Privacy Policy

1. Personal Information We Collect

Depending on your interactions with FlightLedger, we may collect the following categories of personal information:

• Identity & Contact Details: Full name, corporate email address, business telephone number, and company/employer name.
• Aviation Credentials & Certifications: CASA Aviation Reference Number (ARN), Remote Pilot Licence (RePL) numbers, Aeronautical Radio Operator Certificate (AROC) status, instrument ratings, Chief Remote Pilot appointment status, and training expiry dates.
• Pilot Fitness & Duty Logs: Pre-flight medical self-declarations, fit-for-duty confirmations, duty start/finish times, and rest interval records required under fatigue risk management systems.
• Authentication Data: Encrypted password hashes, session identifiers, and multi-factor authentication metadata.

2. Operational Telemetry & GPS Location Data

In order to fulfill statutory flight logging requirements under CASR Part 101, the Platform processes operational and telemetry data which may relate to identifiable remote crew:

• Takeoff, landing, and flight path geographic coordinates (latitude, longitude, altitude AGL/AMSL);
• Airframe registration details, manufacturer serial numbers, motor hours, and technical defect logs;
• Battery telemetry: serial numbers, voltage curves, internal resistance readings, temperature metrics, and cycle counts;
• Job Safety Analysis (JSA) site risk assessments, ground hazards, airspace classifications, and weather observations.

3. Methods of Data Collection

We collect personal and operational information through:

• Direct manual entry by you or your organisation's Chief Remote Pilot or administrator;
• Automated ingestion of digital flight log files (e.g. CSV, TXT, JSON telemetry exports from drone ground control stations);
• Automated system activity logs, error reports, and audit trail generation during your use of the Platform.

4. Lawful Purpose & Use of Information

We collect and process personal information strictly for purposes related to operating our aviation software and fulfilling Australian regulatory compliance:

• To establish and authenticate your user profile and organisation workspace;
• To enforce serviceability gating (preventing unserviceable aircraft or unqualified pilots from dispatch);
• To deliver automated compliance notifications (e.g. ReOC certificate expiry, airframe maintenance intervals, battery cycle quarantine);
• To generate CASA-compliant audit packages and operational logs in the event of an aviation safety inspection;
• To bill and manage subscription accounts;
• To detect, investigate, and prevent fraudulent, unauthorised, or illegal activities.

5. Australian Data Residency & Storage Architecture

5.1. Australian Sovereignty: Customer operational data and flight records are hosted in high-availability data centres located in Sydney, Australia (Supabase AWS region ap-southeast-2).

5.2. Encryption: All data transmitted between your browser and FlightLedger is encrypted using Transport Layer Security (TLS 1.3). Database records, backups, and confidential logbook fields are encrypted at rest using industry-standard AES-256 encryption.

6. CASA 7-Year Statutory Record Retention Mandate

6.1. Statutory Retention Requirement: Under CASR Part 101 Manual of Standards (MOS) Section 10.02 and CASA regulations, commercial RPAS operators must retain technical logs, aircraft maintenance records, flight planning risk assessments, and remote pilot flight logbooks for a minimum period of seven (7) years.

6.2. Reconciliation with Privacy Act Deletion Requests: Where an individual user requests account deletion under APP 11 or general privacy rights, Learno will decommission active user access and anonymise marketing or ancillary account data. However, operational aviation flight logs, maintenance signoffs, and safety audit entries will be securely archived for the mandatory 7-year regulatory period to ensure both the Customer and Learno comply with Australian civil aviation safety laws and statutory limitation periods.

7. Disclosure of Personal Information

7.1. No Sale of Personal Data: We do NOT sell, rent, commercialise, or trade your personal information or flight telemetry to third parties, data brokers, or advertisers.

7.2. Sub-processors and Essential Service Providers: We disclose data to reputable infrastructure providers strictly to deliver our SaaS service (including cloud hosting providers, transactional email dispatch services, and database platforms). All service providers are bound by written agreements requiring compliance with equivalent confidentiality and privacy standards.

7.3. Regulatory & Law Enforcement Disclosures: We may disclose personal and flight information to the Civil Aviation Safety Authority (CASA), the Australian Transport Safety Bureau (ATSB), or law enforcement agencies where required by law, subpoena, warrant, or mandatory statutory incident reporting under the Transport Safety Investigation Act 2003 (Cth).

8. Multi-Tenant Security & Tenant Isolation

FlightLedger is engineered as a secure multi-tenant platform. All database tables containing customer flight plans, crew rosters, battery inventories, and maintenance records enforce PostgreSQL Row-Level Security (RLS). This ensures that no customer or user can view, query, or modify the operational data of another organisation.

9. Access & Correction Rights (APP 12 & APP 13)

Under APPs 12 and 13, you have the right to request access to the personal information we hold about you and to request correction if that information is inaccurate, out-of-date, or incomplete.

Most personal details and qualification records can be updated directly within your FlightLedger account profile. For formal access or correction requests, contact our Privacy Officer at privacy@learno.com.au. We will respond within thirty (30) days in accordance with the Privacy Act.

10. Cookies, Tokens & Local Storage

FlightLedger uses strictly necessary session cookies and browser storage (such as Supabase JWT authentication tokens) to maintain secure user sessions, authenticate API requests, and preserve operational state across page navigation. We do not use intrusive cross-site third-party tracking cookies.

11. Notifiable Data Breaches (NDB) Scheme

Learno complies with Part IIIC of the Privacy Act 1988 (Cth) (the Notifiable Data Breaches scheme). In the event of an actual or suspected data security incident involving unauthorized access or disclosure of personal information likely to result in serious harm, we will immediately initiate an assessment, take containment measures, and notify affected individuals and the Australian Information Commissioner as required by law.

12. Complaints & Privacy Officer Contact

If you have questions, concerns, or wish to lodge a complaint regarding our compliance with the Australian Privacy Principles, please contact our Privacy Officer:

If you are not satisfied with our response to a privacy complaint, you may refer your complaint to the Office of the Australian Information Commissioner (OAIC):

Website: www.oaic.gov.au · Phone: 1300 363 992 · Post: GPO Box 5218, Sydney NSW 2001.