The desktop application is designed to control the simulator locally. We do not sell personal data or use it for third-party behavioural advertising. Simulator-session content remains on your computer unless you deliberately submit it for support or enable a feature that clearly states it transfers data.
1. Scope and controller
Evolve Orbit FZC ("Evolve Orbit", "we", "us", or "our") is the controller of personal data processed for the FlightSim Control website, customer account, subscription, protected downloads, device activation, support, and desktop licensing service. This notice applies to visitors, account holders, subscribers, authorised organisational users, and people who contact us.
It does not govern Microsoft Flight Simulator, Stripe, Supabase, Vercel, Microsoft, aircraft providers, navigation services, weather services, or other independent third parties. Their own notices apply to data they control.
2. Data we collect
Account and identity data
Email address, account identifier, authentication method, authentication events, profile or organisation details you provide, salted password hash when you choose password sign-in, and hashed single-use verification or recovery-token records. We do not store your Google password or a readable copy of your FlightSim Control password.
Organisation and commercial-licensing data
Organisation name, business contact details, billing contact, team invitations, account roles, authorised-user status, licensed platforms, station quantity, activation allowance, locations or intended-use information you provide, order-form details, and administrative or entitlement audit events. An organisation may provide your business email and role when inviting or administering you.
Subscription and transaction data
Plan, price, currency, tax status, subscription status, renewal and cancellation dates, Stripe customer and transaction identifiers, invoices, refunds, disputes, and limited payment-method information such as card brand and last four digits. We do not receive or store complete payment-card numbers or card security codes.
Device and licence data
Device identifier, device name, operating-system and application version, activation and revocation times, last licence check, licence status, cryptographic key identifiers, and security or integrity events. We avoid collecting hardware details that are not needed for entitlement, compatibility, fraud prevention, or support.
Website and technical data
IP address, browser and device type, requested URL, timestamps, referring page, approximate region derived by infrastructure providers, security signals, and server logs. We do not currently use advertising trackers or build cross-site behavioural profiles.
Support and communication data
Name, email, request category, subject, platform, affected page or feature, product and simulator versions, aircraft/provider details, reproduction steps, expected and actual results, message, correspondence, diagnostic information, attachments you deliberately send, reference number, triage status, and the outcome of the request. Do not send passwords, complete payment details, licence keys, activation tokens, or personal data unrelated to the issue.
3. How data is collected
We collect data:
- directly from you when you register, subscribe, activate, download, report a problem, share feedback, request commercial licensing, or change account settings;
- automatically from the website, desktop licensing client, security controls, and service infrastructure;
- from Stripe about payment and subscription events;
- from an organisation that purchases or administers access for you; and
- from service providers where needed to investigate fraud, abuse, availability, or support issues.
4. How and why we use data
| Purpose | Typical data | Reason |
|---|---|---|
| Provide accounts, subscriptions, licences, and downloads | Account, subscription, device | Perform our contract and take requested pre-contract steps |
| Set up and administer commercial organisations and station licences | Organisation, role, business contact, station, entitlement | Contract, requested pre-contract steps, and legitimate interests in account administration |
| Process payment and maintain financial records | Transaction, invoice, tax | Contract and legal obligations |
| Secure the service and prevent misuse | Authentication, IP, device, logs | Legitimate interests, legal obligations, and protection of rights |
| Provide support, triage reports, and answer requests | Contact, diagnostics, reproduction details, correspondence | Contract, requested pre-contract steps, consent where appropriate, and legitimate interests |
| Maintain compatibility and improve reliability | Versions, errors, feedback, de-identified or aggregated usage | Legitimate interests in operating and improving the product |
| Send essential service notices | Email, account, subscription | Contract and legitimate interests |
| Comply with law and resolve disputes | Relevant account, transaction, logs, communications | Legal obligations and establishment or defence of claims |
Where consent is the appropriate basis, you may withdraw it at any time without affecting earlier lawful processing. We use support reports and feedback to respond, investigate, reproduce defects, improve security and compatibility, and develop the product. We do not use those submissions for unrelated marketing or publish your identity without permission. Essential messages about security, billing, legal changes, and service operation are not marketing and may continue while you use the service.
