Last updated: October 7, 2026 · version 2026-10-07
Jet Tracker is an independent business aviation intelligence platform in Brazil, operated by Medralia Desenvolvimento de Software Ltda. (CNPJ 66.432.251/0001-53), the data controller under art. 5, VI of the LGPD. It is not affiliated with operators, brokers or MROs.
The platform displays public data obtained from official sources (RAB ANAC, FAA, Receita Federal (Brazil's Federal Revenue Service), NTSB, CENIPA), including owners' names, CNPJ, registration marks and owner state. This data is already publicly accessible in government records.
When the owner is a natural person, we display the data on record in the RAB ANAC and mask sensitive data (full CPF, residential address). The natural-person owner's name may appear as recorded in the public registry. The data subject may request correction, objection or removal at any time (section 8 and LGPD form).
The aircraft pages on the site, the partner API and the MCP connector (tools jt_aircraft_lookup, jt_aircraft_lookup_batch, jt_fleet_search, jt_owner_group, jt_operator_profile and jt_company_search) return registry data about who owns or operates aircraft. Part of it identifies natural persons: the name of an owner or operator who is a natural person and the name and role of company partners and officers (QSA). CPF (personal tax id), home address and personal contact details are not provided, and there is no search by a person's name.
Where this data comes from
Legal basis. This is publicly accessible personal data, made available by official bodies and processed in line with the purpose, good faith and public interest that justified its publication (LGPD art. 7, §3). Its use for market intelligence and transparency in the aviation sector relies on the legitimate interest of the controller and of third parties (art. 7, IX, and §7), after a proportionality assessment: we return registry data only, with no personal document, no home address and no profile of the person. Company data (legal name, CNPJ, business contact) is not personal data under the LGPD; where a company record carries data about a person (for example, an e-mail containing a personal name), it is handled as described in this section.
Correction and removal. Any named individual may request access, correction, objection or removal of their own name, with no account required: through the LGPD form or by e-mail to our data protection officer (suporte@medralia.com.br), stating the name and the registration mark or CNPJ where it appears. We respond within 15 days (art. 19). The site, the API and the MCP connector read the same database: whatever is corrected or removed stops being returned by all three. If the error is in the source record (ANAC or Receita Federal), we correct our copy and explain how to rectify it at the source.
We generate automated inferences about aircraft, operators and owners (e.g.: SPE detection, estimated value range, status flags). These are estimates based on heuristics and public data and subject to error, they do not assert any irregularity or misconduct. The data subject has the right to contest them and to request review (LGPD art. 18 and 20).
When you sign up by e-mail we collect name, e-mail, phone and a record of acceptance of the Terms. When you log in with Google we receive name, e-mail and profile photo, we do not receive your password or contacts. This data is used for authentication and communication about the platform. The use of Google data is also governed by the Google Policy.
If, while talking to Jet Copilot, you ask to speak with our team and provide your name and e-mail (and optionally a company), we record that contact along with a summary of your request, the page where the conversation happened and how you reached the site (source and campaign parameters). The purpose is to reply to your commercial enquiry and to understand which topics generate interest. The legal basis is your consent, given by providing the details after the notice shown in the assistant panel itself. The assistant only records the contact of the person talking to it, never third parties. You may request deletion at any time.
We collect aggregated usage metrics (pages, queries, device type, approximate city and traffic source) through a first-party measurement cookie (jt_vid). We do not use third-party advertising tracking cookies and your IP address is never stored in clear text: we keep only a hash. The legal basis is legitimate interest (art. 7, IX), subject to your right to object via the LGPD form. Conversations with the Jet Copilot and the dossiers generated are logged for security, support and service improvement, and may contain personal data that you enter or that appears in the consulted public record.
