AerialLegal

Version 2026-10-10 · Terms of Service · Data Processing Addendum

Privacy Policy

Effective date: October 10, 2026

Last updated: November 6, 2026

---

Business: Aerial Flight Management System LLC, an Illinois limited liability company (“Company,” “Aerial,” “we,” “us”)

Product: the Aerial flight management software and related websites, apps, and services (the “Service”)

Privacy contact: contact@flyaerial.app

Address: 730 N Milwaukee Ave, Chicago, IL 60642

This Privacy Policy explains how we collect, use, disclose, and retain personal information when you use the Service. Capitalized terms not defined here have the meaning in the Terms of Service.

Depending on the relationship:

  • For Organization Data processed on behalf of a flight school or club, we act as a processor or service provider, and the school is the controller or business. The school decides what it collects about its members, who in the school can see it, and how long it keeps it, and the school’s own privacy notice applies to that use. Our processing for schools is governed by our Data Processing Addendum.
  • For account data, personal logbook data you keep outside an Organization, website and product analytics, security and legal-compliance records, and our own billing of schools and individuals for subscriptions, we act as a controller or business.

---

1. Personal information we collect

1.1 Information you provide

  • Account identifiers: name, email address, password (stored in hashed form by our authentication provider), and phone number.
  • Profile and aviation information: certificate numbers, ratings, medical class and expiry, total hours, accident or enforcement history you choose to enter, address, and date of birth.
  • Organization membership: roles, locations, employee or student numbers, and school notes.
  • Training and operations: schedules, flight requests, dispatch and check-in records, meter readings (Hobbs and tach), enrollments, lesson grades, logbook entries, endorsements, aircraft assignments, and squawks and maintenance records you enter.
  • Electronic signatures: the typed name, certificate number, and ratings entered when signing, the statement signed, the date and time, time zone, and the signing account and session.
  • Emergency contacts: name, relationship, phone, and email of people you designate (this is information about other people).
  • Aircraft owners: if a school saves an aircraft that is not in its fleet, it may enter the owner’s name (this is information about another person). We store it only on that aircraft’s record, show it only to the person who saved the record and to staff who manage these records, and clear it when the record is archived or the school erases it.
  • Billing: subscription plan, invoices, payment status, payment-processor customer and payment identifiers, saved-card brand, last four digits and expiration month and year, billing address, school payout and payment-account metadata, and the record of your card-on-file authorization.
  • Communications: support requests, emails you send us, and in-app notices. When you use Report a problem in the Service, we receive what you write, any screenshot you attach (which may show whatever was on your screen, including information about other people in your school), the page you were on, your school and role, and your browser type, and we email it to our support team.
  • Documents: uploaded files, including pilot certificates, medical certificates, government identification, citizenship evidence, syllabi, and organization documents.

We do not receive or store your full card number or security code; you enter card details on Stripe’s secure pages.

1.2 Information collected automatically

  • Device and browser type, IP address, and approximate location derived from IP address
  • Log data (timestamps, pages and API routes accessed, error diagnostics)
  • Authentication session metadata
  • When you accept our Terms, this Privacy Policy, or other legal documents: the version accepted, the date and time, your IP address, and your browser user agent
  • Page-view analytics as described in Section 8

1.3 Information from others

  • Organization administrators who invite you or enter member information
  • Instructors and schools who record training against your profile
  • Sign-in providers, if you choose to sign in with Google or Microsoft (your name, email address, account identifier, and any other basic profile information the provider shares with your permission)
  • Payment processors (payment success or failure, the card details listed above, and dispute events)
  • Identity verification performed by our payment processor during payment-account onboarding (Stripe performs this verification under its own terms)
  • Public data sources such as aviationweather.gov (weather for airports you book at; this is not personal information about you)

1.4 Sensitive information

The Service may process government identification and citizenship documents, medical certificate information, date of birth, and aviation safety information (such as accident or enforcement history) if you or your school enter it. Provide only what is needed, and do not upload unnecessary sensitive documents.

  • Why schools ask for citizenship evidence. U.S. flight training providers may be required to verify and keep records of a student’s citizenship or obtain a security threat assessment before certain training (49 CFR Part 1552). Your school, not Aerial, decides whether to collect these documents and is responsible for that program; we store the documents for the school.
  • Who can see identity documents. Within an Organization, government identification and citizenship documents are available only to roles that hold a dedicated permission to view them. By default, that permission is held by the Organization’s owners, administrators, and chief instructors, and the Organization can change which roles hold it. Each download of a member document is logged.
  • Medical information. We are not a health-care provider or a HIPAA “covered entity,” and medical-certificate information in the Service is not protected health information under HIPAA. We protect it as sensitive personal information.
  • No biometrics. We do not collect biometric identifiers or biometric information (for example, we do not perform facial recognition or extract face geometry from photo identification).

