Privacy Policy

This Privacy Policy explains how Exis, LLC (“Exis,” “we,” “us,” or “our”) collects, uses, shares, and protects information in connection with My Flight Systems, including our website, web administration portal, and mobile and desktop applications (together, the “Service”).

1. Our Role

The Service is used by aviation operators and other organizations (each a “Customer”) to manage their pilots, personnel, aircraft, and operations. When we process information that a Customer or its users enter into the Service (“Customer Data”), we do so on the Customer’s behalf and under its instructions; the Customer decides what information to collect and how it is used. If you are a pilot or other user of a Customer’s account, please direct questions about your records to that organization as well as to us.

We are responsible for the information we collect for our own purposes, such as website visitors, sign-up and account information, billing contacts, support communications, and technical logs.

2. Information We Collect

Account and contact information

Name, work email address, company name, role and permissions, password (stored only as a salted hash), multi-factor authentication settings, and single sign-on identifiers when your organization uses SSO. We also record when you accept our legal agreements, including the version accepted, time, IP address, and browser or device information.

Pilot and personnel records

Information a Customer maintains about its pilots, mechanics, and other personnel, which may include contact and emergency-contact details, employee or pilot identifiers, certificates and ratings, medical certificate class and expiration dates, training, check, and currency dates, aircraft type qualifications, flight-time totals, and signatures on records.

Flight, duty, and operational data

Duty days and rest periods, flight logs and segments, aircraft, airports, origins and destinations, times, approaches, flight risk and ground risk assessments and their reviews, flight-following posts and notes, maintenance entries, customers and passengers entered for flights, and, where enabled, expense reports and receipt images.

Files

Documents and images uploaded to the Service, such as manuals, receipts, certificate images, and branding images.

Device, technical, and usage information

IP address, browser type and user agent, device model, operating system and app version, pages and features used, timestamps, and error and crash reports that help us diagnose problems.

Location

The Service does not track the precise location of your device. Location information in the Service consists of airports, routes, and places that users enter as part of their records, and the approximate location that can be inferred from an IP address.

Biometrics and device permissions

If you choose to unlock the mobile app with Face ID, Touch ID, or a similar feature, the check is performed by your device’s operating system; we never receive or store your biometric data. The app may request camera or photo access so you can attach receipts or documents; it accesses them only when you choose to.

Cookies

We use cookies and similar technologies that are necessary to sign you in, keep your session secure, and protect against misuse. We do not use advertising or cross-site tracking cookies. Our website loads web fonts from Google Fonts, which means your browser sends a request, including your IP address, to Google when you visit.

Communications

Messages you send us through the contact form, by email, or through support channels.

3. How We Use Information

• To provide, operate, and maintain the Service, including authenticating users and keeping each Customer’s data separate;
• to deliver features the Customer has enabled, such as reminders and notification emails, reports, calendar entries, and flight-following updates;
• to provide support, respond to requests, and send service, security, and account notices;
• to monitor, troubleshoot, secure, and improve the Service, including through error logs and usage analysis;
• to manage subscriptions and billing;
• to keep records of acceptance of our agreements and to enforce them; and
• to comply with law and respond to lawful requests.

We do not sell personal information, and we do not use Customer Data for advertising.

4. Legal Bases

Where laws such as the EU or UK General Data Protection Regulation apply, we rely on the following legal bases: performance of our contract with the Customer; our legitimate interests in operating, securing, and improving the Service; compliance with legal obligations; and consent where it is required. For Customer Data, the Customer is responsible for establishing the legal basis for processing.

5. How We Share Information

We share information only as described below:

• Within the Customer’s organization. Information in a Customer account is visible to that Customer’s administrators and to other users according to the roles the Customer assigns.
• Service providers (processors). We use vendors that process information on our behalf under contractual confidentiality and security obligations, including:
  • Microsoft Azure — application hosting, databases, and file storage;
  • Google (Gmail) — delivery of invitations, notifications, and other emails;
  • Microsoft 365 — only if a Customer connects it, to create calendar entries in the Customer’s own Microsoft 365 tenant;
  • the Customer’s identity provider — only if the Customer configures single sign-on; and
  • Apple, Google, and Microsoft app stores — to distribute our apps, under their own privacy policies.
• Legal and safety. When we believe in good faith that disclosure is required by law, regulation, subpoena, or court order, or is necessary to protect the rights, property, or safety of any person.
• Business transfers. In connection with a merger, acquisition, financing, or sale of assets, subject to this Privacy Policy.
• With your direction. When the Customer or you ask us to share information.

6. Where Information Is Processed

We are based in the United States, and the Service is hosted in Microsoft Azure data centers in the United States (Microsoft Azure). If you access the Service from outside the United States, your information will be transferred to and processed there, using appropriate safeguards where the law requires them.

7. Retention

We keep Customer Data for as long as the Customer’s account is active and as instructed by the Customer. After an account ends, Customer Data is available for export for 30 days and is then deleted from production systems within 90 days, with backup copies expiring on their normal schedule. We keep account, billing, legal-acceptance, and security records for as long as needed for the purposes described here, including to meet legal, tax, and audit obligations and to resolve disputes. Technical and error logs are kept for a limited period and then deleted or anonymized.

8. Security

We use administrative, technical, and physical safeguards designed to protect information, including encryption in transit, hashed passwords, optional multi-factor authentication and single sign-on, role-based access controls, and logical separation of each Customer’s data. No system is completely secure, so we cannot guarantee absolute security. Please keep your credentials confidential and tell us promptly if you suspect unauthorized access.

9. Your Rights and Choices

Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of your personal information, to object to or restrict certain processing, and to withdraw consent. Because Customers control Customer Data, we will usually refer requests about it to the relevant Customer and help that Customer respond. For information we control, contact us at exisllc@gmail.com. We will verify requests before acting on them and will not discriminate against you for exercising your rights. You may also have the right to complain to your local data-protection authority.

You can update much of your own profile information in the Service, and you can opt out of non-essential emails using the instructions in them. Service and security notices are part of the Service and cannot be turned off while you have an account.

10. U.S. State Privacy Rights

Residents of certain U.S. states may have additional rights under state privacy laws. We do not sell or “share” personal information for cross-context behavioral advertising, and we do not use sensitive personal information for purposes that would require an opt-out. To make a request, contact us as described below; an authorized agent may submit a request on your behalf with proof of authorization.

11. Children

The Service is intended for business use and is not directed to children under 16. We do not knowingly collect personal information from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated policy with a new version number and effective date and, for material changes, give notice by email or in the Service before the change takes effect.

13. Contact Us

Exis, LLC
5 Cleveland Street, Morristown, NJ 07960
Privacy requests: exisllc@gmail.com
General: exisllc@gmail.com