Privacy Policy

Effective 28 September 2026

This policy explains what data Altus Air collects, what it is used for, how it is protected, and how it is deleted. It covers the Altus Air web app at app.altusairtech.com, the Altus Air mobile app, and this website.

1. Who we are

Altus Air is made and operated by Altus Air Tech LLC ("we", "us"). For any question about this policy or your data, email privacy@altusairtech.com.

Our customers are air-charter operators. Each operator has its own workspace in Altus Air and decides what goes into it. For the personal data in an operator's workspace (its staff, crew, clients and passengers), the operator is responsible for that data and we process it on the operator's behalf. If you fly with or work for an operator and have a question about your data, you can contact the operator named on your paperwork, or us.

2. What we collect

2.1 Account data

For each person with an Altus Air account: name, email address, phone number where given, role, and the operator they belong to. For the mobile app, a push-notification token so notifications reach the right phone. Sign-in is handled by our authentication provider; we never see or store your password in plain text.

2.2 Operator business data

The records an operator keeps in Altus Air to run its flights: trips, quotes and invoices; aircraft and maintenance records; crew schedules, qualifications and duty records; client contacts; and passenger details that charter flights require, which can include identity-document details for customs filings. Where a client accepts a quote online, we record the signature event (typed name, time, IP address and browser) as proof of acceptance.

2.3 Google user data

An operator may choose to connect one or more of its own Google mailboxes to Altus Air. This is optional, and nothing here applies unless someone at the operator connects a mailbox. Each connection is for one purpose and asks only for the permissions that purpose needs:

Connection	Google permission	What Altus Air does with it
Sending mailbox	`gmail.send`	Sends the quotes, itineraries, invoices and crew notices that the operator's staff create in Altus Air, from the operator's own address. Altus Air cannot read this mailbox through this permission.
Invoice inbox	`gmail.modify`	Reads the messages in the Gmail label the operator chooses, and imports vendor invoices from them into the operator's Accounting as draft bills for review. After importing a message it adds an "AP/Imported" label (creating that label once) so the same invoice is not imported twice. It never sends, deletes, archives or marks messages as read, and never removes a label.
Fuel price inbox	`gmail.readonly`	Reads recent messages from the operator's fuel vendors that carry price-sheet attachments, and imports those prices into the operator's fuel pricing. It makes no change to the mailbox.
All of the above	`userinfo.email`	Reads the connected account's email address, so the app can show which mailbox is connected and send from the right address.

What we keep from Google. A refresh token for each connection, so Altus Air can act for the operator without asking them to sign in again, and the connected email address. From the invoice inbox, we keep the invoice file, the bill details read from it, and the Gmail message and attachment IDs so an invoice is never imported twice. From the fuel inbox, we keep the imported prices and a log of which messages were imported. We do not keep copies of other emails.

AI processing of invoices. To read the details off an imported invoice (vendor, date, amounts), the invoice file, and where the invoice is written in the email itself, that text, is sent to our AI provider, Anthropic. This is done only to produce the draft bill the operator asked for. It is not used to train AI models.

2.4 This website

This website sets no cookies and runs no analytics or advertising scripts. Our hosting provider keeps standard server logs, such as IP addresses and request times, for security and reliability.

3. How we use data

To provide Altus Air to the operator: run its scheduling, dispatch, crew, maintenance and accounting, and send the messages its staff send.
To keep the service secure, investigate problems and prevent abuse.
To meet legal obligations.

We do not sell data. We do not use data for advertising. We do not use one operator's data for another operator.

4. Google API Services: Limited Use

Altus Air's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, Google user data:

is used only to provide the features described in section 2.3, which the operator turned on;
is transferred to others only as needed to provide those features (the service providers in section 6), to comply with law, or as part of a merger or sale of the business with notice to you;
is never used for advertising, including retargeting or personalised ads, and is never sold;
is never used to develop, improve or train generalised AI or machine-learning models;
is not read by people, unless the operator asks us to for support, it is needed for security (for example, investigating abuse), or the law requires it.

5. How data is stored and protected

Google and other third-party credentials are encrypted at rest (AES-256-GCM), with the encryption key kept outside the database. A stored credential is never sent back to a browser or phone; at most the app shows the last four characters of a key, so you can tell which one is set.
Each operator's data is kept separate. Every record belongs to one operator's workspace, and the app only reads and writes records for the operator the signed-in person belongs to.
All traffic to and from Altus Air is encrypted in transit (HTTPS/TLS).
Access inside an operator's workspace is controlled by role, so for example crew see their own schedule and documents, not the company's accounts.

6. Sharing

We do not share data with anyone except the service providers that run Altus Air for us, and only as needed to run it:

Supabase: database, sign-in and file storage.
Railway: runs the Altus Air server.
Vercel: hosts the web app's files and this website.
Google: sends and reads mail for operators that connect a mailbox.
Anthropic: AI features, including reading imported invoices.
Apple and Expo: deliver notifications to the mobile app.

We may also disclose data where the law requires it.

7. Retention and deletion

Disconnecting a Google mailbox (Settings → Integrations → Disconnect) asks Google to revoke our access and deletes the stored token for that connection. You can also remove Altus Air's access at any time from your Google Account, at myaccount.google.com/permissions; once you do, Altus Air can no longer use that connection.
Invoices and fuel prices already imported become part of the operator's business records. They stay with the operator's records until the operator deletes them or asks us to delete its workspace.
Operator business data is kept while the operator uses Altus Air, and for as long as the operator must keep it for aviation, tax or other legal record-keeping.
To ask for deletion of your data, or of an operator's workspace, email privacy@altusairtech.com. If the data belongs to an operator's records, we will work with that operator. We reply within 30 days.

8. Your choices and rights

You can ask to see, correct, export or delete personal data about you by emailing privacy@altusairtech.com. Depending on where you live, you may have further rights under local law, and you may complain to your local data-protection authority.

9. Children

Altus Air is a business tool for charter operators and is not directed at children. Passenger records for minors travelling on a charter flight are entered by the operator, as required for the flight.

10. Changes

If we change this policy, we will update the date at the top of this page. If a change affects how we use Google user data, we will tell connected operators before it takes effect.

11. Contact

Altus Air Tech LLC · privacy@altusairtech.com