Privacy Policy

ROTYR Inc. ("ROTYR", "we", "us") is a Yukon company based in Whitehorse. This policy explains what personal information we collect, how we use and share it, and the choices you have. It covers both our website, rotyr.com (the "Website"), and the ROTYR aviation operations and maintenance platform, available at app.rotyr.com (the "Platform").

We handle personal information in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). In this policy:

• Client means a business that has accepted the ROTYR Subscription Agreement to use the Platform.
• Licensed User means a person a Client has invited to use the Platform, such as a pilot, dispatcher, aircraft maintenance engineer or administrator.
• Visitor means anyone who uses the Website without logging in to the Platform.
• You means any Licensed User or Visitor whose personal information we handle.

This policy forms part of the ROTYR Subscription Agreement. If the two conflict on how Client Data is handled, the Subscription Agreement governs.

1. Information we collect

We collect only what we need to run the Platform and the Website, bill Clients and provide support. The Website collects information only from Visitors who contact us. Most of what we hold comes from Clients and Licensed Users of the Platform.

• Account and profile (from the Licensed User or the Client's administrator): name, email, phone, job title, and aviation credentials a Licensed User chooses to add (pilot licence, AME licence, aircraft certification authority number), signature image and profile photo. Passwords are held by our login provider, not by us.
• Organization (from the Client): company name, addresses, contact names, emails and phone numbers, AMO and other certificate numbers, logo.
• Operational records (from the Client and its Licensed Users): aircraft, parts, maintenance entries, journey logs, releases, defects, work orders, inventory and uploaded documents. These records include the names, licence numbers, initials and signatures of the people who made or approved them.
• Billing (from the Client): subscription plan (Essential or Pro), number of aircraft, any additional ROTYR credits purchased, and payment status. Card details are entered directly on our payment processor's pages; we never see or store full card numbers.
• Support (from Licensed Users and Visitors): messages sent to support@rotyr.com or info@rotyr.com, and questions typed into the Platform's help assistant.
• Usage and technical (collected automatically when Licensed Users use the Platform): login times, feature use, AI usage counts, and server logs such as pages requested and error codes.
• Website enquiries (from Visitors): name, work email, company and any message sent through our contact form or by email.
• Website statistics (from Visitors): anonymous page-view counts that do not identify anyone.

We do not knowingly collect personal information from anyone under 18. The Platform is intended for business use.

2. How we use it

We use personal information to:

• create and manage Licensed User accounts, and verify who is logging in;
• provide the Platform, including records, forecasts, alerts, reports and AI-assisted features;
• process Client subscriptions and payments;
• respond to support requests and send service messages to Clients and Licensed Users, such as invitations, password resets, security notices and changes to our terms;
• keep the Platform and the Website secure, investigate misuse and fix problems;
• understand how the Platform and the Website are used so we can improve them;
• send marketing emails, only as described in section 7; and
• meet legal, regulatory and accounting obligations.

We rely on your consent. Consent may be implied when a Client or Licensed User provides information to use the Platform, or when a Visitor contacts us. We ask for express consent before using information for a new purpose, or for marketing where the law requires it. We do not sell personal information.

3. Client Data and who is responsible

Clients own the records they and their Licensed Users enter into the Platform ("Client Data"). For Client Data, we act on the Client's behalf, under the Subscription Agreement. The Client decides what goes into the Platform, who can see it, and how long it must be kept for aviation regulations.

If you are a Licensed User and want to see or correct your information in a Client's records, such as your name on a journey log entry, contact that Client first, because the Client controls those records. We will help them respond.

Clients are responsible for having the right to upload the information they add, including information about their staff, contractors and customers, and for giving those people any notice the Client's own privacy obligations require.

To provide support and resolve technical issues, and with the Client's approval, a small number of authorized ROTYR staff can access Client Data. Without that approval, staff access Client Data only when needed to keep the Platform secure or to meet a legal requirement.

4. AI features and de-identified data

Some Platform features use artificial intelligence provided by Anthropic, a US company. These include the help assistant, importing aircraft data from uploaded documents, and maintenance insights. When a Licensed User uses an AI feature, the relevant information is sent to Anthropic to generate a response. That can include uploaded documents and records containing personal information. Anthropic processes this information under its commercial terms, which do not allow it to use the information to train its AI models. It may keep the information for a limited time for safety and operational purposes.

AI outputs are assistive only. They can be incomplete or wrong, and must be checked by qualified people before anyone relies on them.

