AerialLegal

Version 2026-10-14 · Terms of Service · Privacy Policy

Data Processing Addendum

Effective date: October 10, 2026

Last updated: November 6, 2026

---

This Data Processing Addendum (this “DPA”) is between Aerial Flight Management System LLC, an Illinois limited liability company, 730 N Milwaukee Ave, Chicago, IL 60642 (“Aerial,” “we,” or “us”), and the flight school, club, or other organization that accepts the Terms of Service for an Organization (the “Customer”). It forms part of, and is incorporated into, the Terms. The Customer accepts this DPA when it accepts the Terms for an Organization, including when it creates an Organization in the Service. Capitalized terms not defined here have the meaning in the Terms.

---

1. Definitions

  • “Applicable Data Protection Law” means all U.S. federal and state laws that apply to the processing of Customer Personal Data under the Terms, including, where applicable, the California Consumer Privacy Act as amended by the California Privacy Rights Act and its regulations (the “CCPA”), other U.S. state comprehensive privacy laws, and the Illinois Personal Information Protection Act (815 ILCS 530) (“PIPA”).
  • “Customer Personal Data” means personal data contained in Organization Data that Aerial processes on the Customer’s behalf in providing the Service.
  • “Controller,” “processor,” “business,” “service provider,” “data subject,” “personal data,” “processing,” “sell,” and “share” have the meanings given in Applicable Data Protection Law. “Personal data” includes “personal information.”
  • “Data Subject Request” means a request from a data subject to exercise a right under Applicable Data Protection Law about Customer Personal Data.
  • “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data while it is in Aerial’s or its Subprocessors’ systems.
  • “Subprocessor” means a third party Aerial engages to process Customer Personal Data on Aerial’s behalf.

---

2. Scope and roles

2.1 Customer as controller. The Customer is the controller (and the business) of Customer Personal Data. It decides which personal data about its members, students, instructors, staff, and other individuals is entered into the Service, who in the Organization can see it, and how long it is kept.

2.2 Aerial as processor. Aerial processes Customer Personal Data as the Customer’s processor (and service provider), on the Customer’s behalf and under this DPA.

2.3 Aerial as independent controller. Aerial is an independent controller, and not the Customer’s processor, for personal data it processes for its own purposes: user account and sign-in data, its own billing of the Customer and of individuals for subscriptions, security, fraud prevention, and audit logs, records of legal acceptances and authorizations, compliance with law and enforcement of the Terms, aggregated or de-identified data created under the Terms, and personal logbook data individuals keep outside an Organization. The Privacy Policy describes that processing.

2.4 Student payments. Where the Customer collects payments from students through Stripe Connect, the Customer and Stripe process the related payment data under their own agreement (the Stripe Services Agreement). Aerial processes the limited payment information it receives as described in the Terms and this DPA.

---

3. Processing instructions

3.1 Instructions. Aerial will process Customer Personal Data only on the Customer’s documented instructions. The Terms, this DPA, and the Customer’s configuration and use of the Service (including the settings, roles, and permissions its users choose) are the Customer’s complete instructions. Additional instructions require a written agreement between the parties.

3.2 Unlawful instructions. Aerial will tell the Customer if, in its opinion, an instruction violates Applicable Data Protection Law. Aerial is not required to follow such an instruction.

3.3 Legal requirements. Aerial may process Customer Personal Data where required by law. In that case, Aerial will tell the Customer before processing unless the law prohibits it.

3.4 Customer responsibilities. The Customer is responsible for the lawfulness of its instructions and of the personal data it enters, for giving its members any notices and obtaining any consents required by law (including for sensitive data such as medical, identity, and citizenship documents), for meeting the age requirement in Terms Section 2.1 for the individuals it invites, and for configuring roles and permissions appropriately.

---

4. Details of the processing

4.1 Subject matter and nature. Hosting, storing, organizing, displaying, transmitting, backing up, and deleting Customer Personal Data to provide the Service described in the Terms.

4.2 Purposes. Providing, securing, supporting, and maintaining the Service for the Customer, including scheduling, dispatch and check-in, training records and logbooks, endorsements, fleet and maintenance records, member documents, notifications and email, reporting, data import and export, and student invoicing where the Customer enables it.

