Privacy Policy

StratusLog is flight school operations software operated by Stratus Marketing LLC. We provide scheduling, digital flight logbooks, training-progress tracking, and invoicing tools to flight schools, certified flight instructors, and their students.

This Privacy Policy describes the data we collect through https://getstratuslog.com and through https://app.getstratuslog.com (collectively, the “Service”), and how that data is used and shared.

We collect the following categories of personal data:

• Account data. Name, email, phone number, password (hashed), and role within a school.
• School data. School name, location, instructor roster, aircraft fleet, billing rates, and operational settings.
• Student data. Names, contact details, certificate track, training stage, milestones, medical expiry, and logged flight history.
• Flight records. Date, route, duration, landings, Hobbs/Tach, instructor and student references, remarks, and endorsements.
• Payment data. Stripe customer and invoice identifiers, payment status, and amounts. We do not store full card numbers; Stripe processes and stores payment instruments directly.
• Integration tokens. OAuth access and refresh tokens for Google Calendar, Calendly, and Stripe Connect. These are encrypted at rest.
• Usage data. Pages viewed, actions taken, timestamps, IP address, browser, OS, and device identifiers for security, support, and product improvement.
• Communications. Messages you send to support, sales, or via the contact form.
• SMS consent records. When you consent to receive text messages, we may record your phone number, consent method, consent date/time, the staff member or form that collected consent, and opt-in/opt-out status.

We use personal data to:

• Provide, operate, and improve the Service.
• Authenticate users, secure accounts, and prevent abuse.
• Send transactional messages — invoice links, payment receipts, schedule confirmations, lesson reminders, account notices.
• Generate Stripe invoices and process payments on behalf of your school.
• Sync schedule events with connected calendars when you authorize it.
• Respond to support requests.
• Send SMS/text messages only where consent and applicable law allow it, including operational reminders, scheduling updates, billing/payment notices, and support-related messages.
• Maintain proof of SMS consent, help requests, opt-outs, and suppression lists for compliance.
• Comply with legal obligations (tax records, lawful requests, fraud prevention).

We do not sell personal data, and we do not use student or flight-record data to train third-party machine-learning models.

We share information only as needed to provide the Service:

• Within a school. Owners, chief instructors, instructors, and front desk users see records appropriate to their role, scoped by row-level security.
• Between schools. Never. Each school's data is isolated.
• Stripe. For invoicing and payment processing. Stripe's privacy practices govern data sent to it.
• Google / Calendly. Only when you connect an integration, and only the schedule fields required to sync.
• SMS / email providers. To deliver messages you have consented to receive or that are required to operate the Service.
• Infrastructure. Hosting, database, and content-delivery vendors under contract with us and bound by confidentiality.
• Legal. When required by law, valid legal process, or to protect the rights, property, or safety of users.
• Successor entity. If StratusLog is acquired or merged, your data may transfer subject to this Policy.

We do not sell or rent personal data. We do not share SMS opt-in consent, mobile phone numbers, or text-message consent records with third parties or affiliates for their own marketing or promotional purposes.

StratusLog and participating schools may use text messages to send service-related communications such as lesson reminders, schedule changes, billing/payment notices, account notices, and support updates. Message frequency varies by your activity and school settings; a typical user may receive up to two messages per month, while active scheduling or billing workflows may generate additional operational messages.

When consent is collected verbally, staff must clearly describe the message program and ask for an explicit “yes” or “no” before enrollment. After opt-in, the user should receive or be shown confirmation that they are enrolled. Message and data rates may apply. Reply HELP for help. Reply STOP to opt out.

Verbal consent is used only for service-related or transactional messaging where permitted. Marketing or promotional text messages require written consent, such as a checked website box, signed authorization, or opt-in by text. Verbal consent alone is not sufficient for marketing text messages.

We retain flight records, student records, and billing history for as long as your school maintains an active account, plus a period afterward to satisfy tax, accounting, and aviation record-keeping obligations. You can export your data at any time from the app or by request.

If you delete your account, we delete personal data within 30 days, except where retention is required by law or to resolve disputes.

We use industry-standard practices to protect your data, including HTTPS for all traffic, AES-256-GCM encryption for sensitive credentials at rest, role-based access controls, row-level data isolation per school, and ongoing monitoring. See our Security page for detail.

No system is perfectly secure. You are responsible for protecting your account credentials and for promptly notifying us of any suspected unauthorized access.

Depending on where you live, you may have rights to access, correct, export, or delete your personal data, or to restrict or object to certain processing. To exercise any right, contact support@getstratuslog.com. We will respond within the period required by applicable law (typically 30–45 days).

California residents: you have the rights described in the CCPA/CPRA. We do not “sell” or “share” personal data as those terms are defined under California law.

EU / UK / Swiss residents: our lawful bases for processing are contract performance, legitimate interests (operating and improving the Service), consent (for integrations and marketing), and legal obligation. You may lodge a complaint with your local data protection authority.

StratusLog is a business tool used by flight schools. It is not directed to children under 13, and we do not knowingly collect personal data from anyone under 13. Student pilots who are minors may appear in school records entered by authorized school staff; that data is governed by this Policy.

If you access StratusLog via a mobile app distributed through the Apple App Store or Google Play, the following data categories may be associated with your identity for app-store disclosure purposes:

• Contact info (name, email, phone) — for account, support, and transactional messages
• User content (flight notes, endorsements) — for app functionality
• Identifiers (account ID) — for authentication and product analytics
• Usage data — for product analytics and crash diagnostics
• Diagnostics — for crash and performance reporting

We do not use data for third-party advertising. We do not track users across apps and websites owned by other companies.

We process data in the United States. If you access StratusLog from outside the U.S., you understand and consent to the transfer and processing of your data in the U.S., where data protection laws may differ from those in your country.

We may update this Policy from time to time. We will post the updated version with a new effective date, and notify school owners of material changes by email or in-app notice.

Privacy questions or requests: support@getstratuslog.com.