RLOS Privacy Policy

Last updated: 15 October 2026

This policy describes how RLOS processes personal data under Regulation (EU) 2016/679 (GDPR).

1. Controller

• For account data, analyses saved in personal spaces, billing and security, the controller is the operator of RLOS, who is also the operator of ZENIO: RLOS uses the ZENIO account and infrastructure. The identification details (name, registered office, tax or VAT number, contact of the data protection officer if appointed) are those given in the ZENIO privacy policy. Contact: [email protected].
• In an organisation's space (Enterprise team plan or company space of the other services), the organisation is the controller of the saved analyses. We process them on its behalf (Art. 28 GDPR) under the data processing agreement.

2. Data we process

• Free version:
  • the page contacts the map and place-search services directly (point 6), which see your IP address;
  • for usage statistics we receive the event type, the parameters and the analysed location with its address;
  • we do not receive your device location, your IP address or browser data.
• Account: email, name, profile picture if you sign in with Google, password hash if you use email and password, second factor if enabled, language.
• Saved analyses: name and notes, analysed location (coordinates), parameters, results, date and time, author, organisation, fingerprint; attached PDF and KMZ files.
• FlightHub 2 (Enterprise): organisation key (encrypted), project and mission names, mission files, dock positions, annotations created.
• Payments: processed by Paddle as an independent controller. We only receive the outcome, the plan and a customer identifier; no card data passes through us.
• Technical data: access and security logs (IP address, browser type), kept for 30 days.

3. Purposes and legal bases

• Contract (Art. 6(1)(b)): account, saving, verification, export, FlightHub 2.
• Legal obligation (Art. 6(1)(c)): tax obligations (through Paddle), requests from authorities.
• Legitimate interest (Art. 6(1)(f)):
  • security and abuse prevention;
  • usage statistics of the Free version;
  • keeping the trace of deleted analyses, so that PDFs already handed over can still be verified.
• Consent (Art. 6(1)(a)), which you can withdraw: optional marketing communications.

4. Retention

• Analyses: 2 years from creation, then automatic deletion. After any deletion, the identifier, fingerprint, dates and the author and organisation names are kept.
• Account: until it is closed.
• FlightHub 2 mission files not used in an analysis: 24 hours.
• Technical logs: 30 days.

5. Public verification

• The verification page shows date, parameters, fingerprint, organisation name and status of the analysis, but neither the analysed location nor the author. Without the complete link it returns nothing.
• The PDF, instead, contains the map, the analysed location and the author: anyone who receives it sees them, and the user decides whom to give it to.

6. Recipients and transfers

• Providers processing data on our behalf:
  • application and database hosting;
  • object storage for PDF and KMZ files;
  • Cloudflare, for website hosting;
  • Brevo, for sign-in emails;
  • Telegram, for internal usage notifications of the Free version.
• Independent controllers, or services contacted directly by your browser:
  • Google (sign-in);
  • Paddle (payments);
  • DJI FlightHub 2 (with your organisation's key);
  • OpenFreeMap and OpenMapTiles (map);
  • Geoapify and OpenStreetMap Nominatim (place search);
  • AWS Terrain Tiles (terrain).
• The up-to-date list of the providers of the shared infrastructure, with purpose, data, place of processing and safeguards, is on the ZENIO sub-processors page.
• Transfers outside the EEA take place only with appropriate safeguards: adequacy decisions, the EU-U.S. Data Privacy Framework or standard contractual clauses.

7. Your rights

• You can request access, rectification, erasure, restriction, objection and portability (Arts. 15-22 GDPR) by writing to [email protected]. You can also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).
• We handle requests within one month, including after cancellation, when the in-app archive is no longer accessible.
• For analyses saved in an organisation's space, we refer you to the organisation and help it respond.

8. Cookies and local storage

• Only the browser's local storage needed for the session and preferences (for example the language). No profiling cookies and no behavioural analytics.

9. Minors and changes

• RLOS is not intended for children under 16.
• The date of the last update is at the top of the page; material changes are announced in the application.