
- Error reports (see Section 6, Sentry)
- Your cookie consent choice
3.8 Communications
- The content of emails you send us (support, feedback, data requests)
We do not collect special-category data (health, medical certificates, etc.). Please do not send it to us.
4. HOW AND WHY WE USE YOUR DATA
| Purpose | Data used | Legal basis (GDPR Art. 6) |
|---|---|---|
| Creating your account, signing you in, providing questions, notes, quizzes, exams and progress tracking, offline sync | Account, profile, study data | Performance of a contract (6(1)(b)) |
| Processing purchases and granting plan access | Purchase data, email | Performance of a contract (6(1)(b)) |
| Account and service emails (welcome, password reset, payment confirmation, access expiry warnings) | Email, name, purchase data | Performance of a contract (6(1)(b)) |
| Keeping accounting and tax records | Purchase data | Legal obligation (6(1)(c)) |
| Detecting errors and keeping the service secure and working | Technical data, error reports | Legitimate interest (6(1)(f)) |
| Study reminders and product/offer emails to account holders (Section 9) | Email, name, study activity | Legitimate interest and French "soft opt-in" (Art. L34-5 CPCE); you can object at any time |
| Sending quiz results and follow-up emails from the lead-magnet quiz | Quiz data | Consent (6(1)(a)) |
| Product analytics (PostHog) | Technical data, events, user ID, email, name | Consent (6(1)(a)), via the cookie banner |
| Advertising measurement (Meta, OpenAI, Section 5) | Hashed email, hashed first name, IP address, user agent, ad-click identifiers, event details | Consent (6(1)(a)), via the cookie banner |
We do not use your data for automated decisions that have legal or similarly significant effects on you (GDPR Article 22).
5. ADVERTISING MEASUREMENT (META AND OPENAI)
We advertise 737ng.com on Meta (Facebook, Instagram) and on OpenAI's advertising platform. To measure whether those ads work, and only if you click "Accept" on our cookie banner, we:
- Load the Meta Pixel and the OpenAI Ads pixel in your browser. They record visits and the actions below, and set the cookies listed in Section 8.
- Send the same events from our server to the Meta Conversions API and the OpenAI Ads Conversions API, so that events blocked in the browser are still counted once.
Events reported: sign-up (Google sign-in), starting a checkout, completing a purchase (with plan and price), and leaving your email on the free quiz.
Data sent with each event:
- Your email address, and for Meta your first name, hashed (SHA-256) before they leave our servers
- Your IP address and browser user agent
- Ad-click identifiers stored in cookies when you arrived from an ad
- The event name, time, and for purchases the plan and amount
Hashing is a pseudonymisation technique, not anonymisation: Meta and OpenAI can match a hashed email to an account on their platform. They use this data to attribute conversions to ads, report aggregated results to us, and optimise ad delivery. For this processing Meta and OpenAI act as controllers (or joint controllers with us for the collection and transmission) under their own terms and privacy policies:
- Meta: Meta Platforms Ireland Limited - https://www.facebook.com/privacy/policy
- OpenAI: https://openai.com/policies/privacy-policy
If you decline cookies, or never click "Accept", none of this happens: the pixels are not loaded and our server sends no events to Meta or OpenAI. For purchases, we record your consent choice when you start checkout and only report the purchase if you had accepted. You can withdraw consent at any time (Section 8.4); from then on no further events are sent.
We do not sell your personal data, and we do not share your study data, answers or scores with advertisers.
