PRIVACY POLICY

Take Flight Ops

Operated by Take Flight Design LLC

Effective Date: September 4, 2026

Version 2026-09-04

1. INTRODUCTION

1.1 Take Flight Design LLC, an Ohio limited liability company having its principal place of business at 158 Cardington Lane, Burbank, Ohio 44214 ("Take Flight Design," "we," "us," or "our"), operates Take Flight Ops (the "Service").

1.2 This Privacy Policy describes the categories of information collected through the Service, the purposes for which that information is used, the circumstances under which it is disclosed, and the choices available to individuals. It applies to takeflightops.com, the Take Flight Ops web application, and the Take Flight Ops applications for iOS, iPadOS, Android, Windows, and macOS.

1.3 By accessing or using the Service, you acknowledge the practices described in this Policy.

2. ROLES OF THE PARTIES

2.1 Subscribing institutions. A flight school that subscribes to the Service (a "School") determines the categories of information entered into the Service concerning its students, instructors, and personnel, and determines who within its organization may access that information. With respect to such information, the School acts as the controller and Take Flight Design acts as a processor, handling the information on the School's documented instructions pursuant to the agreement between them.

2.2 Individuals. Where an individual's information is entered into the Service by a School, the School determines what is recorded and who may view it. Requests for access, correction, or deletion should be directed to the School in the first instance. Take Flight Design will provide reasonable assistance to a School in responding to such requests.

2.3 Direct relationship. Where an individual interacts with takeflightops.com independently of a School, Take Flight Design acts as controller with respect to information collected in that interaction.

3. INFORMATION COLLECTED

3.1 Account information. Name, email address, assigned role, and, where recorded by the School, certificate numbers (pilot, flight instructor, airframe and powerplant, inspection authorization), document and medical expiration dates, and telephone number.

3.2 Operational records. Reservations and flight times; aircraft time in service; training records, lesson grades, and instructor endorsements; instructional notes; maintenance discrepancies, work orders, and return-to-service records; inventory and point-of-sale transactions; and account balances and ledger entries.

3.3 Regulatory records. Citizenship verification and Flight Training Security Program status recorded pursuant to 49 C.F.R. Part 1552, and Security Awareness Training completion dates for personnel recorded pursuant to 49 C.F.R. § 1552.23. Such information is collected because federal regulation obligates the School to collect and retain it.

3.4 Payment information. Payment instruments are captured by and submitted directly to Stripe, Inc. Take Flight Design does not receive, process, transmit, or store primary account numbers, card verification values, or bank account numbers. The Service retains the amount, date, description, and status of each transaction for the purpose of maintaining an account ledger.

3.5 Authentication and security information. Credential derivations (not plaintext credentials), multi-factor authentication secrets where enrolled, session records, and authentication attempts including internet protocol address and time.

3.6 Audit information. Records of actions taken within the Service affecting regulated records, identifying the acting individual, the time, and the change made. Such records are maintained pursuant to Federal Aviation Administration guidance (Advisory Circular 120-78B) and applicable Transportation Security Administration regulation and are not subject to modification or deletion by any party, including Take Flight Design.

3.7 Technical information. Device type, operating system, application version, diagnostic information relating to errors, and, where notifications are enabled on a mobile device, a push notification token.

3.8 Information not collected. The Service does not collect precise geolocation data, does not employ advertising identifiers, and does not track individuals across applications or websites operated by third parties.

4. PURPOSES OF PROCESSING

4.1 Information is processed for the following purposes: authenticating users; storing, displaying, and maintaining School records; processing payments through Stripe; delivering operational notifications configured by the School or the individual; enforcing regulatory restrictions described in Section 7; maintaining the audit record; providing technical support; and maintaining the security, integrity, and availability of the Service.

4.2 Aggregated and de-identified information that cannot reasonably be associated with an identified individual or School may be used to evaluate and improve the Service.

4.3 Take Flight Design does not sell personal information, does not disclose personal information for cross-context behavioral advertising, and does not use School or individual information to train machine learning models.

5. DISCLOSURE OF INFORMATION

5.1 Within the School. Information is accessible to personnel of the School in accordance with the roles the School assigns.

5.2 Subprocessors. Information is disclosed to service providers engaged in the delivery of the Service, namely Stripe, Inc. (payment processing), DigitalOcean, LLC (hosting and storage), Google LLC (business correspondence), and the Company's off-site backup storage provider (encrypted backup replication). Each is bound by contract to protect the information and to process it solely for the purpose of providing its service.

