Privacy Policy

This policy applies to all users of the Service, including pilots who hold accounts and visitors who browse the public pilot directory.

By using the Service, you consent to the collection, use, and disclosure of your personal information as described in this policy. If you do not agree with this policy, you should not use the Service.

We are committed to handling your personal information in accordance with the Privacy Act 1988 and the Australian Privacy Principles.

We collect the following types of personal information:

Account information:

• Full name and email address
• Password (stored as a one-way hash — we cannot see your plain password)
• Phone number and physical address (if provided)

Business information:

• Business name, ABN, ACN, and GST registration status
• Business logo and brand colour preferences
• Bank account details (BSB and account number) for invoice display

Client information (entered by you, the pilot, on behalf of your clients):

• Client names, email addresses, phone numbers, and addresses
• Job details, quotes, and invoice records associated with clients

Compliance documents:

• CASA RePL and ReOC credentials
• Insurance certificates
• Medical certificates and operator accreditations

Financial information:

• Invoices, quotes, expenses, and payment records
• Stripe Connect account ID (for processing client payments)
• Stripe customer ID (for your platform subscription)

Usage and technical information:

• Login times and session data
• Feature usage and interaction data within the Service
• AI assistant conversation history
• IP address and device/browser information

Public directory information (opt-in only):

• Business or pilot name, bio, specialties, and service areas
• Portfolio images and certifications
• Public contact details (phone, email) if you choose to display them
• Business suburb or postcode and map location

Sensitive information: We do not knowingly collect sensitive information (such as health information, racial or ethnic origin, or political opinions) except where you voluntarily upload compliance documents that may contain such information (e.g., medical certificates). We handle such information in accordance with APP 3 and only use it for the purpose you provided it.

We collect personal information:

• Directly from you — when you create an account, fill in your business profile, enter client details, upload compliance documents, or submit a public directory profile
• Automatically — through your use of the Service (usage data, session information, IP address)
• From third parties — when you connect your Google Calendar (we receive your Google account email and calendar event data) or when Stripe processes a payment (we receive transaction status and account identifiers)

If you enter client information into the Service, you are the collector of that information and are responsible for ensuring you have the appropriate consent and authority to store it in a third-party platform.

We use your personal information for the following purposes:

• Providing the Service — hosting your business data, generating quotes and invoices, tracking jobs and expenses, and managing equipment and compliance records
• Account management — authenticating your login, managing your subscription, and communicating with you about your account
• Billing — processing subscription payments through Stripe and managing your Stripe Connect account for client payments
• AI assistant — processing your prompts and conversation history to generate responses within the Service
• Public directory — displaying your opt-in profile to potential clients who visit the directory
• Communication — sending service notifications, security alerts, and support responses
• Improvement — analysing usage patterns to improve features, fix bugs, and develop new capabilities
• Legal compliance — meeting our obligations under Australian law, including tax record-keeping and responding to lawful requests
• Referral program — tracking referral codes and applying subscription discounts when referrals convert

If we intend to use your personal information for a purpose not listed here, we will seek your consent first, unless the use is required or authorised by law.

We may disclose your personal information to:

• Stripe — for processing subscription payments and facilitating client payments through Stripe Connect. Stripe handles card data directly; we do not store full card numbers.
• Google — if you connect your Google Calendar, we exchange data with Google's APIs to synchronise your job schedule. This is optional and only activated if you choose to connect.
• Base44 — our platform infrastructure provider that hosts the Service and stores your data. Base44 acts as our subprocessor under appropriate data processing arrangements.
• Cloud service providers — third parties that provide hosting, analytics, email delivery, and other infrastructure services that support the Service
• Law enforcement and regulators — where required or authorised by Australian law, including in response to court orders, subpoenas, or requests from government agencies

We do not sell your personal information to third parties. We do not share your data with third parties for their own marketing purposes.

Your personal information is stored on cloud infrastructure operated by Base44 and its sub-providers, which may be located outside Australia (including in the United States or other countries).

Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure that the recipient does not breach the Australian Privacy Principles. We rely on standard contractual clauses, provider privacy certifications, and the terms of our agreements with infrastructure providers to protect your information when it is transferred or stored overseas.