6. WHO WE SHARE DATA WITH
We share personal data only with the service providers below, and only what each needs. Processors act on our instructions under a data processing agreement.
| Provider | Role | Data | Location |
|---|---|---|---|
| Supabase Inc. | Database, authentication, file storage (processor) | Account, profile, study, purchase and email-preference data | EU (Stockholm, Sweden) |
| Vercel Inc. | Website hosting and server functions (processor) | All data passing through the site, IP address, request logs | United States and global edge network |
| Stripe (Stripe Payments Europe Ltd, Ireland) | Payments (processor; independent controller for fraud prevention and its legal obligations) | Email, name, plan, price, payment details you enter on Stripe's page | EU and United States |
| Resend Inc. | Sending transactional and reminder emails (processor) | Email address, name, email content | United States |
| Klaviyo Inc. | Lead-magnet quiz emails (processor) | Quiz email, first name, pilot profile, score | United States |
| PostHog Inc. | Product analytics, with consent (processor) | User ID, email, name, events, device and browser data, IP address | EU (PostHog EU Cloud) |
| Functional Software Inc. (Sentry) | Error monitoring (processor) | Error details, browser and device data. Emails, IP addresses, cookies and request headers are removed before sending. | United States |
| Google LLC | "Sign in with Google" (independent controller for your Google account) | Sign-in request; we receive name, email, picture | United States |
| Meta Platforms Ireland Ltd | Advertising measurement, with consent (Section 5) | Hashed email and first name, IP, user agent, events | EU and United States |
| OpenAI | Advertising measurement, with consent (Section 5) | Hashed email, IP, user agent, events | United States |
We may also disclose data where required by law (e.g. a court order or a request from a competent authority), or to establish or defend legal claims. If the business is sold or transferred, your data may be transferred to the new owner, who will be bound by this policy.
7. INTERNATIONAL DATA TRANSFERS
Our main database is in the EU. Some providers above process data in the United States. For each such transfer we rely on:
- the EU-US Data Privacy Framework adequacy decision, where the recipient is certified (https://www.dataprivacyframework.gov); or
- Standard Contractual Clauses approved by the European Commission (Decision (EU) 2021/914), with supplementary measures where needed.
You can ask us for more information about these safeguards (Section 16).
8. COOKIES AND SIMILAR TECHNOLOGIES
8.1 Strictly Necessary (No Consent Needed)
| Name | Purpose | Duration |
|---|---|---|
sb-*-auth-token (may be split into several parts) | Keeps you signed in (Supabase) | Up to the session refresh period |
qcm737-consent | Remembers your cookie choice, so our server knows whether analytics and advertising are allowed | 13 months |
Local storage qcm737-cookie-consent | Same choice, stored in your browser | 13 months |
| Local storage and IndexedDB (questions, current session, preferences, sync queue) | Offline study and saving your answers until you are back online | Until cleared or you sign out |
The offline data stays on your device and is only sent to us when it syncs your own answers and progress.
8.2 Analytics (Consent Required)
| Name | Purpose | Duration |
|---|---|---|
ph_*_posthog | PostHog product analytics (EU Cloud): anonymous ID, then your user ID once signed in | 12 months |
PostHog also respects your browser's "Do Not Track" setting.
8.3 Advertising Measurement (Consent Required)
| Name | Purpose | Duration |
|---|---|---|
_fbp | Meta Pixel browser identifier | 90 days |
_fbc | Meta ad-click identifier, set when you arrive from a Meta ad | 90 days |
__oppref, __obref | OpenAI Ads click and browser identifiers | Up to 90 days |
These are set by the pixels described in Section 5 and are not set unless you accept.
8.4 Your Choice
The banner offers Accept and Decline; closing it counts as Decline. Declining has no effect on your access to the service. To change your choice later, clear this site's cookies and local storage in your browser and the banner will reappear; or email us and we will help. Withdrawing consent stops future collection but does not affect processing that took place before.
Error monitoring (Sentry) sets no advertising or analytics cookies and runs on the basis of our legitimate interest in keeping the service working.
9. EMAILS
9.1 Service Emails
We always send emails needed to run your account: welcome, password reset, payment confirmation, access-expiry warnings and important changes to the service or these policies. You cannot opt out of these while you have an account.
9.2 Study Reminders and Product Emails
As an account holder you may also receive study reminders (for example when a study streak is at risk) and emails about 737ng.com features, plans and offers (for example after reaching the free-plan limit, or if you have not studied for a while). These relate only to our own service.
