This summary is provided for convenience and is not a substitute for the full Policy below. Where the summary and the Policy differ, the Policy controls.
Avtech AI (“Avtech,” “we,” “us,” or “our”) builds advisory software for aviation. Avtech Aware is an in-cockpit assistant. Avtech Fleet is an analytics platform for operators. This Privacy Policy (the “Policy”) describes how we collect, use, disclose, retain, and protect personal information, and how we handle the flight operations data our customers entrust to us.
This Policy applies to:
Where we process data on behalf of an operator, flight department, flight school, or other business customer, that processing is governed by the written agreement between us and that customer. If any term of this Policy conflicts with such an agreement, the agreement controls with respect to that customer’s data.
This Policy does not apply to third-party avionics, electronic flight bag applications, data service providers, or other systems that you or your operator may use alongside Avtech. Those systems are governed by their own privacy policies. See Section 18.
By using the Website or the Products, you acknowledge that you have read and understood this Policy. If you do not agree with it, do not use the Website or the Products.
The following terms are used throughout this Policy. Capitalized terms not defined here have the meaning given to them in the applicable customer agreement.
We collect the information you choose to give us. On the Website, that is limited to the following:
When you visit the Website, our hosting infrastructure records standard server log information as a technical necessity of delivering the page. This may include your IP address, browser type and version, operating system, referring URL, the pages and resources requested, and the date and time of the request. We use this information to serve the site, maintain security, diagnose faults, and detect abuse. We do not use it to build advertising or behavioral profiles.
Our forms include a hidden field that is invisible to human visitors and is used solely to identify automated submissions. It collects no information about you.
The Products process operational data supplied by, or generated on behalf of, a Customer. Depending on the aircraft, the integrations enabled, and the Customer’s configuration, this may include:
Some of this data is Pilot-Identifiable Information. Section 5 sets out the specific protections that apply to it.
We do not seek, and we ask that you do not send us, Social Security numbers, government identification numbers, financial account or payment card numbers, health information, precise consumer device geolocation, information about racial or ethnic origin, religious or philosophical beliefs, union membership, sexual orientation, immigration status, or genetic data.
Where the Products process radio or cockpit audio, that audio may incidentally capture the voice of a crewmember. We treat such audio as confidential, retain it only as described in Section 11, and restrict access to it as described in Section 12.
To comply with legal obligations, respond to valid legal process, establish or defend legal claims, enforce our agreements, and maintain records required by law.
We may create De-Identified Data and Aggregated Data and use it to evaluate the performance of our advisory logic, to conduct aviation safety research, and to report on general trends. We do not attempt to re-identify such data, we contractually prohibit our recipients from doing so, and we do not publish aggregate figures at a granularity that would allow an individual, aircraft, or Customer to be singled out.
Flight data is sensitive, and the consequences of mishandling it fall on individual pilots. This section states the specific commitments that govern it.
As between Avtech and the Customer, the Customer owns its Customer Data. With respect to that data, the Customer acts as the controller or business, and Avtech acts as a service provider or processor. We process Customer Data only to provide the Products, to comply with law, and otherwise on the Customer’s documented instructions. We do not use Customer Data for our own independent commercial purposes.
A Customer may configure retention windows, attribution settings, and access roles within the limits the Products allow. The Customer is responsible for providing any notices to, and obtaining any consents from, its crewmembers and personnel that applicable law, its own policies, or an applicable collective bargaining agreement require, and for ensuring that its configuration is consistent with those obligations.
Many operators run voluntary safety programs, including Aviation Safety Action Programs, Flight Operational Quality Assurance or Flight Data Monitoring programs, and Safety Management Systems. Where a Customer directs us to process data in support of such a program, we will honor the de-identification and access protocols the Customer specifies. Avtech is not a substitute for any recordkeeping, reporting, or monitoring program required by regulation, and Avtech output is not represented as a certified source of record.
The preceding paragraph does not limit our ability to disclose information where we believe in good faith that disclosure is necessary to prevent imminent risk of death or serious physical injury.
On termination or expiration of a customer agreement, the Customer may request export of its Customer Data in a structured, machine-readable format. Following export, or following a written deletion request during the term, we delete or de-identify the applicable Customer Data within the periods stated in Section 11, subject to backup cycles and any legal hold.
The Products use machine learning and language models to interpret radio and clearance audio, compare observed aircraft state against expected procedure, and generate advisories. All output is advisory. It is presented to the pilot in command or to authorized operator personnel for their evaluation, and it has no authority over the aircraft.