4.3 Categories of data subjects. The Customer’s owners, administrators, staff, instructors, students, renters, and members; individuals invited to join the Organization; and emergency contacts and other individuals whose information the Customer’s users enter.

4.4 Categories of personal data.

  • Identity and contact information: names, email addresses, phone numbers, addresses, dates of birth, and employee or student numbers
  • Membership information: roles, locations, permissions, and school notes
  • Aviation and training information: certificate numbers and ratings, total hours, logbook entries, lesson grades and progress, endorsements, electronic signature details, schedules, flight requests, dispatch and check-in records, meter readings, squawks, and maintenance records entered by users
  • Billing information: invoices, payment status, payment-processor identifiers, and saved-card brand, last four digits, and expiration month and year (never full card numbers or security codes)
  • Uploaded documents and related dates
  • Emergency contact details
  • Technical information: IP address, browser user agent, and log and audit data about use of the Service

4.5 Sensitive personal data. If the Customer or its users enter them: pilot certificate details; medical certificate class and expiry and medical certificate documents; government identification and citizenship documents (including evidence a flight training provider may collect under 49 CFR Part 1552); dates of birth; and accident or enforcement history. Aerial does not collect or process biometric identifiers or biometric information. Within an Organization, government identification and citizenship documents are available only to roles that hold a dedicated permission (by default, owners, administrators, and chief instructors), and each download of a member document is logged.

4.6 Duration. For the term of the Customer’s use of the Service and until deletion under Section 11.

---

5. Confidentiality of personnel

Aerial will ensure that its personnel and contractors authorized to process Customer Personal Data are bound by appropriate obligations of confidentiality, access it only as needed to provide, secure, and support the Service, and receive instruction appropriate to their role.

---

6. Security

Aerial will implement and maintain the technical and organizational measures described in Annex 1, which are designed to protect Customer Personal Data against Personal Data Breaches. Aerial may update these measures if the update does not materially reduce the overall protection of Customer Personal Data. The Customer is responsible for the security of its own accounts, devices, and credentials, and for the roles and permissions it grants.

---

7. Subprocessors

7.1 Authorization. The Customer authorizes Aerial to engage the Subprocessors listed in Annex 2. Aerial will have a written agreement with each Subprocessor that imposes data protection obligations no less protective of Customer Personal Data than those in this DPA, to the extent applicable to the services the Subprocessor provides. Aerial remains responsible for its Subprocessors’ performance of those obligations.

7.2 Notice of changes. Aerial will update Annex 2 and notify the Customer by email to the Organization’s owners or in the Service at least 30 days before a new Subprocessor begins processing Customer Personal Data, except where a shorter period is needed to address an emergency or a Subprocessor’s sudden unavailability, in which case Aerial will notify the Customer as soon as reasonably practicable.

7.3 Objection. The Customer may object to a new Subprocessor on reasonable data-protection grounds by emailing contact@flyaerial.app within the notice period. The parties will discuss the objection in good faith. If Aerial cannot reasonably address it, the Customer may terminate the affected part of the Service by written notice and receive a refund of any prepaid Fees for the period after termination; this is the Customer’s sole remedy for the objection.

---

8. Assistance with Data Subject Requests

The Service lets the Customer’s authorized users view, correct, export, and delete much of the Customer Personal Data in it (subject to Terms Section 8.5 while the Customer’s account is read-only). If Aerial receives a Data Subject Request about Customer Personal Data, Aerial will, where the law allows, refer the data subject to the Customer or forward the request to the Customer, and will not respond to it except to confirm the referral or as the law requires. Taking into account the nature of the processing, Aerial will provide reasonable assistance to help the Customer respond to Data Subject Requests that the Customer cannot handle through the Service. Aerial will also provide reasonable information the Customer needs for any data protection assessment Applicable Data Protection Law requires of it. Aerial may charge a reasonable fee for assistance that goes beyond what the Service provides, where the law allows.

---

9. Personal Data Breaches

9.1 Notice. Aerial will notify the Customer of a Personal Data Breach without undue delay, and in any case within 72 hours after Aerial confirms the Personal Data Breach where feasible, by email to the Organization’s owners. Where Aerial maintains or stores Customer Personal Data that the Customer owns or licenses, Aerial’s notice is intended to meet the requirement of PIPA (815 ILCS 530/10(b)) that a data maintainer notify the owner or licensee of the data immediately after discovering a breach.