5.3 Partner institutions. A School may authorize disclosure of specified categories of student information to a university, affiliated institution, simulator provider, or scholarship provider. Such disclosure occurs only with respect to students for whom the School has recorded consent, only as to the categories configured by the School, and each disclosure is recorded in the audit log.

5.4 Legal requirements. Information may be disclosed where required by law, including in response to inspection of records that a School is obligated to produce to the Federal Aviation Administration or the Transportation Security Administration, or pursuant to valid legal process. Where permitted, Take Flight Design will notify the affected School.

5.5 Corporate transactions. In connection with a merger, acquisition, financing, or sale of assets, information may be transferred as part of the transaction. Schools will receive advance notice, and this Policy will continue to govern the transferred information until superseded by notice.

6. RETENTION

6.1 Records maintained in the Service are subject to retention periods established by federal regulation and enforced by the Service. Such periods cannot be shortened by a user of the Service.

6.2 Upon termination of a School's subscription, Take Flight Design will furnish a complete export upon request and will delete the School's data from active systems. Encrypted backup copies expire in accordance with the backup retention schedule.

7. INFORMATION SECURITY

7.1 Information is encrypted in transit using Transport Layer Security and encrypted at rest. Each School's records are maintained in a discrete encrypted database with discrete key material.

7.2 Access requires an individually credentialed account. Authentication secrets are stored as PBKDF2-HMAC-SHA256 derivations at 600,000 iterations. Multi-factor authentication is available to all accounts. Actions affecting regulated records are recorded in an append-only, hash-chained audit log. Backups are encrypted prior to leaving the production environment.

7.3 No information system can be guaranteed secure against all threats. In the event of a security incident affecting personal information, Take Flight Design will notify affected Schools without unreasonable delay and will notify individuals and regulatory authorities where required by applicable law.

7.4 A separate Security and Data Protection Overview describing these safeguards in greater detail is available to Schools and their advisors upon request.

8. INDIVIDUAL RIGHTS AND CHOICES

8.1 Access and correction. Individuals should direct requests to their School, whose personnel may view and correct records directly within the Service. Schools may request assistance from Take Flight Design.

8.2 Deletion. Deletion requests are honored except with respect to records subject to a retention period identified in Section 6, in which case the record must be retained and the requesting party will be so advised.

8.3 Communications. Push and electronic mail notifications may be disabled within the Service or in device settings. Messages necessary to account administration and security will continue to be delivered.

8.4 State privacy rights. Residents of states having comprehensive consumer privacy legislation, including California, Colorado, Connecticut, Utah, and Virginia, hold rights to confirm processing, to access, to correct, to delete, to obtain a portable copy, and to be free from discrimination for the exercise of such rights. Because Take Flight Design acts as a processor on behalf of Schools with respect to most information, requests will be transmitted to the relevant School and supported by Take Flight Design. Take Flight Design does not sell personal information and does not process personal information for targeted advertising.

8.5 Educational records. Where a School shares student information with a college or university in connection with an educational program, that institution's obligations under the Family Educational Rights and Privacy Act may apply to the records so shared.

9. MINORS

9.1 The Service is licensed to flight schools for the administration of flight training. Individuals receiving flight training may be minors.

9.2 Take Flight Design does not knowingly collect personal information directly from children under the age of thirteen. Where a School records information concerning a minor student, the School is responsible for obtaining any parental consent required by its own policies and by applicable law.

9.3 The Service is not directed to children, contains no advertising, and does not construct behavioral profiles of its users.

10. INTERNATIONAL TRANSFERS

10.1 Information processed through the Service is stored on servers located in the United States. Individuals accessing the Service from other jurisdictions do so with the understanding that their information will be transferred to and processed in the United States.

11. AMENDMENTS

11.1 Take Flight Design may amend this Policy from time to time. The revised Policy will be posted at this address bearing a revised effective date. Where an amendment materially affects the processing of personal information, subscribing Schools will receive notice by electronic mail not less than thirty days in advance where practicable.

12. CONTACT

Inquiries concerning this Policy, and requests relating to personal information, may be directed to:

Take Flight Design LLC

158 Cardington Lane, Burbank, Ohio 44214

ops@takeflightops.com

Requests should identify whether the requesting party is acting on behalf of a School or in an individual capacity, and should identify the relevant School, so that the request may be routed appropriately.