We may also create de-identified data from Client Data. That means removing names, organization names, aircraft registrations, serial numbers and anything else that could reasonably identify a person, organization or aircraft. We may use de-identified data for analytics, benchmarking, commercial insights, improving the Platform and training AI models. De-identified data is not personal information.

5. Who we share it with

We share personal information only as described here. We use these service providers, who may only use the information to provide their service to us:

• Microsoft Azure: hosting, database, file storage and backups
• Auth0 (Okta): user login and password management
• Stripe: payment processing
• Resend: sending service and marketing emails
• Anthropic: AI features (see section 4)
• Vercel: hosting the Website
• Plausible Analytics: anonymous Website statistics
• GitHub: tracking issues reported through the Website

We may add or replace providers. We keep this list current.

We may also share personal information:

• within a Client, as that Client's settings allow, and with other organizations or people a Client chooses to share records with, such as through a shared fleet-status link;
• with third-party services a Client connects, such as a messaging platform, at the Client's direction;
• when the law requires it, or to protect the rights, safety or property of ROTYR, our Clients or others; and
• in a business transaction, such as a merger, financing or sale, under confidentiality obligations.

6. Where your information is stored

The Platform and its backups are hosted in Canada and the United States. Some of our service providers listed in section 5 process information in the United States or other countries. Information processed outside Canada is subject to the laws of those countries and may be accessed by their courts, law enforcement and national security authorities.

We use contracts and other measures to make sure our providers protect personal information to a standard comparable to Canadian law. You can contact our Privacy Officer (section 11) for more information about our providers outside Canada.

7. Marketing emails, cookies and advertising

Marketing emails. We send marketing emails only to people who have agreed to receive them, or where Canada's Anti-Spam Legislation (CASL) otherwise allows, such as to current Clients. Every marketing email identifies ROTYR, includes our mailing address and has an unsubscribe link. Unsubscribing takes effect within 10 business days and does not stop essential service messages about your account.

Cookies and analytics. The Website uses Plausible and Vercel Web Analytics to count page visits. Neither uses cookies or identifies individual visitors. The Platform does not use advertising or tracking cookies.

Advertising. We may advertise ROTYR through services such as Google Ads. Before we use any advertising or tracking cookies on the Website, we will update this policy and ask for your consent where required.

8. How long we keep it

We keep personal information only as long as needed for the purposes in this policy, or longer if the law requires it.

• Client Data is kept while the Client's subscription is active. After it ends, we keep it for two years so the Client can request its historical records by emailing info@rotyr.com, as set out in the Subscription Agreement. After that, we may delete it. The two-year period does not apply if a Client cancels during its 7-day free trial, or if its first payment fails and is not made within 30 days, as set out in the Subscription Agreement.
• Aviation records. Maintenance entries, journey logs and releases are regulatory records. Names, licence numbers and signatures on them are kept with the record and cannot be removed while the record is kept. Corrections are added as amendments, so the original entry stays visible.
• Backups are deleted on a rolling schedule, normally within 120 days.
• Website enquiries and marketing lists are kept until you ask us to delete them or unsubscribe, or until they are no longer useful.
• Billing records are kept as long as tax and accounting laws require.

9. Security

We protect personal information with safeguards suited to its sensitivity. These include encryption in transit, encrypted storage, access controls that separate each Client's data, limits on staff access, and regular backups.

No system is perfectly secure. Licensed Users help by keeping their login details private and using multi-factor authentication when it is offered or required.

If a breach of security safeguards creates a real risk of significant harm to anyone, we will report it to the Office of the Privacy Commissioner of Canada and notify affected people and Clients as soon as feasible, as PIPEDA requires.

10. Your choices and rights

You can ask us to:

• tell you what personal information we hold about you, how we use it and who we have shared it with;
• give you access to it;
• correct information that is inaccurate or incomplete; and
• stop using it for a purpose you previously agreed to, such as marketing.

Withdrawing consent may mean we can no longer provide some or all of the Platform. We cannot stop keeping information the law or a Client's regulatory obligations require us to keep. For Client Data, we may refer your request to the Client (see section 3).

Send requests to our Privacy Officer (section 11). We may need to confirm your identity first. We will respond within 30 days, or tell you if we need more time and why. Requests are free.

If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada.

11. Changes and contact

We may update this policy. We will post the new version at rotyr.com/privacy with its effective date. We will notify Clients by email or in the app at least 30 days before any change takes effect.

Privacy Officer
ROTYR Inc.
146 Titanium Way
Whitehorse, Yukon Y1A 0G1
info@rotyr.com