5. Local simulator data
FlightSim Control is designed so routine SimConnect communication, aircraft state, position, weather controls, failures, instructor inputs, and live session operation occur locally between the desktop application and the simulator. That information is not automatically uploaded to Evolve Orbit merely because you use the instructor station.
The Windows and macOS applications operate independently. Instructor commands and simulator state remain between the application and supported simulator interfaces on the same computer and are not routed through Evolve Orbit's cloud services.
A future optional cloud sync, remote instructor, analytics, or diagnostic feature must identify the data transferred and provide an appropriate control before it is enabled. It will not silently convert the local product into a remote-control service. If you attach a log, screenshot, session record, or configuration to a support request, the submitted copy becomes support data under this notice.
7. International transfers
Evolve Orbit is based in the United Arab Emirates and uses international cloud providers. Your data may therefore be processed in the UAE, European Economic Area, United Kingdom, United States, or other locations where a provider operates. Where applicable law requires it, we use recognised transfer safeguards such as contractual protections, adequacy mechanisms, or another lawful transfer basis.
8. Retention
We keep personal data only for the purpose and period reasonably required:
- account, password credential, and active-entitlement records: while the account is active and ordinarily up to 24 months after closure;
- unused or consumed verification and recovery records: ordinarily deleted shortly after expiry through routine cleanup;
- subscription, invoice, tax, refund, and transaction records: for the period required by applicable accounting, tax, payment, and anti-fraud law, ordinarily up to seven years;
- device and licence history: while active and ordinarily up to 24 months after revocation or account closure;
- organisation, team-role, commercial order, and entitlement records: while the organisation is active and ordinarily up to 24 months after closure, except transaction records retained for the longer accounting period;
- routine website and security logs: ordinarily up to 12 months, unless an incident or legal obligation requires longer;
- support correspondence and submitted diagnostics: ordinarily up to 24 months after the request closes; and
- legal claims, abuse, chargebacks, and consent records: for the applicable limitation, dispute, or compliance period.
We may retain de-identified information that can no longer reasonably identify you. Backup copies are deleted on their normal secure rotation schedule.
9. Security
We use administrative, technical, and organisational safeguards appropriate to the service, including TLS in transit, salted memory-hard password hashing, hashed and single-use recovery tokens, failed-attempt lockouts, session invalidation after password changes, restricted administrative access, provider security controls, signed and short-lived licence tokens, private release links, access logging, and separation of public and privileged credentials. Public installers will be code-signed before release.
No system is completely secure. You are responsible for securing your email account, computer, browser session, local network, simulator installation, and licence key. If you believe an account or the service is compromised, use our security reporting channel promptly.
10. Your rights and choices
Subject to applicable law and relevant exemptions, you may ask us to confirm whether we process your data and request access, correction, deletion, restriction, objection, portability, or withdrawal of consent. You may also cancel marketing communications, close your account, revoke devices, and manage subscription renewal.
If an organisation provides or administers your access, its authorised administrators may manage your organisation membership, role, and station access. They do not receive ownership of your personal data or unrestricted access to your private support correspondence. Contact us if organisation records about you are inaccurate or if access should be separated after your relationship with that organisation ends.
Submit a request through the privacy contact form. We may verify your identity and authority before acting. We aim to respond within 30 days, or within another period required by applicable law, and will explain any lawful extension or refusal. Rights may be limited where retention is required for transactions, security, legal obligations, another person's rights, or legal claims.
12. Children
FlightSim Control is a professional simulation tool intended for adults and organisations. It is not directed to children under 16, and subscriptions require an adult legally able to contract. If you believe a child has provided personal data without appropriate authority, contact us so we can investigate and delete it where required.
13. Changes
We may update this notice to reflect product, provider, security, or legal changes. We will publish the revised date and provide additional notice through the website, account, application, or email where a change materially affects your rights or our processing. The version in effect when data is processed governs that processing.
14. Contact and complaints
For privacy questions, rights requests, or complaints, use the privacy contact form or email support@flightsimcontrol.com with "FlightSim Control privacy" in the subject. You may also complain to the competent data-protection or consumer authority available under applicable law.