Legal

Privacy Policy

Draft template, not legal advice; have a lawyer review before use. This document is a starting-point draft for AviWare. Bracketed items (for example [Company LLC], [State], [Address], [Email], [Effective Date]) are placeholders that must be completed or confirmed, and the subprocessor list must be checked against the services actually in use. State privacy laws change often and their applicability depends on your size and facts, so a licensed attorney should review this before it is published or relied on.

Effective Date: [Effective Date] | Last Updated: [Last Updated Date]

This Privacy Policy explains how [Company LLC], a [State] limited liability company doing business as AviWare ("AviWare," "we," "us," or "our"), collects, uses, shares, and protects information in connection with the AviWare website at aviware.com and the AviWare flight school management platform (together, the "Service").

1. Summary in Plain English

  • AviWare is business software for flight schools and flying clubs ("Schools"). Schools decide what information goes into the Service about their students, instructors, staff, and aircraft.
  • For that school-provided information, the School is in charge (the "controller") and AviWare acts as its service provider (the "processor"). If you are a student or instructor, your School's privacy practices also apply to you, and you should contact your School first with privacy requests.
  • We do not sell personal information, and we do not share it for cross-context behavioral (targeted) advertising.
  • We use trusted providers to run the Service, such as Vercel, Supabase, and Stripe. They are listed in Section 8.
  • We keep data while a School's subscription is active and delete it after cancellation and a short export window, as explained in Section 10.

2. Who This Policy Covers and Our Role

2.1 School Data (AviWare as Processor)

Most information in the Service is entered or uploaded by a School and its users about the School's students, instructors, staff, renters, and aircraft ("School Data"). We process School Data on behalf of the School and under its instructions, as described in our Terms of Service and any Data Processing Addendum with the School. For School Data, the School is responsible for providing any required privacy notices to its students and staff, obtaining any needed consents (including parent or guardian consent for minors where required), and responding to individuals' privacy requests. We help Schools do this as described in Section 12.

This Privacy Policy describes how AviWare handles School Data as a processor, but it does not describe the School's own practices. Please review your School's privacy notice or contact your School for that information.

2.2 AviWare Business Data (AviWare as Controller)

AviWare is the controller for a smaller set of information that we collect for our own business purposes, such as: contact and account information for School owners and administrators; billing information for the School's AviWare subscription; information from visitors to aviware.com; sales, support, and marketing communications; and technical and usage data we use to secure and improve the Service.

2.3 Business-to-Business Service

The Service is offered only to organizations, not to consumers for personal use. Individuals use the Service only as Authorized Users of a School account.

3. Information We Collect

3.1 Information Schools and Their Users Provide

Depending on how a School uses the Service, School Data may include:

  • Identity and contact information: name, email, phone number, mailing address, date of birth, emergency contact, user role, and profile photo.
  • Student training records: enrollment information, course and syllabus progress, lesson and stage check records, ground and flight training records, test results, and other records Schools maintain under 14 CFR 141.101 or 14 CFR Part 61.
  • Flight logs: dates, aircraft, routes, flight times, landings, approaches, and instructor and student remarks.
  • Endorsements: instructor endorsements and related signatures and dates.
  • Instructor and pilot records: certificate numbers, ratings, CFI certificate expiration, flight review and currency dates, and medical certificate class and expiration dates.
  • Uploaded and scanned documents: for example, government-issued photo IDs, pilot and medical certificates, passports, birth certificates, or other proof of U.S. citizenship collected for TSA flight training security requirements, student pilot certificates, knowledge test reports, and other documents the School chooses to upload.
  • Aircraft and maintenance records: aircraft identification, hours and tach/Hobbs times, inspection due dates, airworthiness directive tracking, squawks, and maintenance entries.
  • Billing and account records between the School and its students: invoices, account balances, payment history, and the last four digits and type of a payment card. Full card numbers are collected and stored by Stripe, not by AviWare.
  • Messages and notes: communications sent through the Service, error flags submitted by students, and notes entered by staff.

