Privacy Policy

This Privacy Policy describes how PilotConnect App LLC ("PilotConnect," "we," "us," or "our") collects, uses, and shares your information when you use the PilotConnect mobile application and related services (the "Service"). This Privacy Policy is incorporated by reference into our Terms of Service. By using the Service, you consent to the practices described below.

1. Information We Collect.

(a) Information You Provide.

We collect information you voluntarily provide, including: account information (name, email address, phone number, password or authentication tokens); profile information (profile photo, aircraft photo, biography, home airport, aviation qualifications); Service Provider information (FAA certificate numbers and uploaded certificate documents, business details, pricing, availability, service areas, bank account information collected by our payments processor during onboarding); booking and scheduling information (services requested, locations, times, notes to providers); messages and forum posts exchanged through the Platform; reviews and ratings; payment information (handled by our payments processor — see Section 1(c) below); and support inquiries.

Photos you upload (profile picture and aircraft photo) are stored using Firebase Storage and may be displayed within the app to other users where appropriate (e.g. on your profile or aircraft listing). Certificate documents uploaded by Service Providers are stored privately for verification purposes and are not displayed publicly.

(b) Information Collected Automatically.

When you use the Service, we may automatically collect: device information (device type, operating system, unique device identifiers); usage data (features accessed, actions taken, session duration); location data (approximate or precise, with your permission, used to display nearby Service Providers); log data (IP address, browser type, crash data, access times); and performance data (app diagnostics and crash reports).

(c) Information from Third Parties.

We may receive information from: Firebase (Google) for authentication, real-time database, analytics, crash reporting, and push notifications; Google Sign-In and (optionally) Google Calendar API if you choose to connect those services; Apple for App Store transactions and Sign in with Apple authentication; RevenueCat for subscription management; Stripe for payment processing, including the creation of customer records, processing of card and bank transactions, and Stripe Connect onboarding for Service Providers (collectively, our "Payments Processor"); and publicly available FAA databases for airman certificate information. Payment card numbers and bank account numbers are collected and stored by Stripe; we never receive or store full card or bank account details on our servers.

2. How We Use Your Information.

We use your information to: provide and operate the Service; create and manage accounts; facilitate connections between Clients and Service Providers; process subscriptions and transactions; display Service Provider profiles and map-based search results; communicate with you about your account and support requests; send you transactional and, where permitted, promotional communications; improve and personalize the Service; monitor usage patterns for product development; detect, investigate, and prevent fraud, abuse, and security issues; enforce our Terms of Service; and comply with legal obligations.

3. How We Share Your Information.

(a) With Other Users.

Profile information, ratings, and reviews may be visible to other users. Service Provider business information is displayed publicly on the Platform.

(b) With Third-Party Service Providers.

We share information with companies that perform services on our behalf, including: Firebase (Google) for authentication, database, analytics, crash reporting, and push notifications; Google for optional Google Sign-In and Google Calendar integration; RevenueCat for subscription billing and management; Apple for App Store transactions and Sign in with Apple authentication; Stripe for payment processing (including PCI-compliant handling of payment card and bank account information, processing of pilot payments to Service Providers, Stripe Connect onboarding, and payouts to Service Providers); and analytics providers for usage monitoring. These providers are contractually obligated to use your information only for the purposes for which it was disclosed and in accordance with applicable law. Each of these providers is responsible for its own privacy practices, and we encourage you to review their privacy policies.

(c) For Legal Reasons.

We may disclose information to: comply with applicable laws, regulations, or legal processes; enforce our Terms of Service; respond to lawful requests from public authorities, including law enforcement; detect or prevent fraud, security issues, or technical problems; or protect the rights, property, or safety of PilotConnect, our users, or the public.

(d) Business Transfers.

In the event of a merger, acquisition, reorganization, bankruptcy, or asset sale, your information may be transferred as part of that transaction. We will provide notice before your personal information becomes subject to a different privacy policy.

(e) No Sale of Personal Information.

We do not sell, rent, or trade your personal information to third parties for their marketing purposes. We do not share your personal information for cross-context behavioral advertising.

4. Data Retention.

We retain your information for as long as your account is active or as needed to provide the Service. After account deletion, we will delete or anonymize your personal information within thirty (30) days, except for information we are required or permitted to retain for: compliance with legal obligations (such as tax, accounting, or regulatory requirements); resolution of disputes; enforcement of our agreements; fraud prevention; and backup or archival purposes, for a period not to exceed twelve (12) months following deletion. Aggregated or de-identified data that cannot reasonably be used to identify you may be retained indefinitely for analytics and product improvement purposes.