9.2 Content. To the extent known, the notice will describe the nature of the Personal Data Breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures Aerial has taken or proposes to take. Aerial may provide information in stages as it becomes available.

9.3 Cooperation. Aerial will take reasonable steps to contain and remediate the Personal Data Breach and will reasonably cooperate with the Customer so it can meet its own notification obligations to individuals and regulators. Unless the law requires otherwise, the Customer decides whether and how to notify its members about a Personal Data Breach affecting Customer Personal Data. Aerial’s notice of a Personal Data Breach is not an admission of fault or liability.

---

10. Audits and information

On the Customer’s written request, no more than once a year (or after a Personal Data Breach, or when a regulator requires it), Aerial will provide information reasonably necessary to demonstrate its compliance with this DPA, in the form of written responses to a reasonable security or privacy questionnaire and relevant documentation of its practices. If that information is not enough to meet a requirement of Applicable Data Protection Law, the parties will agree in good faith on any further reasonable review, including its scope, timing, duration, and confidentiality. All audits and reviews are at the Customer’s cost, must not unreasonably disrupt Aerial’s operations, and may not give access to other customers’ data or to information that would compromise security. Information Aerial provides under this Section is Aerial’s confidential information.

---

11. Return and deletion

11.1 During the term. The Customer can export and delete Customer Personal Data using the Service’s features (while the Customer’s account is read-only, exports and changes are paused as described in Terms Section 8.5, except as the Service otherwise allows), and can ask Aerial for help, including for a copy of Customer Personal Data, by emailing contact@flyaerial.app.

11.2 At the end of the Service. When the Customer’s use of the Service ends, the Customer may request an export of Customer Personal Data within 30 days, as described in Terms Section 12.4. On the Customer’s written request to contact@flyaerial.app, Aerial will delete or anonymize Customer Personal Data within 30 days after the request (or after the export period ends, if later). Otherwise, Aerial will delete or anonymize it within a reasonable time after the Service ends.

11.3 Exceptions. Aerial may keep Customer Personal Data (a) to the extent required by law, including tax, accounting, and billing-record requirements; (b) in records needed to establish, exercise, or defend legal claims, or for security and fraud prevention; (c) in signed training records that are also personal records of the individual pilot who signed or received them, which Aerial holds as described in the Privacy Policy; and (d) in backups until they are replaced in the ordinary course. Aerial will keep any retained Customer Personal Data confidential, protect it under this DPA, and process it only for the purpose for which it was retained.

11.4 Individual account deletion. If an individual asks Aerial to delete their account, Aerial will act on that request for the data it controls, and will refer the individual to the Customer, or act on the Customer’s instructions, for Customer Personal Data the Customer must or chooses to keep.

---

12. Data location and transfers

The Service is designed for use in the United States, and Aerial’s database and application servers are located in the United States. Some Subprocessors listed in Annex 2 (for example, web hosting, payment, and email providers) may process limited Customer Personal Data in other countries under their own safeguards. Aerial does not offer the Service under the transfer mechanisms of the EU or UK General Data Protection Regulation. If the Customer needs to transfer personal data subject to non-U.S. law to Aerial, it must tell Aerial in writing before doing so, and the parties will agree on any additional terms needed.

---

13. U.S. state privacy law terms

Where Aerial processes Customer Personal Data as a service provider or processor under the CCPA or another U.S. state privacy law, Aerial:

1. Will process Customer Personal Data only for the limited and specified business purposes in Section 4 and the Terms, and not for any other purpose, including any other commercial purpose, except as the law permits a service provider to do

2. Will not sell or share Customer Personal Data (including for cross-context behavioral advertising)

3. Will not retain, use, or disclose Customer Personal Data outside the direct business relationship between Aerial and the Customer

4. Will not combine Customer Personal Data with personal data Aerial receives from or on behalf of another person, or collects from its own interactions with individuals, except as Applicable Data Protection Law permits a service provider to do (for example, to provide the Service to the same individual across Organizations they belong to, or for security and fraud prevention)

5. Will comply with the obligations that apply to it under Applicable Data Protection Law and provide the same level of privacy protection the law requires of the Customer

6. Will notify the Customer if it determines it can no longer meet its obligations under Applicable Data Protection Law

7. Agrees that the Customer may, on reasonable notice, take reasonable and appropriate steps to stop and remediate any unauthorized use of Customer Personal Data, and to help ensure Aerial uses it consistently with the Customer’s obligations, including through the information described in Section 10

8. Will require each Subprocessor to meet obligations consistent with this Section

Aerial certifies that it understands and will comply with the restrictions in this Section 13.

