Privacy Policy

StratusLog is flight school operations software operated by Stratus Log LLC. We provide scheduling, digital flight logbooks, training-progress tracking, and invoicing tools to flight schools, certified flight instructors, and their students.

This Privacy Policy describes the data we collect through https://getstratuslog.com and through https://app.stratuslog.co (collectively, the “Service”), and how that data is used and shared.

We collect the following categories of personal data:

• Account data. Name, email, phone number, password (hashed), and role within a school.
• School data. School name, location, instructor roster, aircraft fleet, billing rates, and operational settings.
• Student data. Names, contact details, certificate track, training stage, milestones, medical expiry, and logged flight history.
• Flight records. Date, route, duration, landings, Hobbs/Tach, instructor and student references, remarks, and endorsements.
• Payment data. Stripe customer and invoice identifiers, payment status, and amounts. We do not store full card numbers; Stripe processes and stores payment instruments directly.
• Integration tokens. OAuth access and refresh tokens for Google Calendar, Calendly, and Stripe Connect. These are encrypted at rest.
• Usage data. Pages viewed, actions taken, timestamps, IP address, browser, OS, and device identifiers for security, support, and product improvement.
• Communications. Messages you send to support, sales, or via the contact form.
• SMS consent records. When you consent to receive text messages, we may record your phone number, consent method, consent date/time, the staff member or form that collected consent, and opt-in/opt-out status.

We use personal data to:

• Provide, operate, and improve the Service.
• Authenticate users, secure accounts, and prevent abuse.
• Send transactional messages — invoice links, payment receipts, schedule confirmations, lesson reminders, account notices.
• Generate Stripe invoices and process payments on behalf of your school.
• Sync schedule events with connected calendars when you authorize it.
• Respond to support requests.
• Send SMS/text messages only where consent and applicable law allow it, including operational reminders, scheduling updates, billing/payment notices, and support-related messages.
• Maintain proof of SMS consent, help requests, opt-outs, and suppression lists for compliance.
• Comply with legal obligations (tax records, lawful requests, fraud prevention).

We do not sell personal data, and we do not use student or flight-record data to train third-party machine-learning models.

We share information only as needed to provide the Service:

• Within a school. Owners, chief instructors, instructors, and front desk users see records appropriate to their role, scoped by row-level security.
• Between schools. Never. Each school's data is isolated.
• Stripe. For invoicing and payment processing. Stripe's privacy practices govern data sent to it.
• Google / Calendly. Only when you connect an integration, and only the schedule fields required to sync.
• SMS / email providers. To deliver messages you have consented to receive or that are required to operate the Service.
• Infrastructure. Hosting, database, and content-delivery vendors under contract with us and bound by confidentiality.
• Legal. When required by law, valid legal process, or to protect the rights, property, or safety of users.
• Successor entity. If StratusLog is acquired or merged, your data may transfer subject to this Policy.

We do not sell or rent personal data. We do not share SMS opt-in consent, mobile phone numbers, or text-message consent records with third parties or affiliates for their own marketing or promotional purposes.

No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. Information sharing to subcontractors in support services, such as customer service, is permitted.

Text messaging originator opt-in data and consent will not be shared with any third parties, except for aggregators and providers of the text-message service.

Stratus Log LLC, operating as StratusLog, and participating schools may use text messages to send transactional, informational, and alert communications such as lesson reminders, schedule changes, billing and payment notices, account notices, and support updates, and — with separate consent — promotional and marketing messages. Message frequency may vary, up to 10 messages per month. Message and data rates may apply. Reply HELP for help. Reply STOP to unsubscribe.

You can opt in on our text message opt-in page, in the StratusLog app, by texting an opt-in keyword to our number, or verbally to your flight school. When consent is collected verbally, staff must clearly describe the message program and ask for an explicit “yes” or “no” before enrollment. After opt-in, the user receives confirmation that they are enrolled. You must be 18 years of age or older to use this SMS service.

Verbal consent is used only for service-related or transactional messaging where permitted. Marketing or promotional text messages require written consent, such as a checked website box, signed authorization, or opt-in by text. Verbal consent alone is not sufficient for marketing text messages.

We use a small number of first-party cookies and equivalent local-storage keys. We do not use third-party advertising cookies, and we do not track you across other companies’ apps or websites.

• Strictly necessary. Session and authentication cookies that keep you signed in and protect against cross-site request forgery. The Service cannot function without these.
• Preferences. Local storage that remembers your timezone, unit, and display settings.
• Security. Cloudflare Turnstile and bot-mitigation cookies used to block automated abuse of our forms and sign-in.
• Analytics. Aggregate, first-party page and feature usage counts used to improve the product. These are not sold, not shared, and not used to build advertising profiles.

You can block or delete cookies in your browser settings. Blocking strictly necessary cookies will prevent sign-in from working. We honor Global Privacy Control (GPC) signals where applicable law requires it.

We retain flight records, student records, and billing history for as long as your school maintains an active account, plus a period afterward to satisfy tax, accounting, and aviation record-keeping obligations. You can export your data at any time from the app or by request.

If you delete your account, we delete personal data within 30 days, except where retention is required by law or to resolve disputes.

We use industry-standard practices to protect your data, including HTTPS for all traffic, AES-256-GCM encryption for sensitive credentials at rest, role-based access controls, row-level data isolation per school, and ongoing monitoring. See our Security page for detail.

No system is perfectly secure. You are responsible for protecting your account credentials and for promptly notifying us of any suspected unauthorized access.

Depending on where you live, you may have rights to access, correct, export, or delete your personal data, or to restrict or object to certain processing. To exercise any right, contact support@getstratuslog.com. We will respond within the period required by applicable law (typically 30–45 days).

California residents: you have the rights described in the CCPA/CPRA. We do not “sell” or “share” personal data as those terms are defined under California law.

EU / UK / Swiss residents: our lawful bases for processing are contract performance, legitimate interests (operating and improving the Service), consent (for integrations and marketing), and legal obligation. You may lodge a complaint with your local data protection authority.

StratusLog is a business tool used by flight schools. It is not directed to children under 13, and we do not knowingly collect personal data from anyone under 13. Student pilots who are minors may appear in school records entered by authorized school staff; that data is governed by this Policy.

If you access StratusLog via a mobile app distributed through the Apple App Store or Google Play, the following data categories may be associated with your identity for app-store disclosure purposes:

• Contact info (name, email, phone) — for account, support, and transactional messages
• User content (flight notes, endorsements) — for app functionality
• Identifiers (account ID) — for authentication and product analytics
• Usage data — for product analytics and crash diagnostics
• Diagnostics — for crash and performance reporting

We do not use data for third-party advertising. We do not track users across apps and websites owned by other companies.

We process data in the United States. If you access StratusLog from outside the U.S., you understand and consent to the transfer and processing of your data in the U.S., where data protection laws may differ from those in your country.

We may update this Policy from time to time. We will post the updated version with a new effective date, and notify school owners of material changes by email or in-app notice.

Privacy questions or requests: support@getstratuslog.com.