Privacy Policy

0. Scope

This Privacy Policy explains how Aetherion Arc LLC (“we,” “us”) collects, uses, shares, and protects personal information across the ATLAS platform (atlascfi.com), the DebriefCFI platform (debriefcfi.com), and any other website, application, hardware, or service that Aetherion Arc LLC operates and that links to this Policy (together, the “Service”). It works together with our Terms of Service.

1. What we collect

• Account data: email, name, role (student / CFI / school admin), and school affiliation
• Training data: quiz responses, session notes, lesson reflections, debrief inputs, phase and competency progress, and your conversations with the Atlas assistant
• Sensitive information (only if you or your school provide it): medical-certificate status and related training-eligibility notes. See Section 8 for your right to limit its use.
• Payment data: processed by Stripe. We receive limited billing details (e.g., last four digits, plan, status); we never receive or store your full card number.
• Signature data: electronic signatures, initials, and sign-offs you apply through the Service
• Schedule data (optional): if you connect Gmail, we read only emails from SchedulePointe (postmaster@mail.schedulepointe.com) to sync lesson schedules. We do not read other email.
• Usage data: pages visited, features used, session timestamps
• Device data: browser type, IP address, operating system (standard server logs)

2. How we use it

• To provide the Service and personalize your training experience
• To generate AI-powered training content relevant to your phase and progress
• To send lesson reminders and training notifications (you can opt out)
• To process payments and manage subscriptions
• To secure the Service, prevent fraud and abuse, and enforce our Terms
• To improve the platform using aggregate, de-identified usage patterns
• To comply with legal obligations

We use any sensitive information (such as medical-certificate status) only to provide the training features you or your school expect — not to infer characteristics about you and not for advertising. We do not sell or “share” your personal information (as those terms are defined under California law), and we do not use your training data for advertising.

3. AI and your data

To generate responses, the Service sends portions of your training history and session context to AI providers, including Anthropic (Claude) and, for radio-trainer voices, ElevenLabs. These providers process the data as our service providers and, by default, do not use it to train their models. We send only what is needed to produce the response — we do not send your payment information, and we minimize other identifiers. AI output can be wrong; see Sections 2, 9, and 10 of the Terms of Service.

4. Gmail integration

If you connect Gmail for SchedulePointe sync, we store OAuth tokens to access your Gmail account. We use the gmail.readonly scope and query only emails from postmaster@mail.schedulepointe.com. We do not read, store, or process any other emails. Our use of information from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can disconnect at any time from your account settings.

5. Service providers (subprocessors)

We share personal information with vetted service providers who process it on our behalf under contracts that restrict their use of it:

• Supabase — database, authentication, and storage (US)
• Vercel — application hosting and delivery (US)
• Anthropic — AI model provider (Claude)
• ElevenLabs — text-to-speech for radio-trainer voices
• Stripe — payment processing (we never see your full card number)
• Resend — transactional email delivery
• PostHog — product analytics (usage patterns; US-hosted)
• Google — optional Gmail sync (read-only, SchedulePointe emails only) and airport place details
• Twilio — SMS/voice notifications (when enabled)

We may add or change subprocessors as the Service evolves and will update this list. We may also disclose information to comply with law, enforce our Terms, protect safety, or in connection with a merger, acquisition, or sale of assets.

5a. Visibility within your school

ATLAS is a training tool shared between you, your instructor, and your flight school. If you are enrolled with a school or assigned to an instructor, your training records — lesson history, progress, competency and study activity, medical-certificate status, and your conversations with the Atlas assistant — are visible to your instructor and your school's authorized staff so they can coach you. Your school and instructor are independent parties responsible for their own use of your information.

If you leave a school or change instructors, that school's and instructor's ongoing access to your account ends. Training records the school or instructor created about you (for example, logged lessons and debrief grades) may remain part of the school's own records, consistent with their obligations as your training provider and applicable law. Your personal ATLAS account and study data remain yours.

5b. Lesson recording & consent

Some future features may let instructors or students record lesson audio to power debrief and feedback. Where recording is offered, we will require the consent of all participants before any recording begins, consistent with California's two-party (all-party) consent law. You control whether to record, and recordings are treated as your training data under this Policy. Do not record anyone without their consent.

6. Data retention

We keep your personal information while your account is active and as needed to provide the Service. If you delete your account, we delete or de-identify your personal information within 30 days, and purge it from routine backups on our normal backup cycle, except where we must retain it to comply with law, resolve disputes, prevent fraud, or enforce our agreements. Records a school or instructor created about a student may be retained by that school or instructor as described in Section 5a. We may keep aggregate, de-identified data that cannot reasonably identify you.

7. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information, including encryption in transit, access controls, and row-level data isolation between schools. No method of transmission or storage is perfectly secure, so we cannot guarantee absolute security. If a breach affecting your personal information occurs, we will notify you as required by law.

8. Your privacy rights (including California)

You may exercise the following rights by emailing support@atlascfi.com:

• Know / access: the categories and specific pieces of personal information we hold about you and how we use them
• Delete: your personal information, subject to legal exceptions
• Correct: inaccurate personal information
• Limit sensitive information: we already limit sensitive information (such as medical-certificate status) to providing the Service you expect; you may direct us not to use it beyond that
• Opt out of sale/sharing: we do not sell or share your personal information, so there is nothing to opt out of, but you retain the right
• Non-discrimination: we will not deny service, charge different prices, or provide a different level of service because you exercised a right

We will verify your request against your account information before acting on it, and you may use an authorized agent (with proof of authorization). If you are a student enrolled with a school, some records are also controlled by your school (see Section 5a), and we may direct certain requests to them. We respond within the timeframes required by law. If we ever deny a request, we will explain why.

9. Children

The Service is not directed to children under 13, and we do not knowingly collect their personal information; if we learn we have, we will delete it — contact us at support@atlascfi.com. Users aged 13–17 may use the Service only with parental/guardian consent or through a school or instructor that has obtained the required consent, as described in our Terms of Service.

10. International users

We operate in the United States and process and store data in the US. If you access the Service from outside the US, you understand your information will be transferred to and processed in the US, where privacy laws may differ from those in your location.

11. Changes

We may update this Policy. We will post the updated version with a new effective date and, for material changes, provide notice by email or in-app at least 14 days before they take effect.

12. Contact

Aetherion Arc LLC · support@atlascfi.com