---

14. Liability

Each party’s liability arising out of or related to this DPA is subject to the exclusions and limitations of liability in the Terms (Section 14), and claims under this DPA are Disputes under the Terms (Section 15).

---

15. Term, order of precedence, and changes

15.1 Term. This DPA applies for as long as Aerial processes Customer Personal Data, and survives termination of the Terms until that processing ends.

15.2 Order of precedence. If this DPA conflicts with the Terms about the processing of Customer Personal Data, this DPA controls. A signed order form controls over both only if it expressly says so. If the Privacy Policy conflicts with this DPA about Customer Personal Data, this DPA controls.

15.3 Changes. Aerial may update this DPA as described in Terms Section 10, including to reflect changes in Applicable Data Protection Law, but no update will materially reduce the protection of Customer Personal Data without the Customer’s agreement, except where the law requires it.

---

Annex 1: Security measures

Aerial maintains the following measures. Measures supplied by Aerial’s hosting and infrastructure providers are identified as such; their scope and details are set by those providers.

  • Encryption in transit: connections to the Service use HTTPS (TLS).
  • Encryption at rest: Customer Personal Data is stored with Aerial’s database, file-storage, and hosting providers (Supabase and Google Cloud), which apply their own encryption at rest to the services Aerial uses. This encryption is supplied and managed by those providers, not by Aerial.
  • Hosting: the database, authentication, and file storage run on Supabase (managed PostgreSQL) in the United States, and Aerial’s application services run on Google Cloud Run in the us-central1 region.
  • Access control: role-based access control within each Organization, with permissions configured by the Customer; a dedicated, separately granted permission for government identification and citizenship documents; and time-limited download links for member documents, issued only after an access check.
  • Organization isolation: server-side checks that limit each user to the Organizations and records they are permitted to access, together with database hardening, including row-level security policies and restricted database privileges.
  • Audit logging: logging of security-relevant and sensitive actions, including member-document downloads, legal acceptances, and changes to roles and settings.
  • Payment data: card numbers and security codes are entered on Stripe-hosted pages and are not received or stored by Aerial.
  • Authentication: passwords are handled by Aerial’s authentication provider and stored in hashed form; optional sign-in with Google or Microsoft.
  • Data minimization in analytics: page-view analytics exclude query strings and pages containing invitation or password-reset tokens.
  • Retention controls: scheduled deletion of abandoned uploads, import files, and email delivery records, as described in the Privacy Policy.
  • Backups: backups provided by Aerial’s database provider.
  • Personnel: access to production systems limited to personnel who need it, bound by confidentiality obligations.

---

Annex 2: Subprocessors

  • Supabase, Inc.: authentication, database, and file storage. Location: United States.
  • Google LLC (Google Cloud): application hosting and compute (Cloud Run). Location: United States (us-central1).
  • Google LLC (Google Workspace): our support email inbox, which receives support emails and in-app problem reports. Location: as provided by Google.
  • Vercel Inc.: web application hosting and page-view analytics (Vercel Web Analytics). Location: global edge network.
  • Stripe, Inc.: payment processing for subscription billing and, where the Customer enables it, student payments through Stripe Connect. Location: United States and other locations Stripe uses.
  • Resend: transactional email delivery (for example, invitations, booking and billing notices, and in-app problem reports sent to our support inbox). Location: as provided by Resend.
  • Google LLC and Microsoft Corporation: sign-in, only for users who choose to sign in with a Google or Microsoft account. Location: as provided by each provider.

Aerial also retrieves public weather data from aviationweather.gov. That service does not receive Customer Personal Data and is not a Subprocessor.

Aerial will update this Annex and give notice of changes as described in Section 7.