Privacy Policy

AeroSlate uses your uploaded bid packages only to generate bid analysis, rankings, explanations, tags, favorites, and exports, for you. We don't sell your data, share it with other users, or use it to train third-party AI models. Raw uploaded PDFs are deleted after parsing unless you choose otherwise. You can delete your data from your account at any time.

The data we hold falls into four categories:

• Account data. Email address, hashed password (via Supabase Auth), and the timestamps of when you signed up and last logged in.
• Pilot Profile. What you enter on the Account page -- company, position, hire date, base, fleet, commuter status, commute airports. We use these to scope analysis and pre-fill defaults.
• Uploaded bid pack PDFs. The raw files you upload. These are stored in a private Supabase Storage bucket scoped to your user ID; no other user can read them. Retention follows the policy you pick on your account page (see §5).
• Parsed bid pack data. Pairings, dates, credit, block, layovers, deadheads, report and release times, scores, tags, your favorites, and exports. This is what makes the product work.

We also collect minimal subscription metadata via Stripe: your customer ID, subscription status, and billing period. We never see or store your full card number.

We use your data only to provide the product to you. Specifically: parsing the bid package, computing the scores, ranking pairings against your stated preferences and constraints, generating exports, managing your subscription, and emailing you about account or billing changes.

We do not use your data for advertising, lead generation, or model training, and we don't hand your data to any third party that does either.

We don't sell your data. We don't share it with other AeroSlate users. We don't share it with airlines. We don't send it to third-party AI models. Bid analysis runs on deterministic code we wrote ourselves; nothing about your pairings, scores, or PDF contents is ever sent to OpenAI, Anthropic, Google, or any other AI vendor.

We share the minimum necessary with the infrastructure providers AeroSlate is built on (see §8). We will share data with law enforcement only when compelled by valid legal process, and only the minimum required.

• Raw uploaded PDFs: deleted after parsing by default. You can change this on your Account page to keep them 7 days (for one-click Reparse) or keep them indefinitely until you delete the package.
• Parsed bid pack data: kept until you delete it. You can delete a single package from its detail page, or wipe everything from the Account page.
• Account data: kept while your account exists. Email us to fully delete your account; we remove the account row and all linked data within 30 days.
• Subscription / billing records: retained as long as required by applicable financial recordkeeping law (typically up to 7 years).

All traffic between your browser and AeroSlate is encrypted in transit (HTTPS). Your bid pack PDFs live in a private Supabase Storage bucket with row-level security policies that restrict access to your user folder. at the database level, not just the application layer.

Account passwords are managed by Supabase Auth and stored hashed (we never see them). The backend service key used to access storage is held only on the server and never exposed to the browser. We do not log raw PDF contents or pairing details to our application logs.

No system is perfectly secure. If you find a vulnerability, please email us before disclosing it publicly. See contact below.

• Access: everything we have about you is visible to you in your account: your profile, your packages, your favorites, your exports.
• Export: bid analysis exports are available on demand on each package's Export page in plain text, PBS-style, CSV, and JSON formats.
• Delete (per package): click the Delete button on a package detail page to remove it permanently.
• Delete (all packages): use the "Delete all my bid packs" button on the Account page.
• Delete the entire account: email us. We respond within 30 days.

AeroSlate depends on a few well-known providers:

• Supabase: authentication, database, file storage. Subject to Supabase's privacy policy.
• Stripe: payment processing and subscription management. Subject to Stripe's privacy policy.
• Vercel: frontend hosting. Subject to Vercel's privacy policy.
• Render: backend hosting. Subject to Render's privacy policy.

We share the minimum necessary with each: your email and password hash with Supabase Auth; your email and subscription info with Stripe; nothing user-identifiable with Vercel or Render beyond standard request logs.

We use cookies and browser local storage for two things: keeping you logged in (session cookies from Supabase Auth) and remembering your filter selections between pages on the pairings list (sessionStorage). We don't use tracking cookies, advertising pixels, or analytics that follow you across sites.

AeroSlate is intended for licensed pilots. You must be at least 18 years old to create an account. We don't knowingly collect data from anyone under 18. If you believe a child has signed up, email us and we'll remove the account.

We update this Policy when the service or the law changes. Material changes get an email or in-app notice. The current version is always at aeroslate.io/privacy.

Privacy questions, deletion requests, or security reports go to support@aeroslate.io.