Privacy Policy

1. Data Controller

The data controller for personal data processed through the Service is:

2. Personal Data We Collect

2.1 Account Data

When you create an account, we collect: full name, work email address, organisation name, job title, country, and phone number (optional, for SMS authentication).

2.2 Authentication and Security Data

For multi-factor authentication and security purposes we collect: email OTP tokens (not stored after verification), TOTP authenticator secrets (stored encrypted), SMS verification codes (not stored after verification), IP addresses at login and Terms acceptance, and browser user agent strings.

2.3 Fleet and Compliance Data (Subscriber Data)

Aircraft registration numbers, aircraft type and serial number data, and maintenance compliance records entered by the Subscriber. This data may include personal data if the Subscriber enters information relating to individual maintenance engineers or accountable managers. Aviagent.ai acts as a data processor for this data category.

2.4 Usage Data

API access logs including endpoint, timestamp, IP address, and response code. Page access logs. Feature usage analytics (aggregated). Error and diagnostic data.

2.5 Payment Data

Payment processing is handled by our payment processor. Aviagent.ai does not store credit card numbers. We retain invoice data (amount, date, subscription plan) for accounting and VAT purposes as required by Norwegian law.

3. Legal Basis for Processing

4. Data Retention

5. Data Sharing and Third Parties

We do not sell personal data. We share personal data with the following categories of third parties only where necessary to operate the Service:

6. Data Subject Rights

Under GDPR, individuals whose personal data we process have the following rights. To exercise any right, contact privacynospam[at]aviagent[dot]ai. We will respond within 30 days.

• Right of access (Art. 15) — Obtain a copy of your personal data
• Right to rectification (Art. 16) — Correct inaccurate personal data
• Right to erasure (Art. 17) — Request deletion, subject to legal retention obligations
• Right to restrict processing (Art. 18) — Limit how we use your data
• Right to data portability (Art. 20) — Receive your data in machine-readable format
• Right to object (Art. 21) — Object to processing based on legitimate interests
• Right to withdraw consent — Where processing is consent-based (e.g. marketing)

Note: Some rights are subject to limitations where processing is required for compliance with legal obligations or for the performance of a contract.

7. Security

We implement the following technical and organisational security measures:

• Encryption of data in transit using TLS 1.2 or higher
• Encryption of sensitive data at rest (authentication secrets, TOTP keys)
• Password hashing using bcrypt with appropriate work factor
• JWT access tokens with short expiry periods
• IP address logging for all authentication events
• Access controls limiting employee access to personal data to those with a business need
• Regular security reviews of application dependencies and infrastructure

In the event of a personal data breach that is likely to result in risk to individuals, we will notify the Datatilsynet (Norwegian Data Protection Authority) within 72 hours and, where required, notify affected individuals without undue delay.

8. International Transfers

The Service is hosted on DigitalOcean infrastructure located within the European Economic Area (EEA). Where we use processors outside the EEA (currently only Twilio, which has EEA data centres available), we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission.

9. Cookies and Tracking

The Service uses the following types of cookies and local storage:

• Strictly necessary: Session tokens required for authentication — cannot be disabled
• Functional: User preferences (theme, language) — stored in localStorage
• Analytics: Aggregated usage metrics — no individual tracking cookies

We do not use third-party advertising cookies or tracking pixels.

10. Complaints

If you believe we have processed your personal data unlawfully, you have the right to lodge a complaint with:

11. Updates to This Policy

We may update this Privacy Policy to reflect changes in our processing activities or in applicable law. Material changes will be notified by email at least 30 days before the effective date. The current version is always available at aviagent.ai/privacy.