Privacy Policy

1. Overview

HAVERIS ("we," "us," or "our") provides airworthiness directive and service bulletin intelligence tools for aircraft owners, mechanics, and maintenance organizations. This Privacy Policy explains how we collect, use, and protect information when you use haverisaero.com and related services (the "Service").

This notice explains data processing; reading it or using the Service does not constitute consent to optional analytics, advertising or unrelated marketing. Where consent is needed, we request it separately. For business records uploaded by an organisation, that organisation generally determines the purposes of processing; HAVERIS processes those records to provide the service. We separately determine the purposes of account administration, security, billing and direct enquiries.

Data controller

The data controller responsible for processing your personal data is:

For privacy or data protection questions, write to info@haverisaero.com.

2. Information we collect

Information you provide

• Account data: name, email address, password (stored as a salted hash), and profile type (owner, mechanic, shop).
• Aircraft data: registration numbers, serial numbers, installed equipment, engine and propeller details, and compliance records you upload.
• Billing and access: Lemon Squeezy handles checkout as Merchant of Record. HAVERIS receives subscription, order, invoice and plan metadata needed to administer access, including applicable quotas and gift-code redemption records. We do not store full payment-card numbers.
• Contact and support: the homepage form stores fleet information, company, name, email, message, submission time and a request identifier before sending an email notification. In-app feedback also stores account/organisation identifiers, subject, language, browser user-agent and attachments you choose to send. Delivery attempts and status are retained separately from the enquiry itself. Please remove passwords, payment-card details, health information and unnecessary third-party personal data from messages and screenshots.

Information collected automatically

• Operational data: account activity timestamps, security/session records and organisation audit records support access control and troubleshooting. Optional public-page usage and performance measurement is enabled only after you choose Accept analytics. It does not measure signed-in application routes.
• Technical and security data: hosting providers receive connection information such as IP addresses and browser headers. The contact anti-spam system derives a keyed, pseudonymous identifier from the connection IP, rather than storing the raw IP in the contact record; it also records a challenge hash. This identifier is pseudonymous, not anonymous. Feedback can include the browser user-agent. Country/device activity recording, where enabled, is described below; coverage depends on the actual collection start date.
• Cookies and similar technologies: see Section 9. 9. Cookies.

Information from public sources

To provide applicability matching, we automatically retrieve aircraft registration data from public government registries (e.g., the FAA N-Number registry). We do not cross-reference this with personal data beyond what you have linked to your account.

Information from Google sign-in

• What we receive: when you sign in with Google, we receive your email address, your full name, and your Google profile picture URL.
• How we use it: solely to (a) create or authenticate your account, (b) display your name in the dashboard, and (c) send transactional emails.
• Use and sharing: Google profile data is used for account authentication and administration through our service providers. We do not sell it or use it for advertising. Basic Google sign-in does not give HAVERIS access to your Gmail, Drive, Calendar or Contacts.
• Choices: you can revoke Google access in your Google Account and request account-data access or erasure at info@haverisaero.com. Revoking sign-in access does not by itself erase records already held by HAVERIS. The rights and retention sections below apply.

3. How we use data

We use your information to:

• Provide, maintain, and improve the Service;
• Match airworthiness directives to your aircraft and generate compliance reports;
• Process payments and manage subscriptions;
• Send transactional emails (receipts, security alerts, AD notifications);
• Respond to support requests;
• Detect, investigate, and prevent fraud or abuse;
• Comply with legal obligations.

We do not sell personal data or use personal browsing histories to set individual subscription prices. The current site does not load advertising tags. AI inference used to answer a request or extract a document is distinct from training a model; the AI section below explains the information involved.

4. Data sharing

We share limited data with trusted service providers who help us operate the Service, including:

• Hosting and database: Supabase (database, authentication, file storage) and Vercel (web hosting and edge runtime). Both store data on our behalf within their own infrastructure.
• Payment processing: Lemon Squeezy is the Merchant of Record — they handle all card transactions, tax collection (VAT, sales tax), and billing receipts. We never store full card numbers.
• Email: Resend delivers application notifications, including contact enquiries and feedback, to the relevant recipient or support inbox. Feedback notifications can include time-limited attachment links. Authentication and billing providers may deliver their own service emails. Inbox providers process messages received by the team.
• AI processing: cloud-enabled FLAP and document analysis can send your prompts, limited conversation context, relevant authorised tool results and extracted document/aircraft text to Groq. These inputs can contain personal or confidential data you provide. A separately configured local model can process these tasks instead; local mode does not automatically fall back to Groq. Public regulatory enrichment may use separate AI providers such as Anthropic. Do not assume that all AI processing is local or that only public data is sent.
• Optional measurement: Vercel Web Analytics and Speed Insights measure approved public-page visits and performance after opt-in. Google Ads Basic Consent Mode is available only upon explicit opt-in for advertising measurement (with IP anonymisation). By default and when rejected, no advertising tags or scripts are loaded and no data is shared with Google Ads. The application filters query strings, fragments and non-public routes from its measurement events. Google Fonts serves typography and receives ordinary connection metadata.