Where we use a third-party model provider to deliver a feature, we do so under contractual terms that prohibit the provider from using our inputs or outputs to train or improve its own models, require deletion within a limited retention window, and impose confidentiality and security obligations consistent with this Policy. We will identify our current model providers to a Customer on request.
A limited number of authorized Avtech personnel may review specific records where necessary to investigate a safety-relevant failure, diagnose a defect, or validate accuracy. Such review is restricted to the minimum data required, is subject to confidentiality obligations, is logged, and is governed by the applicable customer agreement.
Automated speech recognition and machine learning systems are imperfect. Audio may be misheard, context may be misjudged, and advisories may be issued in error or omitted. Avtech is designed to state its uncertainty and to degrade visibly rather than to manufacture confidence. Users must not rely on Avtech output as a sole source of truth for any flight-critical decision.
We disclose personal information only in the circumstances described below.
We do not disclose personal information to third parties for those parties’ own marketing purposes, and we do not permit our service providers to do so.
We engage a deliberately small number of vendors. Each is engaged under a written contract that limits processing to the purposes we specify, prohibits sale of the information, prohibits retention beyond what the engagement requires, imposes confidentiality and security obligations, and requires equivalent commitments from any subprocessor it engages.
| Category | Purpose | Data involved |
|---|---|---|
| Cloud hosting and content delivery | Hosting the Website and Product infrastructure; delivery, availability, and security | Server log data; Customer Data at rest and in transit |
| Transactional email delivery | Routing Website inquiries and mailing list subscriptions to our team (currently Mailgun) | Name, email address, telephone number, and message content you submit |
| Business communications and productivity | Email, document, and support tooling used to respond to inquiries and administer accounts | Business contact details and correspondence |
| Error monitoring and observability | Fault diagnosis, uptime monitoring, and security investigation | Diagnostic logs, which may include technical identifiers |
| Model and inference providers | Speech recognition and advisory generation, subject to Section 6.3 | Audio and derived text processed on a transient basis under no-training terms |
Our current list of subprocessors, including the specific entities in each category, is available to Customers and prospective Customers on request at hello@avtechai.us. Customers under contract receive advance notice of material changes to that list in accordance with their agreement.
We do not sell Flight Operations Data. We do not monetize it through advertising, data brokerage, benchmarking products offered to third parties, or any other resale arrangement. We have no advertising business, and we do not receive any consideration, monetary or otherwise, in exchange for the disclosure of personal information.
We retain personal information only for as long as necessary to fulfill the purposes described in this Policy, and we determine retention periods by reference to the duration of our relationship with you, the nature and sensitivity of the information, our legal and contractual obligations, and the need to establish or defend legal claims.
| Data | Retention period |
|---|---|
| Website inquiry submissions | Retained in our business correspondence systems while the inquiry or relationship is active, and for up to twenty-four months thereafter, unless you ask us to delete it sooner. |
| Mailing list subscriptions | Retained until you unsubscribe. We retain a minimal suppression record after unsubscribe so that we do not contact you again. |
| Server and hosting logs | Typically thirty days or less, except where a specific record is preserved for a security or abuse investigation. |
| Customer Data, including Flight Operations Data | Retained for the term of the customer agreement and in accordance with the retention window the Customer configures. Absent a contrary written agreement, we delete or de-identify Customer Data within thirty days of a written deletion request and within ninety days of termination. |
| Radio and ATC audio, where enabled | Retained for the shortest period consistent with the Customer’s configured window, and deleted on the same schedule as other Customer Data. |
| Security, access, and audit logs | Retained for up to twelve months to support security assurance and incident investigation. |
| Backups | Encrypted backup copies are purged on a rolling schedule not exceeding ninety days, after which deleted records are no longer recoverable. |
| Records subject to legal hold | Retained for as long as required by the applicable obligation, notwithstanding the periods above. |
We maintain administrative, technical, and physical safeguards designed to protect personal information and Customer Data against unauthorized access, disclosure, alteration, and destruction, appropriate to the nature and sensitivity of the information. Those safeguards include:
We maintain an incident response process covering detection, containment, eradication, recovery, and post-incident review. If we determine that a security incident has compromised personal information or Customer Data, we will notify affected Customers without undue delay and in accordance with our contractual commitments, and we will notify individuals and regulators where applicable law requires.
We state our security posture plainly rather than by implication. We do not currently hold a SOC 2 Type II attestation or an ISO/IEC 27001 certification, and we will not represent otherwise. Operators evaluating Avtech may request our current security documentation, architecture overview, and subprocessor list at hello@avtechai.us.