You can stop them at any time, free of charge:
- with the one-click unsubscribe link in every such email; or
- in the notification preferences on your Account page; or
- by emailing cgautoentreprise@gmail.com.
9.3 Lead-Magnet Quiz
If you enter your email on the free quiz, you consent to receive your results and a short series of related emails through Klaviyo. Each email contains an unsubscribe link.
10. DATA RETENTION
| Data | Kept for |
|---|---|
| Account, profile and study data | Until you delete your account |
| Purchase and invoice records | 10 years (French accounting and tax law, Art. L123-22 Code de commerce) |
| Lead-magnet quiz profile (Klaviyo) | Until you unsubscribe, then up to 3 years as proof of consent |
| Email send records | 3 years |
| Analytics events (PostHog) | Up to 7 years (PostHog default), unless you ask us to delete them |
| Error reports (Sentry) | 90 days |
| Server request logs (Vercel) | As set by Vercel, typically a few days |
| Cookie consent choice | 13 months, after which we ask again |
| Support emails | 3 years after our last exchange |
10.1 Deleting Your Account
You can delete your account at any time from the Danger Zone on your Account page. Deletion is immediate and permanent: your profile, answers, sessions, progress and preferences are erased from our database at once. Purchase records we must keep for tax purposes are retained for the period above. Copies in backups are overwritten on the backup cycle of our database provider.
11. YOUR RIGHTS
Under the GDPR you have the right to:
- Access the personal data we hold about you (Art. 15)
- Rectification of inaccurate data; you can edit most of it on your Account page (Art. 16)
- Erasure (Art. 17); you can delete your account yourself, see Section 10.1
- Restriction of processing (Art. 18)
- Data portability (Art. 20); you can download your data as a JSON file from your Account page
- Object to processing based on legitimate interest, and at any time to direct marketing (Art. 21)
- Withdraw consent at any time, without affecting earlier processing (Art. 7(3))
- Give instructions on what happens to your data after your death (French Data Protection Act, Art. 85)
To exercise a right, email cgautoentreprise@gmail.com. We may ask you to confirm the request from your account email address. We reply within one month, extendable by two months for complex requests (we will tell you if so). It is free, unless a request is manifestly unfounded or excessive.
We extend these rights to all users, wherever they live.
12. DATA SECURITY
We protect your data with measures appropriate to the risk, including:
- HTTPS (TLS) encryption for all traffic
- Encryption at rest by our database and hosting providers
- Database row-level security, so each user can only read their own data
- Passwords stored only as salted hashes by Supabase; card payments handled on Stripe's own secure page
- Access to production systems limited to the data controller
- Error reports stripped of emails, IP addresses, cookies and request headers
No system is perfectly secure. If a personal data breach is likely to put your rights at risk, we will notify the CNIL within 72 hours and, where the risk is high, inform you without undue delay (GDPR Articles 33-34).
To report a security issue, email cgautoentreprise@gmail.com with the subject "Security Vulnerability Report" and please do not disclose it publicly until we have fixed it.
13. CHILDREN
The service is intended for adults training for a professional type rating and is not directed at anyone under 18. We do not knowingly collect data from minors. If you believe a minor has given us personal data, contact us and we will delete it.
14. CHANGES TO THIS POLICY
We update this policy when our practices, providers or the law change. The "Last Updated" date at the top shows the latest version. For material changes (for example a new category of data, a new purpose, or a new recipient) we will inform account holders by email or with a notice in the app before the change takes effect, and ask for consent again where required.
15. COMPLAINTS
We would like to resolve any concern directly, so please contact us first. You also have the right to lodge a complaint with a supervisory authority, in particular in the EU country where you live or work.
In France: Commission Nationale de l'Informatique et des Libertés (CNIL), 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France - https://www.cnil.fr/fr/plaintes
List of EU authorities: https://edpb.europa.eu/about-edpb/about-edpb/members_en
16. CONTACT
- Email: cgautoentreprise@gmail.com
- Post: www.737ng.com, 5ème Avenue, 60260 Lamorlaye, France
You may write to us in English or French.
END OF PRIVACY POLICY