We may also disclose data when required by law, to enforce our Terms, or to protect the rights, property, or safety of our users or the public.

If HAVERIS is involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.

5. Data retention

Retention depends on the record and purpose. Account and organisation records are used while the service is provided; some shared maintenance/audit records and an access-disabled identity record can remain after an account-deletion action. Contact enquiries, feedback, attachments, AI conversations and email copies require separate review when an erasure request is received. We do not represent that closing an account automatically erases every copy within a fixed period. Records needed for legal obligations or claims may be retained with restricted access.

Application backups use a rolling 30-day retention target, with expired files removed after a successful backup run; failures can delay that cleanup. Anti-spam counter windows expire within two days and are cleaned by queue processing. Those counters are separate from the enquiry records. An enquiry is not deleted merely because its email was sent. You can request an explanation of the retention criteria and an export or erasure review at info@haverisaero.com.

6. Security

Safeguards include encrypted transport, organisation-scoped access controls, restricted server credentials and authentication protections. Support access is limited to people who need it. No system is perfectly secure. We do not claim that every database field is individually encrypted or that a particular security certification has been obtained.

If we become aware of a breach affecting your data, we will notify you without undue delay, as required by applicable law.

7. Your rights

Depending on where you live, you may have the following rights:

• Access: request a copy of the personal data we hold about you;
• Correction: ask us to correct inaccurate data;
• Deletion: ask us to delete your data;
• Portability: receive your data in a machine-readable format;
• Objection: object to certain types of processing;
• Withdraw consent: where processing is based on consent, you can withdraw it at any time.

Contact info@haverisaero.com to exercise rights; we may request proportionate identity verification. Applicable deadlines govern: generally one month under the GDPR (with permitted extensions and notice), and at most 30 days for a KVKK application. Erasure and portability are subject to their legal conditions. You may also request restriction of processing. A shared organisation’s retention duties do not remove your right to contact us directly.

For users in the EU, UK, and Switzerland: the legal bases for processing include performance of a contract, legitimate interests, legal obligations, and consent where applicable. You have the right to lodge a complaint with your local data protection authority.

California: if the CCPA/CPRA applies to our processing, eligible individuals may exercise applicable access, correction, deletion and non-discrimination rights, and rights concerning sale or sharing. We do not sell personal information or load advertising tags in the current site. Applicability depends on statutory criteria, not simply on the presence of a California visitor.

For users in Türkiye: under KVKK Article 11 (Kişisel Verilerin Korunması Kanunu) you have the right to learn whether your personal data is being processed, request information on its purpose, request correction or deletion of incorrect or unlawfully processed data, object to automated decisions producing adverse effects, and seek compensation for damages caused by unlawful processing. The data controller is identified at the top of this policy. Complaints can also be filed with the Turkish Data Protection Authority (KVKK).

8. International transfers

Providers can process data outside your country, including in the United States. Applicable transfers require a valid legal mechanism, such as an adequacy decision or appropriate contractual safeguards, and additional measures where needed. An EU contractual clause alone is not a KVKK transfer mechanism. Contact us for the recipient, destination and safeguards applicable to your processing; this notice itself is neither a transfer agreement nor consent to an international transfer.

9. Cookies

Necessary storage supports sign-in, security, language and requested interface functions. Optional public-page analytics is off until you accept it. Reject analytics is available alongside Accept analytics with equal prominence. Use Privacy preferences at the bottom of any page to change your choice; withdrawing analytics reloads the page to stop loaded measurement scripts. Blocking optional analytics does not block the service.

Cookie categories we use:

• Strictly necessary: required for the Service to function (authentication, security);
• Preferences: language and interface choices; the local privacy-choice record contains a boolean, version and timestamp and is re-requested after 180 days. Browser controls can clear it sooner.
• Optional analytics & advertising: Vercel visit and performance measurement on public pages after opt-in. Google Ads Basic Consent Mode operates solely upon separate advertising opt-in; no advertising cookies or measurement tags are loaded by default.

10. Children's privacy

The Service is not directed to individuals under 18. We do not knowingly collect personal data from children. If you believe we have, please contact us and we will delete it.

11. Changes to this policy

The date above identifies the latest revision. This revision corrects descriptions of existing processing and restricts optional measurement. We will provide appropriate notice before materially new processing starts and request consent separately where required. A notice update does not itself authorise a new purpose.

12. Contact us

If you have questions about this policy or how we handle your data, please reach out:

• Email: info@haverisaero.com
• General contact: Homepage contact form

Additional processing details