No method of transmission or storage is completely secure. While we work to protect your information, we cannot guarantee absolute security, and you transmit information to us at your own risk.
Certain rights described in this Policy are granted by state law to residents of particular states. As a matter of policy, and regardless of where you live, we will honor the following requests concerning personal information we hold about you as a business:
Where we process Customer Data as a service provider or processor, the Customer directs that processing. If you are a crewmember, employee, or contractor of an operator that uses Avtech and you wish to exercise rights with respect to that data, please submit your request to your operator. If you contact us directly, we will, where we are able to identify the relevant Customer, forward your request to that Customer and assist them in responding as our agreement and applicable law require.
We will not discriminate or retaliate against you for exercising any privacy right. We will not deny you goods or services, charge you a different price, or provide a different level or quality of service because you exercised a right.
This section supplements the rest of this Policy and applies to California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the “CCPA”). Terms used in this section have the meanings given to them in the CCPA.
The table below identifies the statutory categories of personal information we have collected in the twelve months preceding the effective date of this Policy.
| Statutory category | Collected | Examples |
|---|---|---|
| A. Identifiers | Yes | Name, email address, telephone number, IP address, operator-issued user identifier |
| B. Customer records (Cal. Civ. Code § 1798.80(e)) | Yes | Name, telephone number, and employer or operator information supplied in an inquiry |
| C. Protected classification characteristics | No | — |
| D. Commercial information | Yes | Products considered, evaluation and subscription records |
| E. Biometric information | No | We do not create voiceprints or biometric identifiers |
| F. Internet or other network activity | Yes | Server log data, pages requested, in-product interaction events |
| G. Geolocation data | Yes (Products only) | Aircraft position and track supplied through the Customer’s systems. We do not collect consumer device geolocation for advertising |
| H. Sensory or surveillance information | Yes (Products only) | Radio and ATC audio and derived transcripts, where the Customer has enabled that capability |
| I. Professional or employment-related information | Yes | Professional role, operator type, crew role and permissions supplied by the Customer |
| J. Non-public education information | No | — |
| K. Inferences | Yes (Products only) | Advisory events and adherence indicators derived from Flight Operations Data |
| L. Sensitive personal information | Limited | Precise geolocation of the aircraft, and the contents of radio communications where the Customer has enabled audio processing |
The sources from which we collect each category are described in Section 3. The business and commercial purposes for which we collect and use each category are described in Section 4. We have disclosed the categories above for a business purpose to the categories of recipients described in Sections 7 and 8. We have not sold or shared any category of personal information.
We use and disclose sensitive personal information only for the purposes permitted by Cal. Code Regs. tit. 11, § 7027(m), namely to perform the services requested, to prevent and investigate security incidents, to resist malicious or fraudulent activity, to ensure the physical safety of natural persons, and to verify or maintain the quality and safety of our services. We do not use or disclose sensitive personal information for the purpose of inferring characteristics about an individual. Accordingly, we are not required to offer, and we do not offer, a “Limit the Use of My Sensitive Personal Information” option.
You may use an authorized agent to submit a request on your behalf. We will require written proof of the agent’s authorization, and we may require you to verify your own identity directly with us or to confirm to us that you granted the agent permission.
California Civil Code § 1798.83 permits residents to request information about disclosures of personal information to third parties for those parties’ direct marketing purposes. We do not make such disclosures.
With respect to Customer Data, Avtech acts as a service provider under the CCPA. We do not retain, use, or disclose Customer Data for any purpose other than performing the services specified in the customer agreement, and we do not combine it with personal information received from other sources except as the CCPA permits.
Residents of states with comprehensive consumer privacy statutes, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states as their statutes take effect, have rights to confirm whether we process their personal data and to access it, to correct inaccuracies, to delete it, to obtain a portable copy, and to opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions producing legal or similarly significant effects. As described in Sections 4.6, 9, and 10, we do not engage in targeted advertising, do not sell personal data, and do not conduct such profiling. The remaining rights are honored as described in Sections 13 and 16.
We do not process sensitive data of website visitors within the meaning of these statutes. Where the Products process data an operator directs us to process, the operator is the controller and is responsible for establishing the lawful basis for that processing, including any consent its personnel must provide.
