AeroLink Privacy Policy

Last updated: July 11, 2026

Effective: July 11, 2026

Version ID: privacy-2026-07-11

Entity: AeroLink Aviation LLC, a Florida limited liability company

Principal place of business: 1219 SE 12th Avenue, Deerfield Beach, Florida 33441

Contact: privacy@aerolink.one | legal@aerolink.one

AeroLink Aviation LLC respects your privacy. This Privacy Policy explains what information we collect, how we use and share it, and your rights. It applies to websites, mobile apps, and services. By using the Platform you agree to this Policy and our Terms of Service.

1. Information We Collect

We collect information you provide when joining the waitlist, creating an account, logging flights, using aviation tools, and interacting with the Platform. This includes:

Information you provide directly

Account & waitlist information: name, email address, phone number (optional), pilot certificate type, home airport, referral source
Notification preferences: email and SMS opt-in status, notification settings
Logbook data: flight dates, aircraft type and registration, departure/arrival airports, flight hours (PIC, SIC, dual, solo, night, instrument, cross-country), landings, approaches, and remarks
Profile data: bio, profile photo, certificates and ratings, aviation experience, social links
User content: posts, comments, photos, messages, forum threads, marketplace listings
Sensitive information (only if you choose to provide it): medical-certificate dates, IMSAFE / wellness self-assessments, and precise location during live flight sharing. We treat these as sensitive and protect them as described in Sections 3 and 14.
Orville AI Copilot interactions: questions and inputs you submit to our AI assistant (processed to generate responses; see Section 5)
Orville memory facts: optional facts you save or allow Orville to extract (aircraft, preferences, training goals) — stored in your account, editable or deletable anytime in Settings → Orville AI; you can disable memory use in new chats without deleting stored facts

Information collected automatically

Usage data: pages visited, features used, session duration, device type, browser, operating system, and approximate location derived from IP
Precise location data: GPS coordinates during live flight sharing or map features (only when you explicitly opt in and activate sharing)
Error and performance data: crash reports and performance metrics (with PII scrubbing) used for reliability
Cookies & device identifiers: as described in Section 6

Information from third parties

Sign-in providers (Google, Apple): name, email, and profile photo when you sign in with a third-party provider
Payment data: processed securely by Stripe and, for in-app purchases, by Apple or Google — we never store full card numbers, CVVs, or bank account details on our servers

2. How We Use Your Information

We use your information to:

Provide, operate, maintain, and improve AeroLink's aviation tools, social features, and marketplace
Calculate pilot currency per 14 CFR §61.57 from your logbook entries
Display weather data (METAR, TAF, SIGMET, PIREP, TFR) for airports you search
Power Orville AI Copilot responses with aviation-specific context
Enable live flight sharing with other AeroLink users (when you choose to share)
Process subscription payments, paid listing fees, and Shop checkout
Send notifications you have opted into: email updates, SMS alerts, push, and transactional confirmations
Detect, prevent, and respond to fraud, abuse, and security threats
Analyze aggregate usage to improve the Platform (we do not sell individual tracking data)
Comply with legal obligations and enforce our Terms

3. Legal Bases for Processing

Where the GDPR or UK GDPR applies, we process personal data on these legal bases:

Contract — to provide the Platform and the features you request
Consent — for marketing messages, SMS, precise location, and any sensitive data you choose to provide (you may withdraw consent at any time)
Legitimate interests — to secure, improve, and analyze the Platform, in a manner balanced against your rights
Legal obligation — to comply with applicable law and lawful requests

4. How We Share Information

We do not sell your personal information and we do not share it for cross-context behavioral advertising. We share data only with service providers (processors) that process it on our behalf under contract, and in the limited circumstances below:

Supabase — our primary database, authentication, storage, and backend infrastructure (hosts your account, logbook, and application data)
Stripe — payment processing and marketplace payouts (PCI-DSS compliant)
Cloudflare — content delivery and media storage (R2) for public assets, and network security
Railway — application hosting
xAI (Grok) — AI query processing for Orville AI Copilot, using the input text and the minimum context needed to respond (see Section 5)
ElevenLabs — voice synthesis for the Orville voice cast (processes text to generate audio)
Email, SMS & push providers — transactional and opted-in messaging delivery (email, SMS when enabled, and Apple Push Notification service / Web Push)
Analytics & error monitoring — product analytics and crash/performance monitoring with PII scrubbing, used to improve reliability (no third-party ad trackers)
Esri / OpenStreetMap / MapTiler — map tile rendering
Other AeroLink users — only content you choose to post or share publicly

