1. Introduction
This Privacy Policy describes how AviaSAFE Systems ("we", "us", or "our") collects, uses, discloses, and protects information through the AviaSAFE SMS platform (the "Platform"), a multi-tenant, cloud-based Safety Management System serving airlines, operators, and aviation regulators.
This policy applies to all users of the Platform, including tenant administrators, employees, safety managers, and individuals submitting safety reports or completing safety culture surveys. By using the Platform, you consent to the practices described in this policy. This policy should be read together with our Terms of Service.
2. Information We Collect
We collect information that is necessary to operate the Platform and to support a robust, just-culture aviation safety management process. The types of information we collect include:
- Account information: name, business email address, organization (tenant), role, and login credentials when you register for an account.
- Safety reports and hazards: voluntary safety reports, mandatory occurrence reports (MORs), hazard reports, and related narrative or supporting information that you choose to submit through the Platform.
- Survey responses: responses to SMS safety culture surveys. Survey submissions are designed to be collected anonymously and are aggregated before analysis wherever possible.
- Usage and technical data: IP address, browser type, device information, and pages visited, collected automatically to maintain security and improve the Platform.
3. How We Use Information
We use the information we collect to:
- Provide, operate, and maintain the Platform and its features;
- Authenticate users and enforce tenant-level access controls;
- Enable safety data capture, analysis, risk assessment, and reporting for your organization;
- Process and aggregate survey responses to measure safety culture;
- Prevent abuse, fraud, and unauthorized access;
- Communicate with you about the Platform, including service notices and support;
- Comply with legal obligations.
We do not sell your personal data or safety data, and we do not use such data for advertising or profiling unrelated to safety management.
4. Data Protection & Multi-Tenant Isolation
The Platform is a multi-tenant system in which each customer organization is assigned a unique tenant identifier. Data protection is anchored in strict isolation boundaries:
- All data is scoped to the tenant that created it, and application and API-level authorization checks enforce that users can only access data within their own tenant.
- Data is stored and transmitted using industry-standard encryption, including TLS for data in transit and encryption at rest.
- Role-based access control (RBAC) restricts which users within a tenant can view, edit, or export safety data.
- No tenant's safety data is accessible to, or used for the benefit of, any other tenant.
Data submitted to the Platform remains the property of your organization. AviaSAFE Systems acts as a processor of your safety data and does not claim ownership of it.
5. Non-Disclosure of Safety Data
Voluntary safety reports and related safety information are treated as strictly confidential. In support of ICAO Annex 19 safety-management principles and a non-punitive, just-culture environment:
- Safety data is disclosed only to personnel within your organization who have a legitimate need, or to authorized regulators in accordance with your organization's reporting obligations.
- AviaSAFE Systems will not disclose identifiable safety data to third parties, except where required by law, by court order, or to protect the integrity and security of the Platform.
- We do not use or publish identifiable safety data for research, marketing, or any purpose other than providing the Platform to your organization.
6. Anonymous Survey Handling
Safety culture surveys are a core feature of the Platform and are designed to preserve anonymity to encourage candid participation:
- Survey responses are collected without linking them to individual identities, unless your organization explicitly configures the survey to collect identifying information.
- Responses are aggregated and analyzed at a group or organizational level; reports generated by the Platform do not attribute individual responses to specific employees.
- Only authorized tenant administrators can view survey results, and such results are shared with AviaSAFE Systems personnel solely to provide support or technical troubleshooting.
8. Infrastructure Security
The Platform is hosted on Google Cloud Platform and uses Firebase services (including Firebase Authentication and Firebase Hosting) for authentication and content delivery, and Supabase (PostgreSQL) for data storage. Security measures include:
- Encryption of data in transit (TLS) and at rest;
- Firebase Authentication with token-based, tenant-scoped session management;
- Server-side authorization checks that validate tenant membership and role on every data request;
- Access controls limiting infrastructure and data access to authorized AviaSAFE Systems personnel;
- Continuous monitoring and security updates for the underlying platform.
While we implement reasonable administrative, technical, and physical safeguards, no method of electronic storage or transmission is completely secure, and we cannot guarantee absolute security.
9. Data Retention
We retain your data only for as long as necessary to provide the Platform and to satisfy the safety-management and record-keeping obligations of your organization:
- Safety reports, hazard registers, and related records are retained in accordance with your organization's retention schedule and applicable aviation regulation.
- Account information is retained for the duration of your subscription and deleted or anonymized within a reasonable period after account termination.
- Survey response data is deleted or de-identified after the survey analysis window unless a longer retention is required by your organization's policies.
- Logs and technical data are retained for limited periods for security and troubleshooting purposes.
Upon termination of your subscription, we will provide a reasonable data export window and then delete or anonymize your data in accordance with this policy.
11. Your Rights
Depending on your jurisdiction and applicable law, you may have the right to:
- Access the personal information we hold about you;
- Request correction of inaccurate or incomplete information;
- Request deletion of your personal information, subject to legal or regulatory retention obligations;
- Object to, or restrict, certain processing;
- Request a copy of your data in a structured, machine-readable format;
- Withdraw consent where processing is based on consent.
To exercise any of these rights, contact us at info@aviasafesystems.com. We will respond within a reasonable timeframe, and will take reasonable steps to verify your identity before processing your request.
12. Children's Privacy
The Platform is intended for use by adults in the context of aviation safety management and is not directed to children. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will take steps to delete it.
13. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated through the Platform or by email at least fourteen (14) days before they take effect. The "Last Updated" date at the top of this page indicates when this policy was last revised.
14. Contact
If you have questions about this Privacy Policy or our data practices, please contact us at info@aviasafesystems.com or through the Contact page.