VECTORAviation Services

Privacy Policy

Effective September 11, 2026 · Version 2026.09.11.1

Vector Aviation Services, LLC (“Vector”), a Florida limited liability company, respects your privacy. This policy explains what we collect, how we use and protect it, and your choices. It applies to vectorflightco.com, the Vector Owner experience, and the Vector Owner app. Markets: United States (primary), Canada, Mexico, and the Caribbean. Privacy officer: the owner, info@vectorflightco.com.

Information we collect

Public site visitors: if you use a contact form, the name, email, and message you send. Standard server and security logs (IP address, user agent, timestamp, URL) are processed by our infrastructure provider to operate and protect the Site. The Site and the members app use Google Analytics to measure pages viewed, how you arrived, browser and device type, and an approximate location derived from IP address. They also use Cloudflare Web Analytics to measure page views, referral source, browser, operating system, device category, country, page-load timing, and Core Web Vitals. See Cookies below.
Members: name and email for sign-in; aircraft, maintenance, scheduling, flight-log, and preflight data you enter; documents and photos you upload; Hangar profile, posts, and media; notification tokens if you enable push; and membership billing identifiers from Stripe.
Voice (optional): spoken checklist commands are recognized on the device. If you start in-app voice support, microphone audio is sent to ElevenLabs for that session after you consent in the app. Vector does not keep a recording of the session.
International travel: if you use manifest features, traveler details you provide, which may include date of birth, citizenship, address, passport number, and passport expiry. Only the member who created the profile should enter it, and only with the traveler’s consent.
Photos, video, and documents you upload: aircraft photos, logbook scans, squawks, receipts, and Hangar media.
Aircraft and phone position: where your aircraft broadcasts ADS-B, we may retrieve that publicly broadcast position from public networks and keep a history so you can see the aircraft and draft log entries. The iOS app also offers an optional block timer. After you grant location permission and arm it, or a trip planned for that day arms it, the phone uses location while the flight is active, including when locked. It reduces the route on the phone to first-movement and final-stop timestamps and positions, a sample count, and peak ground speed; only that summary is sent to Vector with the flight. The intervening route is not uploaded. You can stop the timer in the app or disable location in iOS Settings.
Plaid (optional): if you connect a bank or card account, Plaid sends us transaction data so the app can flag and tag trip expenses. We do not receive your bank password. You can disconnect Plaid in the app.
Apple Health: the app does not read or write Apple Health data. An earlier iOS build offered an optional, read-only readiness card; that card and the preflight risk score it fed were removed on 2026-09-18, and no Health measurement was ever uploaded to Vector.
Legacy pilot certificate and medical dates: the app no longer collects pilot certificates, medical class, BasicMed status, or their expiration dates. Any such dates you entered in an earlier version remain account data you entered, not a medical-practice record, until you delete them or your account.
Notification registrations: push subscription or device token, stored only while notifications are enabled.
Diagnostic reports: when the Site or app hits an error, a short technical report (error, page, user agent, and if signed in an account identifier) kept about 30 days to fix the problem, not for advertising.

The Hangar

Handles, bios, posts, photos, video, follows, and likes in the Hangar are visible to other members. Publish only what you are willing to share. Do not post another person’s information without consent. Vector may review posts, including with automated tools, to enforce community rules.

How we use it

To provide the services you request: membership, scheduling, maintenance tracking, recordkeeping, risk and preflight aids, Hangar, expense tagging, invoicing, and, where you direct us, preparing customs (eAPIS) manifests. Until Vector is an approved CBP transmitter, a Vector person files those manifests by hand from the data you entered.
To communicate about your account, security, billing, and your requests.
To secure, maintain, and improve the Site, including rate limiting and abuse prevention.

We do not sell personal information. We do not use it for third-party advertising. We do not use customer content to train foundation models.

How we protect it

Traffic is encrypted in transit (HTTPS/TLS). Data is encrypted at rest by our infrastructure provider.
Passport numbers are additionally encrypted at the field level and are never displayed in full; only the last few digits are shown.
Sign-in uses one-time email codes and a human-verification challenge, with rate limits.
We do not store ForeFlight, Garmin, CBP, or bank passwords.

No method of transmission or storage is perfectly secure. If we become aware of a breach of personal information affecting you, we will notify you and, where required, the Florida Department of Legal Affairs, no later than 30 days after we determine that a breach has occurred or as sooner required by Florida Statutes § 501.171 and the law of your place of residence.

Cookies and local storage

Security cookies. Sign-in is protected by Cloudflare Turnstile, which sets cookies to tell people from bots. After you pass that check, the Site sets a first-party signed security cookie so you are not challenged on every request, and email sign-in sets a session cookie.
Local storage. The app keeps your sign-in token and an offline snapshot of your own account data on the device. Signing out or deleting your account clears it.
Analytics cookies. The Site, including the members app, uses Google Analytics 4 (Google LLC). It sets first-party cookies (_ga, and _ga_ followed by an identifier) that hold a random visitor identifier for up to two years, and it sends Google the pages you view, how you arrived, browser and device type, and IP address, from which Google derives an approximate location. We serve its script from our own domain, switch off Google signals, ad personalization, and Google’s automatic click, download, form, and search events, and strip private sign-in links and Hangar details from the reported page address. You can block it with the Google Analytics opt-out browser add-on or by blocking cookies.
Cookie-free performance analytics. The Site, including the members app, uses Cloudflare Web Analytics to measure page views, page-load timing, Core Web Vitals, referral source, browser, operating system, device category, and country. Cloudflare says this service does not use cookies, local storage, or fingerprinting to identify visitors, does not log query strings, and does not track individuals across different sites. It does not receive the contents of forms, uploads, private records, or messages through this analytics beacon.
We set no advertising cookies, and we do not use analytics data to serve advertising.