We may also disclose information (a) to comply with law, legal process, or lawful government requests; (b) to enforce our Terms or protect the rights, safety, and security of AeroLink, our users, or the public; and (c) in connection with a merger, acquisition, financing, or sale of assets, in which case we will require the recipient to honor this Policy.

SMS is not treated as active unless a provider is configured, a compliant opt-in workflow is live, and you have affirmatively opted in. Until then, SMS-related fields in this Policy describe our intended posture when the program launches.

SMS-specific disclosure: No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing to subcontractors in support services, such as customer service and messaging delivery providers we identify when SMS is enabled, is permitted. All other use case categories exclude text-messaging originator opt-in data and consent; this information will not be shared with any third parties.

5. AI & Orville Data

When you use Orville AI Copilot or other AI Features, your inputs are sent to our AI provider (xAI) to generate a response and may be processed by ElevenLabs to synthesize voice. We send only the input text and the minimum context required.

We do not sell your AI inputs, and we do not use them to build advertising profiles. Prompts and outputs are processed to provide responses and improve product quality; we may retain AI conversations to provide history, ensure safety, and support incident review, and you can delete your conversations. Optional Orville memory facts are stored separately in your account and are only injected into new chats when memory is enabled in Settings → Orville AI. Do not submit other people's personal, confidential, or proprietary information to AI Features. AI output may be inaccurate; see Section 3 of the Terms of Service.

6. Cookies & Tracking

AeroLink uses:

Essential cookies / storage: authentication tokens and session management (required for the Platform to function)
Analytics: aggregate usage metrics to improve the Platform (no third-party ad trackers, no cross-site tracking)

We do not use third-party advertising cookies and do not sell data to advertisers. Because we do not engage in cross-context behavioral advertising, there is nothing to opt out of; where required, we honor recognized browser signals such as Global Privacy Control (GPC) and Do Not Track for applicable categories.

7. Data Security & Breach Notification

We protect your data using industry-standard security measures:

HTTPS/TLS encryption for all data in transit
Encrypted storage at rest for sensitive fields (e.g., certificate numbers, medical dates, wellness notes) using AES-256-GCM
Authentication via our identity provider with short-lived access tokens and row-level security on user data
Stripe PCI-DSS compliant payment processing
Rate limiting and CSRF protection on API endpoints
Error monitoring with PII scrubbing enabled
Regular security audits and dependency vulnerability scanning

We never log passwords, authentication tokens, or full payment card numbers.

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal data, we will notify you and the appropriate authorities as required by applicable law.

8. Data Retention

Active accounts: data is retained as long as your account is active
Waitlist entries: retained until you request removal or your account is created
Deleted accounts: personal data is removed within 30 days of account deletion; anonymized aggregate data may be retained for analytics
Logbook data: exportable at any time in CSV format; removed upon account deletion
SMS opt-in records: retained for TCPA compliance for a minimum of 5 years after opt-out
Legal/financial records: retained as required by tax, accounting, and other legal obligations

9. International Data Transfers

AeroLink is operated from the United States and our infrastructure and service providers are primarily located in the United States. If you access the Platform from outside the United States, you understand that your information will be transferred to, stored, and processed in the United States and other countries that may not provide the same level of data protection as your home country. Where required for transfers from the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

10. Your Privacy Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

Access — request a copy of the personal data we hold about you
Correction — request correction of inaccurate data
Deletion — request deletion of your personal data (subject to legal retention requirements)
Portability — export your logbook data and account information
Opt-out — unsubscribe from marketing email or SMS at any time
Restriction / objection — request that we limit or stop certain processing
Withdraw consent — where processing is based on consent

To exercise any of these rights, contact us at privacy@aerolink.one. We will verify your request and respond within the time required by applicable law (generally 30–45 days). You may authorize an agent to act on your behalf, and we will not discriminate against you for exercising your rights.