We do not sell personal data and we do not share it with third parties for advertising purposes. To operate the platform, we use service providers (data processors) that process data only in accordance with our instructions:
In particular, when you use the Jet Copilot or the Dossier, the content of your request (the text you write and the context of the conversation, which may include public data on aircraft, owners and operators) is sent to Anthropic PBC (United States), which acts as a data sub-processor solely to generate the response. We never send Anthropic your password, payment data or card data. The legal basis for this transfer is the performance of the contract (LGPD art. 7, V), as it is necessary to deliver the AI feature you invoke. This processing observes contractual safeguards under the Anthropic API Commercial Terms, whose default is to not use content submitted via the API to train models, with limited retention; we do not opt in to optional data-sharing programs. See the Anthropic privacy notice for details. The resulting international transfer is addressed in section 6. Additional sharing only occurs under legal obligation (court order, ANPD request).
AI connectors and partner API. You can connect Jet Tracker to AI assistants (for example claude.ai, ChatGPT or Cursor) and to your own systems through our MCP server and partner API. The assistant or system then acts on your behalf, with your login (OAuth) or an API key created in your account, and receives only what you ask for: the same data your account already sees on the site, under the same plan rules. We log each call (tool, date, volume) for quota, security and audit; we do not log the content of your conversation with the assistant, which stays with its provider under that provider's policy. You can revoke a connection or key at any time in Account, Connections. Personal tax IDs (CPF) are never provided through these channels, and there is no search by a person's name.
We use a small set of first-party cookies (none from advertising networks). Below is the complete list of what Jet Tracker stores in your browser and why.
| Cookie | What it does | Type |
|---|---|---|
NEXT_LOCALE, JT_LOCALE_CHOICE | Remembers the language you picked (Portuguese or English). | Essential |
sb-… (Supabase) | Keeps you securely signed in to your account. | Essential |
jt_vid | Random browser identifier used in our own audience metrics. Holds no name, e-mail or IP address. | Analytics |
jt_sid | Groups the pages of a single visit so we can measure navigation. Expires when the visit ends. | Analytics |
jt_ref | Records the referral code when you arrive through a partner link, so the referral is credited. | Functional |
jt_web_intro | Remembers that this browser has already seen the home page opening animation, so it does not play again. Its value is "1", it lasts 1 year and it does not identify you. | Functional |
Jet Tracker does not currently use advertising cookies and does not share your browsing with ad networks. Should that change, we will ask for your consent before any such cookie is stored, and this policy will be updated.
You can delete or block cookies in your browser settings. Blocking essential ones breaks sign-in and language switching; blocking analytics ones does not affect using the site.
The providers listed in section 4 (Supabase, Vercel, Anthropic, Stripe and Resend) process data on servers outside Brazil (United States). The international transfer observes the grounds of arts. 33 and 34 of the LGPD and relies on adequate contractual safeguards, such as contractual clauses incorporated into those providers' terms, as regulated by the ANPD (Resolution CD/ANPD No. 19/2024). When engaging each provider, we verify that processing is limited to our instructions and to the contracted purpose.
The platform is intended for persons over 18 and for a professional (B2B) audience. We do not intentionally collect account data from children and adolescents (LGPD art. 14). As for displayed public data that may incidentally involve minors (a rare situation), we apply the best-interest standard and prioritize removal or masking upon request.
You have the right to:
Use the LGPD form to exercise any of these rights. We respond within 15 days (art. 19). Deletion is reflected immediately in the active systems and in the internal caches (dossiers, enrichments); backups are overwritten within the retention cycle (up to 30 days), after which the data is no longer restorable.
The data is kept on Supabase infrastructure (PostgreSQL with Row Level Security) and Vercel. Authentication uses Supabase Auth (OAuth 2.0) and administrative access is restricted. Access logs to natural-person data are retained for 12 months; records of AI conversations/dossiers are retained for the period necessary for security and support and are then deleted or anonymized. We keep account data for as long as the account is active. Contacts shared with Jet Copilot are kept while there is an active commercial interest and for at most 24 months from collection, unless you request deletion sooner.
This policy may be updated. Material changes will be communicated with a new date and version at the top of this page.
For data protection matters or to exercise LGPD rights, contact our officer (Encarregado de Proteção de Dados, Jet Tracker): suporte@medralia.com.br