Avion Desk is software for running a flight department: trips, crew, aircraft and maintenance, and the money that goes with them. It is provided by Avion Desk, LLC (“we”, “us”). This policy says what information the service holds, why, who else handles it, and what you can ask of us.
Who controls the data
Each organization that subscribes (an “operator”) decides what it records about its own people, passengers and clients. For that information the operator is the controller and we process it on the operator’s behalf and on its instructions. If you are a crew member, passenger or client of an operator and want to see, correct or remove what it holds about you, ask the operator first; we will help it answer.
We are the controller for the account information we need to run the service itself: who signs in, who pays, and how the service is used.
What we hold
- Account details: your name, email address and sign-in history. Sign-in is handled by Clerk, by an emailed code or with Google; we never see or store a password.
- The operator’s details: its name, settings, members and their roles, and its billing contact.
- Crew records: names, contact details, positions, certificates, medical certificate dates, training and qualifications, duty and flight time. The most sensitive of these (dates of birth, nationality, home and US addresses, medical notes, certificate numbers) are encrypted field by field before they are stored.
- Passengers and travel documents: names, contact details, weights and preferences the operator enters, and passport or other travel document details. Document numbers, names on documents and issuing countries are encrypted field by field.
- Trips: legs, airports, times, aircraft, crew and passengers on each leg, risk assessments, requests and changes.
- Customs records: when a pilot records an eAPIS filing, we keep an encrypted copy of what was filed.
- Aircraft and maintenance: tails, counters (hours, landings, cycles), maintenance items, defects, downtime and flight logs.
- Money: expenses and receipts, vendors, fuel prices, rate cards, quotes, invoices, credit notes and payments recorded against them.
- Messages: conversations between members of an operator.
- Files you upload: receipts, aircraft documents and other attachments.
- Client portal users: the name and email of an operator’s client who is invited to see their own trips, quotes and invoices, and, when a client accepts a quote, the time, network address and browser it was accepted from.
- A history of changes: who changed which record and when. Encrypted fields are masked in that history.
- Technical information: error reports and server logs needed to keep the service working.
We do not receive or store card numbers. Payments are taken by Stripe, and we keep only what Stripe tells us about the subscription (its plan, status, dates and number of aircraft).
Why we use it
- To provide the service the operator subscribed to, including the features its members use.
- To sign people in and keep accounts secure.
- To bill for the subscription.
- To send the emails the service needs: sign-in codes, invitations, messages to an operator’s clients about their trips, quotes and invoices, and notices about connected services.
- To find and fix faults, and to protect the service and its users from misuse.
- To meet our legal obligations.
Put simply, we use information to perform our contract with the operator, for our legitimate interest in running a safe and reliable service, and where the law requires it. We do not sell personal information, we do not use it for advertising, and we do not use customer data to train machine-learning models.
Who else handles it
We use a small number of service providers, each only for its part of the service:
- Clerk: sign-in and account management.
- Stripe: subscription billing, payments and sales tax.
- Cloudflare: the network that carries traffic to the service and our website, its protection against attacks and bots (including the check on the website’s demo form), and file storage (Cloudflare R2) for uploaded files.
- Resend: sending the service’s emails and the requests sent through the website’s demo form.
- Sentry: error reports from our servers. Reports are set up to leave out request bodies, cookies, network addresses and the values of sensitive fields.
- Anthropic: reads the text a person types into Quick add, with the names of the operator’s aircraft and crew, to suggest a trip or time off for them to check. Only if the operator uses Quick add. Anthropic does not use it to train its models.
- Intuit (QuickBooks Online): only if an operator connects its QuickBooks company. Before connecting, the operator is shown exactly what is sent, and agrees to it.
- A maintenance tracking provider: only if an operator connects one. What is exchanged is shown before connecting.
eAPIS filings are made by the operator’s pilot in their own account with US Customs and Border Protection (CBP). Avion Desk does not send anything to CBP; it keeps a record of what was filed.
We may also disclose information when the law requires it, or to a buyer of our business, who would be bound by this policy.
How we protect it
- All traffic to and from the service is encrypted in transit (HTTPS).
- Sensitive fields are encrypted at rest with AES-256-GCM before they reach the database; the encryption keys are kept outside the database and its backups.
- Each operator’s records are kept apart by the database itself: every operator-owned table carries row-level security, so one operator’s members cannot read another’s records.
- Database backups are made nightly, checked, encrypted, and copied to a second location.
- Access to the production servers is limited to the people who run them.
No system is perfectly secure. If a breach affects your information, we will tell the operator, and you where the law requires, without undue delay.
How long we keep it
We keep an operator’s records while its account exists, so its history stays complete. Removed records are marked as removed rather than erased straight away. eAPIS filing records keep travelers’ details for five years, after which those details are blanked.
After an operator’s account closes we keep its data for one year, so it can be exported, and then delete it. Copies in our encrypted backups are deleted as those backups age out, within 60 days.
When someone deletes their sign-in account, their access ends; the operator’s records that mention them remain the operator’s.
Your choices and rights
Depending on where you live, you may have the right to see the personal information held about you, to correct it, to have it deleted, to receive a copy, or to object to how it is used. For records an operator keeps about you, ask the operator. For your own account, or if you cannot reach the operator, write to [email protected]. We will answer within the time the law sets, and we will not treat you differently for asking.
Cookies and similar storage
The service uses only what it needs to work:
- Clerk’s session cookies, which keep you signed in.
- Cookies Cloudflare may set to protect the service against bots and attacks, including the bot check on the sign-in page.
- Your browser’s own storage, for preferences such as how times are shown, and to hold an invitation while you sign in.
There are no advertising or tracking cookies and no third-party analytics.
The demo request form on our website
Our marketing website has a form for asking for a demo, asking about pricing or asking a question. It is separate from the service; this section says what happens to what you send through it.
The form asks for your name, work email, company, the kind of operation you run, roughly how many aircraft it flies and what you are asking about. Your role, a phone number and a message are optional.
What you send is emailed to us through Resend, and Resend emails you a confirmation. We use it only to answer you. The website keeps no database: the request is kept in our email for 24 months, and the website’s logs record only whether a request went through, never what was in it.
Cloudflare Turnstile checks that the form is sent by a person and not a bot. It runs only on the form’s page; to make the check, Cloudflare processes information about your browser and device and your network address.
The marketing website sets no cookies of its own and runs no analytics or trackers. Cloudflare may set cookies to protect it against bots and attacks.
Children
The service is for businesses and is not meant for anyone under 16. We do not knowingly collect information from children. An operator may record a child as a passenger; that record is the operator’s, under its responsibility.
Where the data is
Our servers and their backups are in the United States. Some of the providers above may handle information in other countries; where they do, they are bound to protect it.
Changes to this policy
If we change this policy, we will update the date at the top. If the change is significant, we will tell operators’ administrators by email or in the service before it takes effect.
Contact
Questions about privacy go to [email protected].