3.2 Information We Collect Directly (AviWare Business Data)

  • Account and subscription information: the name, title, email, and phone number of School owners and administrators; School name, address, and certificate type (for example Part 141 or Part 61); plan selection and aircraft count.
  • Subscription billing information: collected and processed by Stripe on our behalf. We receive limited details such as billing contact, card type, last four digits, and payment status.
  • Support and communications: information you share when you contact us, request a demo, take a survey, or join a beta.

3.3 Information Collected Automatically

When anyone uses the Service or visits aviware.com, we and our providers automatically collect certain technical information, such as IP address, browser and device type, operating system, pages and features used, date and time of access, referring URL, approximate location derived from IP address, and error and diagnostic logs. We also keep audit logs of key actions in the Service (for example, who created or changed a training record and when) to support security and record integrity. See Section 9 for information about cookies.

3.4 Information From Third Parties

We may receive information from Stripe (such as payment status, payouts, and identity verification results for Schools' connected accounts), from Schools when they invite users, and from integrations a School chooses to enable.

3.5 Sensitive Personal Information

Some School Data is considered "sensitive personal information" under certain state laws, such as government ID numbers, passport information, citizenship or immigration status documents, medical certificate information, and account login credentials. We process this information only to provide the Service as directed by the School (for example, to store a document the School must keep for TSA or FAA purposes, or to send a medical expiration reminder). We do not use sensitive personal information to infer characteristics about individuals, and we do not use it for advertising.

4. How We Use Information

We use information to:

  • provide, operate, and maintain the Service, including storing records, generating reports, sending reminders and alerts, and preparing FAA document packages at a School's request;
  • process payments and subscription billing through Stripe, including calculating AviWare's application fee;
  • authenticate users, enforce role-based permissions, and keep audit logs;
  • provide customer support and respond to requests;
  • send service-related messages, such as security alerts, billing notices, and changes to our terms;
  • send product updates or marketing emails to School contacts (you can opt out at any time; we do not send marketing to students on behalf of AviWare);
  • monitor, secure, debug, and improve the Service, including through aggregated and de-identified analytics;
  • detect and prevent fraud, abuse, and security incidents; and
  • comply with legal obligations, enforce our agreements, and protect rights and safety.

We process School Data only for these purposes as needed to provide the Service to the School, or as the School otherwise instructs. We do not use School Data to build profiles for advertising, and we do not use it to train general-purpose artificial intelligence models offered to others. [Attorney/owner to confirm whether any AI features will be offered and update this statement accordingly.]

5. How We Share Information

We share information only as described below:

  • With the School and its authorized users. School Data is visible to the School's users according to the roles and permissions the School sets. Students can see their own records.
  • With service providers (subprocessors). We share information with vendors that help us run the Service, under contracts that require them to protect it and use it only to provide services to us. See Section 8.
  • With Stripe for payments. Payment information is shared with and processed by Stripe under Stripe's own privacy policy (stripe.com/privacy).
  • With the FAA or other recipients at the School's direction. If a School chooses to send a document package or record to the FAA, an examiner, an insurer, or another party, we transmit or make available that information on the School's instruction. AviWare does not send records to the FAA on its own initiative and is not affiliated with the FAA.
  • For legal reasons. We may disclose information if we believe in good faith that it is required by law, subpoena, or court order, or needed to protect the rights, property, or safety of AviWare, our users, or others. Where legally allowed and practical, we will notify the affected School before disclosing School Data and will direct requests for School Data to the School.
  • In a business transfer. If AviWare is involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction, subject to this Privacy Policy and the commitments made to Schools.
  • With consent. We may share information for other purposes with the School's consent or direction.

6. We Do Not Sell or Share Personal Information for Targeted Advertising

AviWare does not sell personal information, and has not sold personal information in the past 12 months. We do not "share" personal information for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act and similar state laws. We do not knowingly sell or share the personal information of anyone under 16.

7. Students and Minors

Flight training students may be as young as 16, so a School may enter information about students who are under 18. The Service is designed for use by Schools, and Schools are responsible for obtaining any parent or guardian consent required by law or their own policies before adding a minor to the Service. Student accounts are view-only and allow students to flag suspected errors for the School to review.