You may request account deletion at any time through the in-app account settings or by contacting info@pilotconnectapp.com.

5. Data Security.

We implement commercially reasonable administrative, technical, and physical safeguards to protect your information, including encryption via Firebase's security infrastructure, secure authentication protocols, access controls, and encrypted data transmission. However, no method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.

Security incident notification. In the event of a security incident or data breach affecting your personal information, we will notify you and applicable authorities consistent with applicable law, including but not limited to state breach-notification statutes such as the New York SHIELD Act, California Civil Code § 1798.82, and other state and federal requirements. Notice will generally be provided without unreasonable delay and, where required by law, within statutorily mandated timeframes (typically not to exceed thirty (30) days after discovery; sooner where law requires).

PilotConnect does not store your password in plaintext. Passwords are cryptographically hashed before storage using industry-standard algorithms, and we do not have the ability to retrieve your original password. If you authenticate via Sign in with Apple or another third-party provider, we do not receive or store your password at all. All data transmitted between your device and our servers is encrypted in transit using TLS (Transport Layer Security). Data stored on our servers is encrypted at rest using the encryption mechanisms provided by our cloud infrastructure.

Access to personal information is restricted to authorized personnel who require such access to operate, develop, or improve the Service, and who are subject to confidentiality obligations. We regularly review our data collection, storage, and processing practices to guard against unauthorized access.

6. Your Choices and Rights.

(a) Account Information.

You may view, update, correct, or delete your account information at any time through account settings or by contacting us at info@pilotconnectapp.com.

(b) Account Deletion.

You may delete your account through the in-app account settings. See Section 4 above for details on data retention following deletion.

(c) Location Data.

You can control location data collection through your device settings. Disabling location services may limit the functionality of certain features, including map-based Service Provider search.

(d) Push Notifications.

You can opt out of push notifications through your device settings.

(e) Promotional Communications.

You may opt out of promotional emails by following the unsubscribe instructions in any promotional email or by adjusting your account settings. Opting out of promotional communications does not affect transactional or account-related messages.

7. Sensitive Personal Information.

The California Privacy Rights Act of 2020 ("CPRA") and analogous state laws define certain categories of personal information as "Sensitive Personal Information" ("SPI") and require additional disclosures and rights. The categories of SPI we collect, and the purposes for which we collect them, are:

Precise geolocation — collected with your permission when you use map-based features (Finder, nearby airports, alternate-airport selection). Used to display nearby Service Providers and compute travel-related pricing. Not used for any other purpose.

Account log-in credentials (email + password or third-party authentication tokens) — collected and stored solely to authenticate your account. Passwords are cryptographically hashed and are not accessible to us in plaintext.

Contents of private communications (messages sent through the in-app messaging system) — collected solely to deliver messages to the intended recipient and to enable moderation in response to user reports. We do not read your messages for advertising, analytics, or any purpose other than operating the Service, responding to reports, and complying with law.

Government identifiers and financial account information for Service Providers (Social Security Number, Employer Identification Number, bank account, etc.) — collected and stored directly by Stripe, our Payments Processor, during Stripe Connect onboarding. PilotConnect does not see or store these identifiers on its own servers.

You have the right to limit our use and disclosure of SPI to the purposes necessary to provide the Service requested. To exercise this right, contact us at info@pilotconnectapp.com. We do not use SPI for any purpose beyond providing the Service, complying with law, or as otherwise permitted under CPRA § 1798.121(b).

8. California Privacy Rights (CCPA/CPRA).

If you are a California resident, you have certain rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA"), including:

• The right to know what personal information we collect, use, disclose, and sell or share, including the categories of personal information, the purposes of collection, the categories of sources, and the categories of third parties to whom we disclose personal information.
• The right to delete personal information we have collected from you, subject to certain exceptions.
• The right to correct inaccurate personal information that we maintain about you.
• The right to opt out of the sale or sharing of your personal information. We do not sell or share personal information as defined by the CCPA.
• The right to limit the use and disclosure of sensitive personal information to purposes necessary to provide the Service.
• The right to non-discrimination for exercising any of your CCPA rights.

To exercise these rights, contact us at info@pilotconnectapp.com. We will verify your identity before processing your request. You may also designate an authorized agent to make a request on your behalf by providing written authorization.

Categories of personal information we collect include: identifiers (name, email, phone number, account ID); commercial information (subscription history, booking and transaction records); internet activity (usage data, device information); geolocation data; financial information (Stripe customer ID and transaction records; full payment card and bank account numbers are stored exclusively by our Payments Processor and never reach our servers); visual or image information (profile and aircraft photos, certificate document uploads); and professional information (FAA certificates, aviation qualifications). We collect this information for the business purposes described in Section 2 above. We disclose personal information to the categories of third parties described in Section 3 above.