11. California Residents (CCPA / CPRA)

If you are a California resident, you have rights under the California Consumer Privacy Act, as amended by the CPRA:

The right to know what personal information we collect, use, and disclose
The right to correct inaccurate personal information
The right to delete your personal information
The right to opt out of the "sale" or "sharing" of personal information — we do not sell or share your personal information
The right to limit use of sensitive personal information — we use sensitive information only for permitted purposes such as providing the features you request and security
The right to non-discrimination for exercising your rights

We honor the Global Privacy Control (GPC). To exercise your rights, contact privacy@aerolink.one.

12. European Economic Area & United Kingdom (GDPR)

If you are in the EEA, the UK, or Switzerland, you have the rights described in Section 10 plus the right to object to processing based on legitimate interests, the right to withdraw consent at any time (without affecting prior processing), and the right to lodge a complaint with your local data protection supervisory authority. The data controller is AeroLink Aviation LLC; contact privacy@aerolink.one. See Section 3 for our legal bases and Section 9 for international transfer safeguards.

13. Other U.S. State Privacy Rights

Residents of states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, and others) have rights to access, correct, delete, and obtain a portable copy of their personal data, and to opt out of targeted advertising, sale, and certain profiling. We do not sell personal data or conduct targeted advertising. To exercise these rights, contact privacy@aerolink.one; you may appeal a decision by replying to our response.

14. Health & Sensitive Data

If you choose to record medical-certificate dates, IMSAFE / wellness self-assessments, or similar information, we treat it as sensitive and store it encrypted at rest. We use it only to provide the features you request (such as reminders and your own tracking) and do not share it for marketing or sell it. This information is not medical advice and is not a substitute for an Aviation Medical Examiner or your physician (see Section 11 of the Terms of Service). AeroLink is not a HIPAA covered entity; this data is provided voluntarily by you for personal use.

15. Children's Privacy

AeroLink is not intended for children under 13, and we do not knowingly collect personal information from children under 13. Users aged 13–17 must have parental or guardian consent. If you believe we have collected data from a child under 13, contact privacy@aerolink.one and we will promptly delete it.

16. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email and/or in-app notification at least 14 days in advance where practicable. The "Last updated" date at the top reflects the most recent revision. Continued use of the Platform after changes take effect constitutes acceptance.

17. Contact

AeroLink Aviation LLC Privacy inquiries: privacy@aerolink.one General support: support@aerolink.one Website: https://aerolink.one

This Policy is the operative privacy notice for the AeroLink Service.

Additional Liability-Relevant Disclosures (v2.0)

Aviation data is processed for supplemental informational tools only and does not create an FAA-approved briefing or transfer PIC responsibility.

Orville AI prompts are sent to AI providers (including xAI). Do not submit classified or third-party confidential data. AI outputs are not professional advice.

Legal consent ledgers (version, timestamp, IP, user agent), account and transaction records may be retained typically up to seven (7) years for legal defense unless longer required.

International transfers may include U.S. processing. SCCs used where required.

California residents: rights to know, access, delete, correct, opt out of certain sharing. We do not sell personal information or share for cross-context behavioral advertising under CCPA/CPRA. Contact privacy@aerolink.one. No discrimination for exercising rights.

Children under 13: not directed to children under 13; no knowing collection. Ages 13-17 require parental consent per Terms.

Contact: AeroLink Aviation LLC, Attn Privacy Officer, 1219 SE 12th Avenue, Deerfield Beach, Florida 33441. privacy@aerolink.one

Annex — Consent to Use of Data

10. CONSENT TO USE OF DATA.

You agree that AeroLink may collect and use technical and related information, including but not limited to technical information about your device (including device identifiers), your physical location, system and application software, usage analytics, and peripherals, gathered periodically to facilitate the provision of software updates, product support, and other services related to the App. AeroLink may use this information, in a form that does not personally identify you, for analytics purposes (including aggregated and anonymized analytics), to improve our products and the Service, or to provide services or technologies to you. Your use of location-based features constitutes your consent to AeroLink's collection, use, transmission, processing, and maintenance of location and account data to provide and improve those features or services, as further described in the Privacy Policy.