Age requirements: see Section 12.

---

2. How we use personal information

We use personal information to:

1. Provide, operate, secure, and support the Service

2. Authenticate users and enforce role-based access within Organizations

3. Enable scheduling, dispatch and check-in, training programs, logbooks, endorsements, fleet and maintenance, and related workflows

4. Process subscription billing and (where enabled) facilitate school–student payments through our payment processor

5. Send transactional messages (invitations, booking notices, security alerts, billing receipts and payment notices, and trial reminders)

6. Detect fraud, abuse, and security incidents, and audit access

7. Comply with law, enforce our Terms, and keep records of legal acceptances and authorizations

8. Improve the Service using aggregated or de-identified analytics

9. Communicate product changes or marketing where permitted (you may opt out of marketing)

Legal bases. Where a law requires a legal basis for processing, we process personal information to perform our contract with you or your Organization (items 1–5), for our legitimate interests in operating a secure and improving service (items 6 and 8), to comply with legal obligations (item 7), and with your consent where required (item 9 and any optional sensitive documents).

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not use your information to train third-party advertising models.

Email. We send transactional and service emails (for example, invitations, booking and billing notices, trial reminders, and security alerts) as part of the Service; you cannot opt out of these while you have an account, but you can adjust optional notifications in the Service. We will send marketing emails only where permitted and will include an unsubscribe link. We do not send text (SMS) messages; if we add SMS, we will ask for your consent first.

---

3. How we share personal information

We share personal information with:

  • Your Organization’s Authorized Users, according to roles and permissions (e.g., instructors see student schedules; billing administrators see invoices).
  • Service providers (subprocessors) that host and operate the Service for us, listed below.
  • Payment processors, to charge Fees and student invoices, make payouts to schools, and handle disputes.
  • Professional advisors (legal, accounting, insurance), under confidentiality.
  • Authorities, when required by law or court order, or to protect rights, safety, and security.
  • Successors, in a merger, acquisition, or asset sale, subject to continuing protections.

We do not allow service providers to use personal information for their own marketing.

Current subprocessors:

  • Supabase: authentication, database, and file storage (United States)
  • Google Cloud: application hosting and compute (United States)
  • Google Workspace: our support email inbox, which receives support emails and in-app problem reports
  • Vercel: web application hosting and page-view analytics
  • Stripe: payment processing, Stripe Connect, and identity verification for payout onboarding
  • Resend: transactional email delivery
  • Google and Microsoft: sign-in, only if you choose to use them

The Data Processing Addendum keeps this list for schools, explains how we notify them of changes, and lets them object. We use aviationweather.gov as a public data source; we do not send it personal information about you.

---

4. Organization access and your choices inside a school

If you join a flight school Organization, the school’s administrators and other roles the school has granted access may access information about you according to that school’s configuration and our permission model. That may include contact details, schedule, training progress, logbook entries and endorsements recorded with the school, billing records with that school, documents you share with it, and certain profile fields.

Questions about what your school accesses, correction of school-managed notes, or school-level retention should go first to your school. We assist the school as its processor.

You may leave an Organization (or be removed). Leaving may not delete training records the school or we must retain.

---

5. Retention

We keep personal information only for as long as we need it for the purposes in this policy, including:

  • Account and profile information: while your account is open. If you ask us to delete your account, we delete or anonymize it within 30 days after verifying the request, subject to the exceptions in this Section.
  • Organization membership information: while you are a member, and afterward for as long as the Organization needs it and for audit history.
  • Signed or locked logbook entries and graded training records: kept to protect their integrity and for aviation recordkeeping. They may not be fully erasable on request where keeping them is necessary, for example because another user signed them.
  • Schedules and operational records: for the life of the Organization’s subscription, plus the period needed for backups, audits, and export.
  • Billing and tax records: for as long as tax, accounting, and other laws require.
  • Legal-acceptance and card-authorization records: for as long as needed to show what was agreed or authorized and to resolve disputes.
  • Uploaded documents from sign-ups that are never completed, and documents left after an account is deleted: deleted automatically on a regular schedule, currently about 30 days.
  • Data import files: deleted automatically after the import is completed or abandoned, currently within about 30 days.
  • Email delivery records: deleted automatically, currently about 30 days after delivery.
  • Support requests: for as long as needed for support history, then deleted or de-identified.
  • Security logs: for a limited period, unless needed to investigate an incident.
  • Emergency contacts: until you or your school remove them or your account is deleted.
  • Aircraft owners’ names: until the school archives the aircraft’s record or erases the name, then removed from the Service; copies in backups are overwritten on the rolling schedule below.
  • Backups: overwritten on a rolling schedule; deleted data is removed from backups as they are replaced.