Who we share it with

Cloudflare: hosting, storage, security, and cookie-free Web Analytics.
Resend: transactional email (sign-in codes and account notices).
Apple: push notifications, only when you enable them. On-device speech recognition for checklist commands is processed by Apple when you use that mode.
ElevenLabs: optional in-app voice support. Audio is sent only after you consent in the app, to run that session. It is not used for advertising.
Google: Analytics, as described above.
Stripe: membership payments and automatic renewals, and payment pages for invoices or shop work orders. Vector never sees unencrypted card numbers. For shop work orders the shop is the merchant of record.
Mercury: Vector’s business account for professional-service invoices (management, training, contract pilot). Mercury is not the membership processor.
Plaid: optional bank and card connection for expense tagging.
Anthropic: when a feature you use calls for it: reading a logbook scan you uploaded, answering a support request you sent, analyzing maintenance data you asked about, or reviewing Hangar content against community guidelines. Content is sent to provide that feature. Vector’s intended configuration is that customer content is not used to train Anthropic’s foundation models. That is a vendor setting Vector maintains, not a warranty that a model provider will never change its terms. Do not put passport numbers into free-text prompts.
The maintenance shop you engage through the app: work-order details, messages, and media you and the shop exchange.
U.S. Customs and Border Protection (and, where you file into Canada, CBSA) when you authorize a manifest. Until Vector is an approved eAPIS transmitter, filing is by hand by a Vector person using the data you entered. Vector does not guarantee clearance.
As required by law, to protect legal rights, or in a sale of the company, subject to this policy.

Where information is processed

Vector operates from Florida, United States. Information is processed and stored in the United States. If you use the services from elsewhere, you understand your information is handled in the United States. We do not currently target the EEA or the United Kingdom as markets and we have not appointed an EU Article 27 representative. If you are in the EEA or UK and still use the Services, we process as needed to perform the contract or on the basis of your consent for optional features.

Retention and deletion

We keep information as long as needed to provide the services and to meet legal, tax, and recordkeeping duties, then delete or minimize it. Start account deletion in the app under Profile › Delete my account. Confirming it revokes access links, signs you out everywhere and stops your membership from renewing. Vector removes your personal details (name, email, phone, address, and similar identifiers) automatically 7 days later and emails you when done, except for records described below. You can cancel from the same screen during those 7 days.

14 CFR § 91.417 is the owner’s or operator’s duty, not Vector’s. Vector is not the operator of your aircraft. Keeping a copy of a log or work order in Vector’s software does not satisfy your 91.417 obligation. Keep the Aircraft’s official records yourself. You may export records from the Service at any time while the account is open.

After deletion, we may keep a minimized copy of flight, fuel, trip-receipt, customs-filing, or maintenance records that (a) you asked us to store as your agent, (b) we need to substantiate Vector’s own invoices and taxes, or (c) we must keep under a legal hold, for up to seven (7) years. Aircraft N-number on those records can still identify an owner. We strip name, email, and phone from the copy we keep when we can do so without breaking that legal purpose. Passenger profiles are controlled by the member who created them.

Your rights

You can ask us to tell you what personal information we hold, to correct it, to delete it, to give you a copy in a portable format, or to restrict a particular use. Email info@vectorflightco.com. We verify that a request comes from the account holder. Exercising these rights does not change the price or quality of the services.

California and similar state laws. We do not sell personal information and we do not share it for cross-context behavioral advertising. You may request access, correction, deletion, and a copy, and may limit the use of sensitive personal information (including passport numbers) to what is necessary to provide the Services.

Florida Digital Bill of Rights. That statute applies to a narrow class of very large technology firms. Vector is not a “controller” under Fla. Stat. § 501.702. We still handle Florida residents’ data under this policy, under Fla. Stat. § 501.171 (breach notice), and under the FTC Act’s prohibition on deceptive practices.

Canada. We handle personal information in accordance with PIPEDA and, for Quebec residents, Law 25. If you submit a passenger manifest for a Canadian arrival or departure, you warrant you have each traveler’s consent.

Mexico. You may request access, rectification, cancellation, or opposition (ARCO) by emailing the address above.

EEA and United Kingdom. Where GDPR applies despite our markets, legal bases are: performance of the contract; legitimate interests in securing the Site; and consent for optional features, which you may withdraw. You may lodge a complaint with your supervisory authority.

Children

Membership is for adults 18 and older. We do not knowingly collect personal information from anyone under 13, and we do not create member accounts for anyone under 18. If we learn we have, we will delete it. One exception is deliberate and narrow: traveler profiles a member creates for international-manifest (eAPIS) filings may include the member’s minor family members. That information is supplied by the member, is used only to prepare the border-crossing manifest, and is protected by the passport safeguards described above.

Not HIPAA

General aviation Part 91 tools are not a HIPAA covered health-care practice. Any legacy self-typed medical-certificate dates are not processed as HIPAA electronic protected health information. We still restrict access, encrypt, and do not use that data for marketing.

Changes

If we change this policy in a material way, we will announce the change in the app or by email before it takes effect, and we will update the date at the top of this page. Earlier versions are available on request.

Consent for likeness

Photographs and video on the public Site depict people who consented to Vector’s use of their image. If you appear in Vector’s media and want it discussed, contact us.

Contact

Vector Aviation Services, LLC · KOPF, Miami, Florida
Registered agent: 6800 SW 40th Street #497, Miami, FL 33155
info@vectorflightco.com · +1 (941) 417-9888