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If we learn that we have collected such information, we will work with the School to delete it. If you believe a child under 13 has provided information to us, please contact us at [Email].

8. Subprocessors and Service Providers

We currently use the following subprocessors to provide the Service. We may update this list over time and will post changes here [and notify School account owners in advance as described in our Terms of Service].

  • Vercel Inc. (United States): application hosting, content delivery, and serverless functions. Processes all categories of School Data in transit and request logs.
  • Supabase, Inc. (United States; infrastructure hosted on Amazon Web Services in [region, e.g., us-east-1]): database, user authentication, and file storage for uploaded documents. Processes all categories of School Data.
  • Stripe, Inc. (United States): subscription billing and Stripe Connect payment processing for Schools. Processes payment, billing, and identity verification data.
  • [Email delivery provider, e.g., Resend / Postmark / SendGrid] (United States): transactional emails such as invitations, reminders, and notices. Processes names, email addresses, and message content.
  • [Error monitoring provider, e.g., Sentry] (United States): error and performance monitoring. Processes technical data and limited user identifiers.
  • [Analytics provider, if any, e.g., Vercel Analytics / PostHog] (United States): product usage analytics. Processes technical and usage data.
  • [Support / help desk tool, if any] (United States): customer support communications.

Owner note: confirm each vendor, region, and data category before publishing, and remove any placeholder rows that do not apply.

9. Cookies and Similar Technologies

We use cookies and similar technologies (such as local storage) on aviware.com and in the Service:

  • Strictly necessary cookies keep you signed in, remember your session, protect against cross-site request forgery, and enforce security. The Service cannot work without them.
  • Preference cookies remember settings such as your selected School, time zone, or display options.
  • Analytics help us understand how the website and Service are used so we can improve them. Where possible, we use privacy-friendly analytics that do not track you across other websites. [Owner to confirm tools used.]

We do not use advertising or cross-site tracking cookies, and we do not allow third parties to use cookies on the Service for targeted advertising. You can control cookies through your browser settings, but blocking strictly necessary cookies will prevent you from signing in.

Global Privacy Control and Do Not Track. We honor Global Privacy Control (GPC) signals as a request to opt out of sale or sharing where required by law. Because we do not sell or share personal information for targeted advertising, a GPC signal does not change how the Service works. There is no common standard for "Do Not Track" browser signals, so we do not respond to them separately.

10. Data Retention, Export, and Deletion

10.1 While a Subscription Is Active

We keep School Data for as long as the School keeps its subscription active, unless the School deletes it sooner. Schools control the retention of their records and can delete or export data using the tools in the Service.

10.2 After Cancellation

When a School cancels, it has [30] days after the end of its subscription to export its data (the "Export Window"). After the Export Window, we delete or de-identify School Data from our active systems within [60] days. Backup copies are overwritten in our normal backup cycle, currently about [30] days, and stay protected until then.

10.3 Records Schools Must Keep

Federal aviation regulations require Schools and instructors to keep certain records for specific periods. For example, 14 CFR 141.101 requires Part 141 schools to keep student training records for at least one year after the student completes or leaves training; 14 CFR 61.189 requires flight instructors to keep endorsement records for at least three years; and 14 CFR 91.417 sets retention periods for aircraft maintenance records. TSA rules (49 CFR Part 1552) also require Schools to keep certain citizenship verification records. Each School is responsible for meeting these requirements, including by exporting and keeping its records before its Export Window ends.

10.4 AviWare Business Data

We keep account, billing, and support records for as long as needed for the purposes described in this Policy, and for longer where needed for tax, accounting, legal, or dispute resolution purposes (generally up to [7] years for financial records). Server and security logs are generally kept for up to [90] days unless needed to investigate an incident.