Retention of Organization Data is also subject to the Organization’s instructions under the Data Processing Addendum and to the Terms (Sections 12.1 and 12.3). Where a law requires a school to keep a record (for example, training or citizenship-verification records), the school is responsible for keeping it for the required period, including by exporting it before closing its account. You should not rely on the Service as the only copy of records required by the FAA, TSA, or your insurer.

---

6. Security

We use technical and organizational measures appropriate to the risk, including encryption of data in transit (TLS), the encryption at rest our hosting and database providers apply to their services, role-based access controls, isolation between Organizations, least-privilege permissions, and audit logging of access to sensitive documents. The Data Processing Addendum describes these measures in more detail. No system is perfectly secure. Report suspected vulnerabilities or breaches affecting you to contact@flyaerial.app.

Breach notification. If we discover a breach of security that compromises personal information, we will notify affected individuals and, where required, regulators (including the Illinois Attorney General when a breach affects more than 500 Illinois residents) in the most expedient time possible and without unreasonable delay, as required by the Illinois Personal Information Protection Act (815 ILCS 530) and other applicable law. Where we hold the data on behalf of an Organization, we will notify the Organization as described in the Data Processing Addendum so it can meet its own obligations.

---

7. Where we process data

The Service is designed for use in the United States, and our database and application servers are located in the United States. Some service providers (for example, our web hosting network, payment processor, and email provider) may process limited information, such as request data or payment and email-delivery details, in other countries under their own safeguards. If you access the Service from outside the United States, your information will be transferred to and processed in the United States. Questions: contact@flyaerial.app.

---

8. Cookies and similar technologies

We use:

  • Essential cookies and browser storage for sign-in sessions and security
  • Preferences stored in your browser (for example, display settings and recently selected views)
  • Analytics: we use Vercel Web Analytics to count page views. We send the page address without its query string, we do not send pages that contain invitation or password-reset tokens, and we do not use analytics for advertising. Vercel describes this product as not using cookies.

You can control cookies through your browser settings; blocking essential cookies may break sign-in.

---

9. Your privacy rights

Depending on where you live (for example, California and other U.S. states with comprehensive privacy laws), you may have rights to:

  • Access or know what we hold about you
  • Correct inaccuracies
  • Delete your information (subject to legal and recordkeeping exceptions, including signed training records)
  • Export or port your information
  • Restrict or object to certain processing
  • Limit the use of sensitive personal information
  • Withdraw consent where processing is based on consent
  • Opt out of “sale,” “sharing,” or targeted advertising (we do not sell or share personal information)
  • Appeal a denied request where required by law

How to exercise your rights, including deleting your account: email contact@flyaerial.app with the subject “Privacy Request” and enough information to verify your identity and locate your data. We will confirm receipt within 10 business days and respond within 45 days (or the period required by applicable law, which we may extend where the law allows). If you ask us to delete your account, we will delete or anonymize your personal information within 30 days after verifying the request, except information we must keep for legal, tax, billing, security, or dispute reasons, signed training records described in Section 5, and information your school, as controller, must or chooses to keep (see Terms Section 12.1). If we deny a request, we will explain why and how to appeal. For Organization Data we hold for a school, we may forward your request to the school and act on its instructions.

We will not discriminate against you for exercising your privacy rights.

Authorized agents: where the law allows, an authorized agent may submit a request on your behalf with proof of authorization.

---

10. Do Not Track and Global Privacy Control

The Service does not currently respond to “Do Not Track” browser signals. Because we do not sell or share personal information for targeted advertising, a Global Privacy Control (GPC) signal does not change how we process your information; if that changes, we will treat GPC as a valid opt-out where the law requires.

---

11. Automated decisions

We do not use personal information for solely automated decisions that produce legal or similarly significant effects about individuals without human involvement, except fraud and security controls. Training progress percentages, scheduling suggestions, booking warnings or blocks (for example, for a grounded aircraft or an expired solo endorsement), and the automatic change of an unpaid account to read-only are operational features applied under the Terms and your Organization’s settings, not credit or employment decisions by us.

---

12. Age requirements and children

You must be at least 16 years old to use the Service (Terms Section 2.1). Users aged 16 or 17 use the Service with the permission of a parent or legal guardian, who agrees to the Terms on their behalf. We do not knowingly collect personal information from anyone under 16, and the Service is never directed to children under 13. If we learn that we have collected personal information from someone under 16, we will delete it and close the account. If you believe someone under 16 has provided us personal information, contact contact@flyaerial.app.

---

13. Changes

We may update this Privacy Policy. We will revise the “Last updated” date and, for material changes, notify you by email or in the Service before they take effect, and ask for your consent or acceptance where required by law.

---

14. Contact

  • Privacy requests: contact@flyaerial.app
  • Security: contact@flyaerial.app
  • Mail: Aerial Flight Management System LLC, 730 N Milwaukee Ave, Chicago, IL 60642