Privacy Policy

This portal is run by the Air Traffic Controllers Guild (India) (“the Guild”, “we”), T-1/7, Pocket-B, INA Colony, New Delhi 110 023, India. For the personal data described here the Guild is the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (“DPDP Act”).

Contact for anything in this policy, including grievances: website.atcguild@gmail.com.

• From your Google sign-in: your name, Gmail address, profile photo and Google account id. We never see or store your Google password.
• Your profile: full name, employee number, station of posting, year of joining, AAI email id, mobile number, bio and photo.
• AAI verification: the AAI email id you verified, when you verified it, and a record of verification attempts (time, success or failure) used to stop guessing.
• What you create: posts, comments, reactions, issues you support, private concerns and their updates, form responses, and files or photos you upload.
• Document access records: each time you open or download a document from the library — which document, when, whether it was opened or downloaded, your IP address and browser, and the reference code of the personalised copy you received.
• Records of actions by office bearers and admins (an audit log: who added, changed or removed content or access, and when).
• Technical data: the sign-in session cookie (see the Cookie Policy) and standard server logs kept by our hosting providers (IP address, browser type, time of request) for security and troubleshooting.

For roster purposes the Guild also keeps a list of Air Traffic Controllers of AAI — AAI email id, name, employee number, place of posting and designation — taken from AAI's ATCO list or entered by authorised office bearers, so that only ATCOs can join and each one can be mailed a one-time verification code. Nothing else from that list (such as date of birth or mobile number) is kept.

• to confirm, once, that you are an Air Traffic Controller of AAI before giving access;
• to run the members' area — feeds, issues, private concerns, forms, documents and galleries;
• to let office bearers act on concerns and issues and to contact members about guild matters;
• to keep the portal secure, prevent misuse and investigate incidents — including tracing a leaked guild document back to the account it was opened or downloaded from;
• to meet legal obligations.

We rely on your consent, given when you sign up and accept these terms, and on the legitimate uses the DPDP Act allows (such as security). We do not sell your data, do not show advertising and do not use your data for profiling or marketing.

• Other verified members can see your profile (name, photo, station, year of joining, guild role, employee number, emails and mobile number) and anything you post publicly in the members' area. Please keep this in mind when completing your profile.
• Private concerns are visible only to you and the guild team of the body you sent it to — or, if you sent it to one office bearer, only to you and that person.
• Form responses are visible to you and to the people who manage that form.
• Document access records are visible to you (your own) and to the Admins and the Super Admin, who use them only to protect guild documents and investigate a suspected leak.
• The AAI email list is visible to Admins, Content Managers and Airport Admins, who can ask the website to mail a person's code (and see when it was sent). The one-time codes themselves are visible only to the Super Admin; the website puts each code straight into the mail.
• The public (not signed in) sees only the public pages: home, About (including office bearers' names with their AAI email and Gmail, as published by the Guild), Live METAR, External Links, Contact and these policies.

We use a small number of service providers who process data only on our instructions:

• Supabase — database, sign-in sessions and file storage, hosted in the Mumbai (India) region.
• Vercel — website hosting; server functions run in Mumbai, with a global delivery network.
• Google — “Sign in with Google”, and the guild's Gmail account that sends verification codes.

Live METAR data comes from the US NOAA Aviation Weather Center; no personal data is sent to it. Videos in the Video Gallery may be played from YouTube (privacy-enhanced mode), Vimeo or Google Drive, which apply their own policies when you press play.

• All traffic is encrypted (HTTPS with HSTS); providers encrypt stored data.
• Every table is protected by row-level access rules in the database itself, so a member can only read what they are allowed to — not just what the pages show.
• Files sit in private storage and open only through short-lived (one-hour) signed links, after a fresh membership check. PDF documents carry a Guild watermark, and every PDF a member opens or downloads is a personalised copy: it shows the member's name, employee number, date and a reference code, carries hidden tracing marks, and the access is recorded.
• Admin actions are recorded in an audit log; permanent deletion is limited to the Super Admin.

Your part: you sign in with your own Google account, so its security protects your access. Turn on Google 2-Step Verification, never share your account, and if your Gmail account is ever compromised, inform the admin immediately at website.atcguild@gmail.com so we can unlink that Gmail from this website. You can then verify again with a new account.

If a personal data breach occurs we will inform affected members and the Data Protection Board of India as the DPDP Act requires.

Document access records are kept for up to three years. We keep your other data while you are a member. If you ask us to delete your account we will remove or anonymise your personal data within 30 days, except where we must keep something longer — for example audit records of admin actions, or content that forms part of a guild record (such as a concern's action log), which we keep without unnecessary personal details. Deleted portal content sits in a recycle bin until the Super Admin removes it permanently.

Under the DPDP Act you can:

• ask for a summary of the personal data we hold about you and how it is used;
• correct or update it (most fields you can edit yourself on your profile);
• ask us to erase it, and withdraw your consent (this ends your access to the members' area);
• nominate someone to exercise these rights if you are unable to;
• raise a grievance with us, and if unresolved, complain to the Data Protection Board of India.

Write to website.atcguild@gmail.com from the email linked to your account. We reply within 30 days.

The portal is meant only for working Air Traffic Controllers and is not intended for anyone under 18.

If we change this policy in a way that matters, we update the date above and ask every member to accept the new version the next time they sign in.