Privacy Policy

1. Who This Policy Covers

This policy applies to the flight schools and their administrators and instructors who use Maverick ("customers," "you"), and to the information handled through the service. Students do not have accounts. Schools enter and control student data on their students' behalf.

2. Information We Collect

• Account information. When an administrator or instructor creates an account, we collect a name, an email address, a password (stored only in a securely hashed form by our authentication provider), and optional instructor details such as a CFI certificate number, a certificate expiration date, and a digital signature used to render endorsements.
• School information. The school name, location (city and state), fleet and aircraft details, and configuration settings.
• Student training records entered by schools. Schools enter and store student data, which can include: student identity information (name, date of birth, and optionally email, phone, and enrollment details); certificates and ratings held or pursued; flight and ground training times and lesson details; endorsements issued; checklist and stage-check progress; TSA verification status; medical certificate, BasicMed, and airman knowledge test records, including the class of medical certificate and the dates of examination and of passing a test; and prospective-student CRM information.
• Payment information. Handled by Stripe, as described in Section 7. Maverick never receives or stores full card numbers.
• Usage and technical information. Basic technical data needed to operate and secure the service, such as authentication session data and standard server logs.
• Error and diagnostic information. When something in Maverick fails, we record diagnostic details so we can fix it: the error message and stack trace, the page or route involved, the browser or server environment, the software version, the school identifier, and whether the signed-in user is an administrator or an instructor. Personal and student information is removed from these reports before they are sent, as described in Section 8.

3. How Schools and Genoa Labs Share Responsibility for Student Data

The student training records in Maverick are entered and controlled by the school, for the school's own record-keeping. The school decides what to collect, is responsible for the accuracy of that data, and is responsible for obtaining any consent or authorization the law requires before entering it.

This includes any consent needed for records of students who are minors: student pilots can be under 18, and the school is responsible for any parental or guardian consent that applicable law requires. Genoa Labs processes this data on the school's behalf and in accordance with this policy. We do not use it for our own independent purposes, except to create aggregated and de-identified information as described in Section 5.

4. How We Use Information

We use the information we collect to: provide, operate, secure, and improve Maverick; authenticate users and enforce access controls; process subscription payments through Stripe; send transactional and service messages (such as automated reports and account or billing notices) when those features are configured; respond to support requests; create aggregated and de-identified information as described in Section 5; and comply with our legal obligations. We do not use student training records for advertising or to build advertising profiles.

5. Aggregated and De-Identified Information

We may de-identify and/or aggregate information collected through Maverick (for example, statistics about training timelines, flight activity, aircraft usage, or weather conditions across schools) so that it no longer identifies any school or individual. We maintain and use de-identified information only in de-identified form and do not attempt to re-identify it, except as permitted by law solely to test whether our de-identification processes are effective. We may use and share aggregated and de-identified information for any lawful purpose, including research, industry and safety reporting, product improvement, and commercial purposes.

6. We Do Not Sell Your Personal Data

We do not sell personal information. Aggregated, de-identified information that cannot reasonably be used to identify any school or individual may be used and shared as described in Section 5. We do not share personal information for advertising or cross-context behavioral advertising. We do not use student data for advertising of any kind.

7. Payments

Subscription payments are processed by Stripe, our payment processor. Stripe collects and handles your payment method directly, under its own terms and privacy policy. Maverick stores only limited billing references (such as a customer or subscription identifier and a subscription status) needed to manage your plan. Maverick never receives, sees, or stores full card numbers or other sensitive payment credentials.

8. Service Providers (Subprocessors)

We use a small number of trusted service providers to run Maverick. Each processes information only as needed to provide its service to us:

• Supabase: database hosting and authentication.
• Vercel: application hosting and delivery.
• Stripe: subscription payment processing.
• Resend: transactional email delivery, used only for the messages a school turns on itself. A school can enable an automated training report, which contains that school's own student names, certificate tracks, flight hours, lesson counts and last flight dates, and a weekly backup email, whose attachment is a complete copy of that school's training records, including the medical and knowledge test records described in Section 2. Those messages are delivered only to the addresses that school's own administrator enters in its settings, and Maverick never sends one school's records to another school's address. When a school configures no recipients, or email delivery is not enabled, Resend receives nothing.
• Sentry: error monitoring, so that we learn about software faults and can fix them. Sentry receives diagnostic data about errors: the type of error and its message, the code location and stack trace, the page or route involved, the browser or server environment, the software version, the school identifier, and whether the signed-in user is an administrator or an instructor. Before any report is sent, Maverick removes personal and student information from it, including names, email addresses, student identifiers, dates, request contents, form submissions, and cookies. Sentry does not receive student training records or medical records.

These providers are bound by their own agreements and privacy commitments. We may update this list as our providers change; a material change is handled as described in Section 14. Third parties that receive only aggregated, de-identified information under Section 5 do not receive personal information and are not subprocessors.

9. Cookies

Maverick uses cookies only for authentication and session management (keeping you signed in and secure). We do not use advertising or third-party tracking cookies in the application.

10. Data Security

We protect data with measures appropriate to its sensitivity, including encryption in transit, database-level access controls that isolate each school's data from every other school's, and restricted administrative access. No system is perfectly secure, and we cannot guarantee absolute security, but we work to protect your information and to limit access to it.

11. Data Retention and Deletion

We keep account and training data for as long as your account is active. When you cancel or close your account, we retain your data for a reasonable window so you can reactivate or export it, and then delete it from our active systems. Residual copies may persist in routine encrypted backups for a limited additional period before they are overwritten. Aggregated and de-identified information that does not identify you or your school may be retained and used as described in Section 5 (Aggregated and De-Identified Information) after deletion or account closure.

You can export your data at any time using the CSV, PDF, and full-backup tools inside Maverick.

12. Access and Deletion Requests

You can request access to, correction of, or deletion of the personal information we hold about you (or, for a school administrator, about your school's account) by contacting us at support@maverickfs.app. For student records that a school entered, direct requests to the school that controls that data, and we will support the school in fulfilling them. We respond to verified requests within a reasonable time and as required by applicable law. Aggregated and de-identified information that does not identify you or your school may be retained and used as described in Section 5 (Aggregated and De-Identified Information) after deletion or account closure.

13. Children's Data

Maverick is a business tool used by flight schools, not a service directed to children, and there is no student-facing login. Some student pilots are minors, and schools may enter their records. Schools are responsible for any consent that applicable law requires before entering a minor's data. If you believe a minor's information was provided to us without proper authorization, contact us at support@maverickfs.app, and we will work with the controlling school to address it.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make a material change, we will post the updated policy with a new effective date and, where appropriate, notify account administrators by email. Your continued use of Maverick after a change takes effect means you accept the updated policy.

15. Contact

Questions about this policy, or privacy requests, can be sent to support@maverickfs.app.