11. How We Protect Information

We use reasonable administrative, technical, and physical safeguards appropriate to the sensitivity of the data we handle, including:

  • encryption of data in transit using TLS, and encryption at rest provided by our hosting and database providers;
  • role-based access controls within the Service, including view-only student access;
  • database security controls (such as row-level security) designed to keep each School's data separate from other Schools' data;
  • restricted, logged access to production systems for AviWare personnel, limited to what is needed for support and operations;
  • private storage for uploaded documents, with access through time-limited, authenticated links;
  • support for strong passwords and [multi-factor authentication]; and
  • regular backups and vendor security review.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we learn of a security incident that affects School Data, we will notify the affected School without undue delay so it can meet its own obligations, and we will notify individuals and regulators where the law requires us to do so.

12. Your Privacy Choices and Rights

12.1 Students, Instructors, and Staff of a School

If your information is in the Service because of your relationship with a School, the School controls that information. Please send requests to access, correct, delete, or export your information to your School. Students can also use the "flag an error" feature to ask the School to correct a record. If you contact us directly, we will forward your request to your School (where we can identify it) and help the School respond. Please note that a School may be legally required to keep certain training, endorsement, maintenance, or TSA records even if you ask for deletion.

12.2 State Privacy Rights

Depending on where you live, you may have rights under state privacy laws, such as the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA), and laws in states such as Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and others. Some of these laws may not yet apply to AviWare based on its size, and some include exemptions for business-to-business information, but we aim to honor the following rights for AviWare Business Data:

  • Right to know / access: to request the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties we disclose it to.
  • Right to delete: to request deletion of personal information we collected from you, subject to legal exceptions.
  • Right to correct: to request correction of inaccurate personal information.
  • Right to portability: to receive a copy of your information in a portable format.
  • Right to opt out of sale, sharing, targeted advertising, and certain profiling: we do not do these things, but you may still submit a request.
  • Right to limit use of sensitive personal information: we use sensitive personal information only for permitted purposes, such as providing the Service.
  • Right to non-discrimination: we will not treat you differently for exercising your rights.

How to submit a request. Email [Email] with the subject line "Privacy Request," or write to us at [Address]. We will verify your request by matching information you provide with information we have, and we may ask for more information to confirm your identity. You may use an authorized agent; we may ask for proof of the agent's authority and confirm your identity directly. We will respond within the time required by law (generally 45 days, with a possible extension).

Appeals. If we deny your request, you may appeal by replying to our response or emailing [Email] with the subject line "Privacy Appeal." If you are not satisfied with the outcome, you may contact your state Attorney General.

12.3 California Notice at Collection

In the past 12 months, we have collected the following categories of personal information (as defined by the CCPA), from the sources and for the purposes described in Sections 3 and 4, and disclosed them for business purposes to the service providers described in Sections 5 and 8. We have not sold or shared any of them.

  • Identifiers: name, email, phone, postal address, IP address, account username.
  • Customer records (Cal. Civ. Code 1798.80(e)): contact, billing, and pilot and medical certificate information.
  • Protected classification characteristics: age or date of birth, and citizenship status (from documents a School uploads for TSA compliance).
  • Commercial information: subscription, invoice, and payment history.
  • Internet or network activity: usage, log, and device data.
  • Professional or education-related information: training records, flight logs, endorsements, instructor ratings and currency. [Attorney to review whether flight training records are treated as education records under any applicable law.]
  • Sensitive personal information: government ID and passport numbers, citizenship documents, medical certificate information, and account login credentials.

Retention periods are described in Section 10.

12.4 Marketing Emails

You can opt out of AviWare marketing emails at any time by clicking "unsubscribe" in any marketing email. We will still send service-related messages.

13. Where Information Is Stored

AviWare is based in the United States, and the Service is intended for Schools in the United States. Information is stored and processed in the United States by us and our subprocessors. If you access the Service from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your country.

14. Links to Other Services

The Service and our website may link to third-party websites or services, such as Stripe, the FAA, or the TSA. We are not responsible for the privacy practices of those third parties, and we encourage you to read their privacy policies.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify School account owners by email or in the Service before the changes take effect, and update the "Last Updated" date above. We will not make material changes that reduce protections for School Data already collected without notice and, where required, consent.

16. Contact Us

If you have questions about this Privacy Policy or our privacy practices, contact us at:

[Company LLC] (AviWare)

Attn: Privacy

[Address]

Email: [Email]

Website: aviware.com