If you connect third-party services such as Google Calendar, your information may also be processed by those providers in accordance with their own privacy policies and jurisdictions.

We take reasonable steps to protect your personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure. These measures include:

• Encrypted transmission of data using HTTPS/TLS
• Passwords stored as one-way cryptographic hashes
• Row-level access controls so users can only access their own data
• Restricted internal access to personal information on a need-to-know basis
• Regular security review of the platform

Data breach notification. If we become aware of a data breach that is likely to result in serious harm to one or more individuals, we will comply with our obligations under the Notifiable Data Breaches scheme, including notifying affected individuals and the Office of the Australian Information Commissioner (OAIC) where required.

No method of transmission or electronic storage is completely secure. While we strive to protect your information, we cannot guarantee absolute security.

Access. You can access most of your personal information directly through the Service — your profile, business details, client records, invoices, and compliance documents are all viewable within the app.

Correction. You can correct or update your personal information at any time through the Service settings. If you believe information we hold about you is inaccurate, out of date, incomplete, or misleading, you can request correction by contacting us at support@aeroimagery.com.au.

Data export. You can export your business data (clients, jobs, invoices, expenses) through the Service. We recommend maintaining your own records.

Account deletion. You can delete your account at any time through the Service. Deletion triggers a grace period during which you can reactivate. After the grace period, your personal information is permanently removed from our active systems.

We will respond to access or correction requests within a reasonable time, typically within 30 days. We may refuse a request in limited circumstances permitted by law, in which case we will explain why.

We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, including:

• Active accounts: Your data is retained while your account is active and for the duration of any subscription
• Deleted accounts: When you delete your account, your data enters a grace period during which it can be restored. After the grace period, your data is permanently deleted from our active systems
• Document retention: Uploaded compliance documents and receipts are retained while your account is active and removed in accordance with our document retention policy after account deletion
• Legal retention: Some records (such as tax-related invoices) may be retained for longer periods as required by Australian tax law, even after account deletion
• Activity logs: System activity logs are retained for a limited period and then automatically cleaned up

When information is no longer needed, we destroy or de-identify it in accordance with the Privacy Act.

We may send you service-related communications, such as security alerts, billing notices, and important account information. These are not marketing messages and are necessary for the operation of the Service.

If we send marketing or promotional communications (such as information about new features or special offers), we will:

• Only send them with your consent or where permitted under the Spam Act 2003
• Clearly identify ourselves as the sender
• Provide a functional opt-out mechanism in every message
• Honour opt-out requests within 5 business days

You can manage your notification preferences within the Service at any time.

Where practicable and lawful, we provide options for interacting with the Service anonymously or under a pseudonym:

• Visitors can browse the public pilot directory without creating an account or providing personal information
• Potential clients can send a message to a pilot through the directory without creating an account

However, certain features — such as creating an account, processing payments, and managing compliance records — require personal information to function and cannot be used anonymously.

This policy. We make this Privacy Policy publicly available and easy to access. We will take reasonable steps to ensure you are aware of it when you provide personal information.

Privacy enquiries. You can contact us about any privacy matter, including requests for access, correction, or complaints, at support@aeroimagery.com.au.

Complaints. If you believe we have mishandled your personal information, you can make a complaint by contacting us. We will:

• Acknowledge your complaint within 7 days
• Investigate and respond within 30 days
• Work with you to resolve the issue

If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or by calling 1300 363 992.

The Service is not directed at children under 18 years of age. We do not knowingly collect personal information from anyone under 18. Account registration requires confirmation that you are 18 or older.

If we become aware that we have collected personal information from a person under 18, we will take steps to delete that information as soon as practicable. If you believe we have collected information from a minor, please contact us at support@aeroimagery.com.au.

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or legal requirements. We will notify users of material changes by email or through the Service. The "Last updated" date at the top of this page indicates when it was last revised.

We encourage you to review this policy periodically. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

If you have any questions about this Privacy Policy or how we handle your personal information, please contact us at:

Aero Imagery
ABN 38 354 218 941
Email: support@aeroimagery.com.au