9. Other State Privacy Rights.

If you are a resident of Colorado, Connecticut, Delaware, Indiana, Iowa, Montana, Oregon, Tennessee, Texas, Utah, or Virginia (and other states that subsequently enact comprehensive consumer-privacy legislation), you may have additional rights under your state's laws, including:

• Right to access — to know what categories of personal information we have collected about you and to request a copy.
• Right to correct — to request correction of inaccurate personal information.
• Right to delete — to request deletion of personal information collected from you, subject to legal exceptions.
• Right to data portability — to receive a copy of your personal information in a portable, readily usable, machine-readable format where technically feasible.
• Right to opt out of sale, sharing, targeted advertising, and profiling for decisions that produce significant effects. We do not sell personal information, share it for cross-context behavioral advertising, or engage in such profiling.
• Right to appeal — if we deny your request, you may appeal by replying to our response within forty-five (45) days. We will respond to appeals within sixty (60) days of receipt, or as otherwise required by applicable law.

To exercise any of these rights, contact info@pilotconnectapp.com with your name, state of residence, and the right you wish to exercise. We will verify your identity before processing your request and respond within the timeframe required by applicable law (generally 45 days, extendable to 90 days where permitted). We will not discriminate against you for exercising these rights.

10. Children's Privacy.

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we will promptly delete such information. If you believe a child under 13 has provided us with personal information, please contact us at info@pilotconnectapp.com.

11. Third-Party Links and Services.

The Service may contain links to third-party websites, services, or applications not operated or controlled by PilotConnect. This Privacy Policy does not apply to those third-party services. We are not responsible for the content, privacy policies, or practices of any third-party services. We encourage you to review the privacy policies of any third-party services you access through or in connection with the Platform.

12. International Users.

The Service is operated from the United States and is intended for users located in the United States. If you access the Service from outside the United States, you understand and consent to the transfer, processing, and storage of your information in the United States, where data protection laws may differ from those in your jurisdiction.

PilotConnect does not target or solicit users in the European Union, the United Kingdom, or other jurisdictions covered by the General Data Protection Regulation, the UK GDPR, or similar non-U.S. data-protection regimes, and does not offer goods or services within the meaning of Article 3(2) of the GDPR. If you reside in such a jurisdiction and choose to use the Service, you acknowledge that you do so on your own initiative and are responsible for compliance with the laws of your jurisdiction. We will nonetheless honor reasonable access, correction, and deletion requests from any user regardless of location, consistent with Sections 6, 8, and 9 above.

13. Firebase and Analytics Disclosure.

PilotConnect uses Google Firebase, which may collect and process data including: authentication data and tokens; cloud database records; push notification tokens; usage analytics and event data; and crash reports and diagnostics. Firebase's data processing is governed by Google's privacy policies. You may opt out of certain analytics data collection through your device settings.

14. Payments Processing Disclosure.

Payments on the Platform are processed by Stripe, Inc. ("Stripe"). When you add a payment method or accept payments as a Service Provider:

Stripe collects and stores your payment information directly, including credit or debit card numbers, bank account numbers, and any identity verification information required for Stripe Connect onboarding. PilotConnect does not receive, store, or process full payment card or bank account numbers on its own servers. We retain only non-sensitive references (such as your Stripe customer ID, Stripe account ID, the last four digits of cards on file, and transaction metadata) that allow us to identify and operate your account.

Stripe's collection, use, and protection of your information is governed by Stripe's Privacy Policy, available at https://stripe.com/privacy. When you provide payment information through the Platform, you are also entering into a separate agreement with Stripe.

Service Providers who onboard with Stripe Connect agree to Stripe's Connected Account Agreement. Payouts to Service Providers, KYC (Know Your Customer) verification, tax form generation, and chargeback handling are administered by Stripe.

15. Notification Preferences.

You may control the categories of push and email notifications you receive through the in-app Settings > Notifications screen. You may also disable notifications entirely through your device settings. Transactional and account-related notifications (such as booking confirmations, payment receipts, and security alerts) may continue to be delivered for active accounts as necessary to operate the Service.

16. Changes to This Privacy Policy.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy within the Service and updating the "Last Updated" date. For material changes, we will provide additional notice through the Service or via email. Your continued use of the Service after the effective date of any changes constitutes your acceptance of the revised Privacy Policy. If you do not agree to the revised Privacy Policy, you must stop using the Service.

17. Contact.

Questions about this Privacy Policy should be directed to:

PilotConnect App LLC

Email: info@pilotconnectapp.com