Privacy Policy

2.1 Account Information

When you create an account or are invited to join an agency's account, we collect:

• Name and email address
• Role and position within your organization
• Authentication credentials (managed by our authentication provider, Clerk)
• Profile preferences and settings

2.2 Operational Data

The Service is designed to help law enforcement aviation units manage their operations. Depending on how your agency uses the Service, we may process:

• Flight records (dates, times, durations, crew members, mission types)
• Aircraft information (tail numbers, types, configurations)
• Maintenance records and schedules
• Pilot compliance and training records
• Fuel management data
• Equipment tracking information
• Mission tracking data as configured by your agency

2.3 Technical Information

We automatically collect certain technical information when you use the Service:

• IP address and general location (country/region)
• Browser type and version
• Device type and operating system
• Usage patterns and feature interactions
• Error logs and performance data

2.4 Information We Do Not Collect

AirUnit does not collect or store:

• Criminal justice information (CJI) subject to CJIS Security Policy
• Case file information or investigative data
• Personal information about subjects of law enforcement activity
• Social Security numbers or financial account information

The Service is designed for aviation operations management, not criminal justice information systems.

4.1 Data Location

All data is stored on servers located in the United States. We use the following infrastructure providers:

• Neon (PostgreSQL database hosting) — US-East region
• Vercel (application hosting) — US region
• Amazon Web Services (backup storage) — US-East region

We do not transfer data outside the United States.

4.2 Security Measures

We implement comprehensive security measures to protect your data:

• Encryption: All data is encrypted at rest and in transit using industry-standard protocols (TLS 1.2+, AES-256).
• Database Security: Row-Level Security (RLS) policies ensure complete tenant isolation at the database level.
• Access Controls: Role-based access control (RBAC) limits data access based on user roles within your organization.
• Authentication: Multi-factor authentication (MFA) is available and recommended for all users.
• Backups: Automated daily backups with point-in-time recovery capability.
• Infrastructure: All infrastructure providers (Neon, Vercel, Clerk) maintain SOC 2 Type II certification.

For more details, see our Security Overview.

4.3 Data Retention

We retain your data for as long as your subscription is active. Upon termination of service, we retain data for a 90-day grace period to allow for data export, after which data is permanently deleted within 30 days. Backup data may be retained for an additional period as necessary for disaster recovery purposes.

7.1 Access and Export

Agency administrators can access, review, and export their organization's data at any time through the Service's data export features. Individual users can access and update their account information through their profile settings.

7.2 Correction

You may correct inaccurate personal information through the Service or by contacting us. Agency administrators can update organizational data.

7.3 Deletion

Upon termination of service, all agency data is deleted in accordance with our data retention policy. Individual users who leave an agency may request removal of their personal information.

7.4 Communication Preferences

You may opt out of non-essential communications, but we may still send important notices about security, service updates, and legal matters.