Privacy Policy

1. Introduction

Aerial Sensing AI ("Company," "we," "us") operates PreBrief, a preflight risk assessment tool for FAA Part 107 UAS operators. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

2. Information We Collect

2.1 Information You Provide

• Account information: Name, email address, business name, Part 107 certificate number (optional), phone number (optional)
• Mission data: Location coordinates, flight parameters, altitude, aircraft details, crew configuration, operation type
• Email opt-in: Email address provided for PDF report delivery
• Branding data: Business logo, company name for Evidence Pack personalization (optional)

2.2 Information Collected Automatically

• Usage data: Pages visited, features used, wizard completion rate, brief generation frequency
• Device information: Browser type, operating system, screen resolution
• IP address: Used for rate limiting and approximate geolocation (country/state level)
• Timestamps: Account creation, login times, brief generation times

2.3 Information We Do Not Collect

• Real-time GPS or telemetry data from aircraft
• In-flight video, images, or sensor data
• Payment or financial information (no paid features at this time)
• Social Security numbers or government identification numbers

3. How We Use Your Information

• Service delivery: Generate preflight risk briefs, produce Evidence Pack PDFs, resolve airspace data for your location
• Account management: Maintain your profile, saved sites, mission history
• Communication: Send requested PDF reports via email, password reset emails, service notifications
• Service improvement: Analyze usage patterns to improve the product (aggregated, not individual-level)
• Lead classification: Segment users by operation type and volume for relevant product communications
• Legal compliance: Respond to lawful requests from authorities, protect against fraud

4. Data Sensitivity — Mission Locations

We treat saved mission locations and site profiles as sensitive data. Client site locations may reveal proprietary business information about your operations.

• Site locations are stored in our database with access restricted to your account only
• We do not sell, share, or disclose individual mission locations to third parties
• Aggregated, anonymized location data (e.g., "35% of briefs are in Class G airspace") may be used for product analytics
• Shared brief links expire after 7 days and are access-controlled

5. Data Sharing

We do not sell your personal information. We may share data in the following circumstances:

• Service providers: Email delivery (SMTP), hosting infrastructure — bound by confidentiality agreements
• Legal requirements: When required by law, subpoena, or court order
• Business transfers: In connection with a merger, acquisition, or sale of assets (with notice)
• With your consent: When you explicitly choose to share a brief via a share link

We do not share your data with advertising networks, data brokers, or social media platforms.

6. Data Retention

7. Data Security

We implement industry-standard security measures including:

• Passwords hashed with Argon2id (memory-hard, GPU-resistant)
• JWT-based authentication with short-lived access tokens (15 min) and rotated refresh tokens
• HTTPS encryption in transit (TLS 1.2+)
• PostgreSQL with row-level access controls
• Rate limiting to prevent brute-force attacks
• No plaintext storage of credentials or secrets

No system is 100% secure. In the event of a data breach affecting your personal information, we will notify affected users within 72 hours of discovery.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access: Request a copy of personal data we hold about you
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your account and associated data
• Export: Request a machine-readable export of your data (JSON)
• Opt-out: Unsubscribe from marketing communications at any time
• Restrict processing: Request that we limit how we use your data

To exercise these rights, contact us at privacy@aerialsensing.ai. We will respond within 30 days.

9. Cookies and Local Storage

PreBrief uses:

• Session storage: Wizard state (cleared when browser tab closes) — no tracking
• HTTP-only cookies: Refresh token for authentication (not accessible to JavaScript)
• No third-party cookies: We do not use advertising or analytics cookies from third parties
• No fingerprinting: We do not use browser fingerprinting techniques

10. Children's Privacy

The Service is intended for licensed drone operators (minimum age 16 for Part 107 certification). We do not knowingly collect information from children under 16. If we learn that we have collected data from a child under 16, we will delete it promptly.

11. International Users

PreBrief is designed for U.S.-based Part 107 operations. If you access the Service from outside the United States, your information will be transferred to and processed in the United States. By using the Service, you consent to this transfer.

12. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information is collected, the right to delete, and the right to opt-out of the sale of personal information. We do not sell personal information.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via the Service or email. The "Last updated" date at the top reflects the most recent revision.

14. Contact Us

For privacy-related inquiries:

Aerial Sensing AI
Privacy Officer
Email: privacy@aerialsensing.ai