Privacy Policy

Updated on October 9, 2026

1. Controller and contact
LOAD FLIGHT VIRTUAL FLIGHT MANAGEMENT LTDA, Brazilian company registration (CNPJ) 67.971.785/0001-10, is the controller of personal data processed to operate Load Flight. For privacy questions, access, correction, deletion or decision review, contact contact@loadflight.com. This channel is available even without an account or access to the application.

2. Registration, account and service use
We process your name, email, phone number with international code, country, state, city, HUB, gender, preferences and account identifiers. Authentication uses cryptographic password verifiers. When you connect external services, we also process the IVAO, VATSIM and SimBrief identifiers needed for integration. During use, we process simulated flight data, career information, transactions, support messages, attachments, error reports and notification tokens, depending on the features used. Flight position and telemetry concern the simulated aircraft, rather than your precise physical location.

3. Security and multiple account prevention
We may process IP addresses, attempt timestamps, application version, computer name, machine identifier, persistent device token and cryptographically transformed hardware component identifiers, including TPM, motherboard, disk, SMBIOS and network interface. These data help protect sessions, detect multiple registrations, identify connections to blocked identities and prevent banned users from returning. Hashed identifiers remain personal data when they allow devices or people to be linked. A security identifier may persist after application reinstallation. Registration is subject to the device and network restrictions in force, with review available through our privacy contact. We may also record request volumes and timestamps to detect abuse and protect service availability. Session tokens are necessary for authentication; compatible versions of the Windows application use operating system cryptographic protection for local storage. This protection does not eliminate risks on compromised devices.

4. Email and phone verification
We check email format, domain, duplication and whether the domain appears on disposable email service lists. These lists may contain errors, which can undergo administrative review. Code confirmation demonstrates access to the address or number provided; it does not, by itself, establish legal identity. Verification emails are sent through Resend. When phone verification is enabled, the number, language and data needed for delivery and confirmation are processed by Twilio Verify through available channels, such as SMS, calls or WhatsApp. WhatsApp depends on provider availability and activation. Changing a contact may require fresh verification and invalidate dependent confirmations. When this rule is actually enabled, we may check public DNS and HTTP/HTTPS responses for email domains associated with banned accounts or still-valid blocked email identities. Resolvers receive only the queried domain; websites receive the domain and technical connection metadata, without the full email address, name, phone number or credentials. Association with a banned user alone does not block a domain under this rule. Unavailability or the absence of a website requires conclusive confirmations in checks separated by at least 24 hours; temporary or inconclusive failures do not initiate a block. Administrative allow exceptions take precedence, and website recovery or loss of the ban association releases the corresponding automatic block. Technical records include the domain, reason, result and check timestamps, with review available through our privacy contact.

5. Risk assessment and automated decisions
We combine registration data, security history, device and network connections and verification results to assess risk. When enabled, completion timing, repeated requests and approximate IP location may also be used. This purpose does not require recording every keystroke. A phone or IP country different from the country provided does not prove fraud: travel, VPNs and international phone numbers can explain differences. An international HUB alone is not a reason to reject registration. Automated checks may prevent registration, refer it for review or restrict an account under applicable rules. You may request data correction and review of solely automated decisions affecting your interests at contact@loadflight.com. We will provide appropriate information about the criteria and procedures, subject to commercial and industrial confidentiality.

6. Data before account creation
Protection also applies to people who start registration without completing it. Depending on the available flow, temporary registration data, confirmations, attempts, refusals and review referrals are processed even before an account is created. Sending a code does not mean verification or approval. Security records of rejected attempts may be retained to prevent abuse, handle review requests and exercise rights, under the retention criteria below.

7. Sharing and external services
We share necessary data with providers that enable the service: Supabase for authentication and databases; Resend for emails; Twilio when phone verification is used; Cloudflare for infrastructure and, if activated, Turnstile; website hosting; Google for public domain resolution, notifications, AI content and video features; Microsoft or ElevenLabs when used for speech; and map and geolocation providers, depending on the feature accessed. Xsolla and PayPal process payments and withdrawals; IVAO, VATSIM and SimBrief receive data needed for integrations you use. In Live Interaction, Woovi and Pusher may operate through the streamer's accounts. Services embedded on the website may receive IP and browser data. Turnstile, when activated, processes browser and device signals to combat automation and may require interaction. We do not sell personal data. We may also share data to comply with a legal duty or valid authority order.

8. International processing
Global infrastructure and providers may involve storage and processing outside Brazil, including Canada and the United States. Transfers are subject to applicable legal grounds and safeguards under data protection legislation. Information about providers and applicable mechanisms can be requested through our privacy contact. This policy does not claim that every provider has the same contract or location.

9. Purposes and legal grounds
Processing needed to provide the service and carry out requested registration steps relies, depending on the operation, on contract performance or preliminary procedures. Account protection and fraud prevention may rely on legitimate interests, subject to necessity, proportionality, expectations and individuals' rights. Legal obligations and the exercise of rights provide grounds for the corresponding operations. Where a feature depends on consent, specific authorization will be requested. Acknowledging this policy is not blanket consent for any use of data.

10. Retention and deletion
Account data are kept during the service relationship, subject to deletion requests and justified retention. Temporary registration and code delivery records follow operational expiry and cleanup periods; data retained for review, repeat abuse prevention, transactions or legal defense may have different durations. Retention must consider purpose, demonstrated necessity, legal periods and periodic review, without assuming unlimited storage of all data. Deleting an account does not mean immediate deletion of every financial or security record. You may request information about the data and periods applicable to your case. Backups may follow separate replacement cycles with restricted access.

11. Visibility and optional features
Your name, photo, network identifiers and results may appear in social features, rankings, career pages and events. Radar and Multiplay share simulated aircraft information during use. Support attachments, error screenshots, landing evidence and videos may contain personal data and should be submitted carefully. Recording, sharing, speech and integration features process data needed for the function used. Avoid including unnecessary third-party data.

12. Your rights
You may request confirmation of processing, access, correction, sharing information, anonymization, blocking or deletion of unnecessary data, portability where applicable, withdrawal of consent and review of automated decisions, under applicable legislation. Send requests to contact@loadflight.com. We may request proportionate proof of identity to avoid disclosing data to third parties. Where available, deletion can also be requested in account settings. Requesting review does not guarantee registration approval, but allows information and decisions to be challenged.

13. Protection, age and updates
We use technical and access controls to reduce the risks of loss, misuse and unauthorized access. No system provides absolute security. The service is intended for adults aged 18 or over; contact us if you identify improperly processed data of a minor. Material policy changes will be communicated through available service channels. The version and date identify the applicable text. Features being prepared, such as additional verification channels and Turnstile, will only be used when actually enabled.