1. Our two roles

Azimuth handles personal information in two ways:

• On behalf of clubs and schools (our clients). When a flight school or flying club uses the Service to manage its members, students, instructors, and operations, that organization decides what information is collected and why. This information may be provided directly by members or students who sign up for the Service as part of that organization, or by the organization's administrators about their members — for example, names, phone numbers, and email addresses. We process that information as the organization's service provider, under our agreement with them. If you are a member or student of a flight school or flying club, please also review that organization's own privacy practices.
• For our own account relationship. We collect limited information — such as the contact details of a client's administrators — to set up accounts, provide support, bill for the Service, and communicate with our clients.

2. Information we collect

Depending on how the Service is used, this may include:

• Identity & contact information — name, email, phone number, and address.
• Pilot & training information — licences and ratings, certificate and medical expiry dates, endorsements, flight and training records, currency, and stage-check or checkride results.
• Scheduling & operational information — bookings, dispatch and check-in records, and fleet and weight-and-balance data.
• Account & billing information — login credentials (stored in hashed form) and, where applicable, billing details. Payment card details, if collected, are handled by our payment processor and are not stored by us.
• Technical & usage information — IP address, device and browser type, and log data about how the Service is used, to keep it secure and reliable.

3. How we use personal information

We use personal information to: provide, operate, and support the Service; authenticate Users and keep accounts secure; process billing; respond to requests; maintain, troubleshoot, and improve the Service; and comply with our legal obligations. We do not sell personal information, and we do not use it for advertising.

4. Consent

We collect, use, and disclose personal information with consent, or as otherwise permitted or required by law. Where we act on behalf of a club or school, that organization is responsible for obtaining any consents required from its own members and students. You may withdraw consent, subject to legal or contractual restrictions and reasonable notice, though doing so may mean we can no longer provide part of the Service.

5. Service providers & disclosure

We share personal information only as needed to run the Service, including with service providers who host our infrastructure, send email, and process payments on our behalf. These providers are permitted to use the information only to provide services to us. Our key providers include Supabase (database & file storage), Vercel (application hosting), Resend (transactional email), and our payment processor.

We may also disclose personal information where required by law, to protect our rights or the safety of others, or as part of a business transaction such as a merger or sale (with appropriate protections).

6. Storage outside Canada

7. Safeguards

We use reasonable administrative, technical, and physical safeguards appropriate to the sensitivity of the information — including secured (TLS) connections in transit, access controls, and restricting staff access to a need-to-know basis. Documents uploaded through the medical-document and certificate/licence upload features are encrypted, and account passwords are stored in hashed form; other information is not guaranteed to be encrypted at rest. No method of transmission or storage is completely secure, but we work to protect personal information against loss, theft, and unauthorized access, use, or disclosure.

8. Retention

We keep personal information only as long as needed for the purposes described here, to provide the Service to the relevant club or school, and to meet legal, accounting, or reporting requirements. When a client relationship ends, we make Client Data available for export for a limited period and then permanently delete or irreversibly de-identify it from our active systems within 30 days, with backup copies purged within 90 days — except for the minimum information we are required by law to retain, which we keep only for as long as the law requires.

9. Your rights: access & correction

Under PIPA you have the right to ask what personal information we hold about you, how it has been used, and to whom it has been disclosed, and to request a correction. If we act on behalf of your club or school, we will direct your request to that organization where appropriate. To make a request, contact our Privacy Officer. We will respond within the time required by law and may need to verify your identity first.

10. Minors

Flight students may be minors. Where a club or school collects information about a minor through the Service, that organization is responsible for obtaining any consent required from a parent or guardian under applicable law.

11. Cookies

The Service uses cookies and similar technologies that are necessary to sign you in, keep your session secure, and remember your preferences. We do not use third-party advertising cookies.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version with a new "last updated" date and, where changes are material, take reasonable steps to notify affected clients.

13. Contact — Privacy Officer

For questions, requests, or complaints about how we handle personal information, contact our Privacy Officer:

Azimuth Privacy Officer
Heurix Corp.
privacy@azimuthfbo.ca

If you are not satisfied with our response, you may contact the Office of the Information and Privacy Commissioner of Alberta.