Privacy Policy

1. Introduction

General Aviation Solutions LLC ("we", "us", "our") operates SkyFSBookings. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

2. Information We Collect

We collect information you provide directly, including:

Account information: name, email address, phone number, and password when you create an account.

Flight school data: aircraft registrations, booking schedules, pilot currency records, and other operational data you enter into the Service.

Billing information: payment details are processed and stored by Paddle, our payment processor. We do not store credit card numbers on our servers.

Pilot certification and currency data: flight review and medical certificate expiration dates, medical certificate class, pilot ratings, landing and instrument currency dates, and any notes you submit with a currency update. We collect this to operate currency tracking and alerts. We do not collect medical conditions, diagnoses, treatment information, or the contents of any medical examination.

Flight records and charges: Hobbs and tach meter readings recorded when a booking is completed, the flight and instruction time derived from them, and the resulting charge calculated at your school's rates.

Push notification data: if you enable browser notifications, we store the push endpoint and encryption keys your browser generates. These identify your browser to the push service, not you personally, and are deleted when you disable notifications.

Marketing contacts: if you subscribe to our newsletter or submit a contact or discovery flight form, we collect the email address and any contact details you provide, along with the page you submitted from.

Usage data: we automatically collect information about how you interact with the Service, including IP addresses, browser type, pages visited, and timestamps.

3. How We Use Your Information

We use your information to: provide and maintain the Service, process transactions, send transactional emails (booking confirmations, currency alerts, account notifications), improve and optimize the Service, respond to customer support requests, and comply with legal obligations.

Marketing email — product news, tips, and the newsletter — is sent only to people who asked for it, by ticking the optional box at signup or by subscribing on our website. We record when that consent was given, and withdrawing it takes effect immediately.

4. Data Sharing

We do not sell your personal information. We may share your information with:

Service providers: third-party companies that help us operate the Service. We use Supabase for database and authentication hosting, Vercel for application hosting and for cookieless traffic and performance analytics (Vercel Analytics and Speed Insights), Paddle as our merchant of record for payments and subscription billing, and Resend for email delivery. When we send transactional or notification emails through Resend, message content — which may include pilot names, aircraft identifiers, booking details, and currency alert information — passes through Resend's servers. Each of these providers processes data solely to deliver its service to us and is bound by its own privacy and data processing terms. We do not sell personal information, and we do not share it for cross-context behavioral advertising.

Within your organization: administrators at your flight school or club can view the profiles, booking history, flight records and charges, currency records — including medical certificate class and expiration date — submitted currency notes, feedback, and support tickets of every member of that organization, and can export the member roster and booking history to CSV.

Legal requirements: we may disclose information if required by law, court order, or governmental regulation.

5. Data Isolation

Each flight school organization's data is logically isolated. Users from one organization cannot access data belonging to another organization. We enforce this isolation at both the application and database levels.

6. Data Security

We implement security measures including encryption of data in transit (TLS/SSL), encryption of data at rest, row-level security policies at the database level, and authentication with hashed passwords managed by our authentication provider. We review our security posture periodically and remediate issues we identify on a risk-prioritized basis. No method of electronic storage or transmission is completely secure, and we cannot guarantee absolute security.

7. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. Upon account termination, we retain organization data for 30 days to allow for reactivation, after which it is permanently deleted. This 30-day period matches the account termination provisions in our Terms of Service.

Other categories are retained as follows: marketing and newsletter contacts until you unsubscribe, and in any case no more than 24 months after your last interaction with us; discovery flight inquiries for 24 months from submission, or until the associated organization's account is deleted; audit and security logs for 24 months; email delivery records for 12 months; billing records for seven years, as required for tax and accounting purposes. We do not retain personal information indefinitely.

When you unsubscribe from our newsletter we delete your email address within 30 days and keep only a one-way cryptographic hash of it. The hash cannot be read back into an address; we hold it solely so that we can recognise your earlier opt-out if that address ever reaches our list by any route other than you choosing to sign up again yourself.

8. Your Rights

You have the right to: access your personal data, correct inaccurate data, request a copy of your data, request deletion of your account and associated data, and opt out of non-essential communications. Administrators can export their organization's roster, bookings, and maintenance costs to CSV from the admin dashboard at any time. If you are a student, pilot, member, or instructor and want a copy of your own data or want it deleted, contact us at the email below and we will action the request; we aim to respond within 30 days.

Every email we send carries a link to your email preferences, where operational email (bookings, the daily summary, announcements from your school) and marketing email can each be turned off without signing in. The same two settings live in the app under Settings. Replies to your own support tickets and feedback, and messages about your account or password, are answers to something you started and are not affected.

Depending on your location, you may have additional rights under applicable privacy laws — including the California Consumer Privacy Act (CCPA) for California residents or the General Data Protection Regulation (GDPR) for individuals in the European Economic Area. We strive to provide these protections to all our users regardless of their location. If you believe you have rights under these or other local privacy laws, please contact us and we will respond accordingly.

9. Cookies

We use essential cookies required for authentication and session management. We also use Vercel Analytics and Vercel Speed Insights to understand aggregate traffic and page performance; these are cookieless, do not track you across sites, and do not build an advertising profile. We do not use advertising cookies, and we do not sell or share personal information for cross-context behavioral advertising.

10. Children's Privacy

The Service is intended for use by flight schools, flying clubs, and their instructors, pilots and students. It is not directed to children under 13, and we do not knowingly collect personal information from children under 13.

Flight school and club administrators are responsible for the accounts they create. Our Terms of Service prohibit them from creating an account for, or entering personal information about, any individual under 13. That is an absolute restriction rather than a consent requirement: we do not offer a way to obtain parental consent, because we do not accept the data in the first place.

We set no other age limit. Flight training is lawfully undertaken by minors, and members aged 13 and over may hold accounts under their school's agreement with us.

If we learn that we have collected personal information from a child under 13, we will delete it promptly. If you believe a child under 13 has provided us with personal information, contact us at support@skyfsbookings.com and we will investigate and delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes via email or through the Service. The "last updated" date at the top of this page indicates when it was last revised.

12. Contact

For questions about this Privacy Policy or your data, contact us at support@skyfsbookings.com, or by mail at the address below.