If we decline to act on your request, you may appeal that decision within a reasonable period by replying to our response or by writing to hello@avtechai.us with the subject line “Privacy Request Appeal.” We will respond in writing within forty-five days of receipt, and will explain the reasons for our decision. If your appeal is denied, you may contact your state attorney general to submit a complaint.
Nevada residents have the right to direct a covered operator not to sell certain covered information. We do not sell covered information as defined by Nevada Revised Statutes Chapter 603A, and we have no plans to do so.
We do not collect, process, or share consumer health data within the meaning of the Washington My Health My Data Act, the Nevada consumer health data law, or similar statutes.
Send your request to hello@avtechai.us with the subject line “Privacy Request.” Please tell us the right you wish to exercise, the state in which you reside, and enough information for us to locate your records, such as the email address you used to contact us or the operator you fly for.
To protect your information, we will verify your identity before acting on a request. Verification is typically accomplished by matching the information in your request against records we already hold, and by corresponding with you at the email address associated with those records. For requests seeking specific pieces of personal information, we apply a higher standard of certainty. We will not require you to create an account in order to make a request, and we will use any information you provide for verification only for that purpose.
We will acknowledge receipt of your request within ten business days and will respond substantively within forty-five days. Where reasonably necessary, we may extend that period by an additional forty-five days and will inform you of the extension and the reason for it within the initial period. We do not charge a fee to respond, unless your request is manifestly unfounded or excessive, in which case we will tell you why and what the fee would be before proceeding.
We may decline a request, in whole or in part, where an exception under applicable law applies, including where retention is necessary to complete a transaction, to detect or prevent security incidents or fraudulent or illegal activity, to comply with a legal obligation or legal hold, to exercise or defend legal claims, or where the information is not reasonably linkable to you. Where we decline, we will explain why and will tell you how to appeal.
The Website and the Products are intended for adults engaged in aviation operations and for business use. They are not directed to children. We do not knowingly collect personal information from any individual under the age of sixteen, and we do not sell or share the personal information of individuals under sixteen.
If we learn that we have collected personal information from a child under thirteen in violation of the Children’s Online Privacy Protection Act, or from any individual under sixteen without a lawful basis, we will delete it promptly. A parent or guardian who believes we hold such information may contact us at hello@avtechai.us.
Flight schools and training organizations may enroll student pilots who are minors. Where an operator provisions accounts for individuals under eighteen, that operator is responsible for obtaining any parental or guardian consent that applicable law requires and for confirming that its use of the Products is consistent with that consent.
The Website may link to third-party sites, and the Products may integrate with avionics, electronic flight bag applications, data services, and other systems that you or your operator select. We do not control those third parties, we are not responsible for their privacy practices, and this Policy does not apply to them. Information you provide to a third party, or that a third party collects through its own integration with you, is governed by that party’s privacy policy. We encourage you to review the policies of any service you connect to Avtech.
Avtech operates in the United States. Personal information and Customer Data we collect are processed and stored on infrastructure located in the United States. The Website and the Products are directed to users in the United States and are not intended for individuals located in jurisdictions whose laws would require additional disclosures or transfer mechanisms.
If you access the Website from outside the United States, you understand that your information will be transferred to, processed in, and stored in the United States, where data protection laws may differ from those of your jurisdiction. If we begin offering the Products to individuals outside the United States, we will update this Policy and provide the additional disclosures and safeguards that the applicable laws require.
We may update this Policy to reflect changes in our practices, our technology, or the law. When we do, we will revise the effective date and the version number at the top of this page. Prior versions are available on request.
Where a change is material, we will provide notice before it takes effect. Notice will be given by posting a prominent statement on the Website at least ten days before the new version becomes effective, and, where we hold your contact information as a Customer or subscriber, by email. Changes affecting Customer Data are additionally governed by the notice provisions of the applicable customer agreement.
Your continued use of the Website or the Products after a revised Policy takes effect constitutes your acknowledgment of the revised Policy.
Questions, requests, and complaints regarding this Policy or our handling of personal information should be directed to us in writing. We answer every message. We aim to acknowledge privacy correspondence within one business day.
| Purpose | Contact | Subject line |
|---|---|---|
| Privacy questions and data rights requests | hello@avtechai.us | Privacy Request |
| Appeal of a declined request | hello@avtechai.us | Privacy Request Appeal |
| Security reports and vulnerability disclosure | hello@avtechai.us | Security |
| Security documentation and subprocessor list | hello@avtechai.us | Security Documentation |
You may also reach us through the contact page. If you are a crewmember or employee of an operator that uses Avtech, please see Section 13.2 before submitting a request.