Introduction & Scope
This Privacy Policy ("Policy") describes how AI Lab Technologies ("Company", "we", "us", or "our") collects, uses, discloses, retains, and protects personal information through the Aeroxperess mobile application ("App") and its associated backend services ("Platform").
Aeroxperess is a professional aviation operations management platform designed exclusively for licensed aviation personnel — including pilots, maintenance officers, and operations staff — employed by or contracted with organisations that have licensed the Platform. The App facilitates pre-flight briefings, post-flight documentation, crew management, compliance tracking, and associated workflows.
By accessing or using the App, you acknowledge that you have read, understood, and agree to the collection and use of information in accordance with this Policy. If you do not agree, you must immediately cease using the App and notify your organisation.
Scope of This Policy
This Policy covers:
- Personal information collected through the Aeroxperess iOS and Android mobile applications.
- Personal information collected through the Aeroxperess REST API backend services.
- Data stored in our PostgreSQL database infrastructure.
- Data processed in connection with our Enterprise Resource Planning (ERP) system integration.
This Policy does not cover third-party websites, services, or applications that may be linked from within the App.
Who We Are
The data controller and responsible entity for your personal information is:
AI Lab Technologies
Under the General Data Protection Regulation (GDPR), AI Lab Technologies acts as the Data Controller for personal data processed through the Aeroxperess Platform. Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), AI Lab Technologies is the Business. Under the India Digital Personal Data Protection Act 2023 (DPDP Act), AI Lab Technologies is the Data Fiduciary.
Data We Collect
We collect the following categories of personal information. All data is collected in the context of an active employment or contractual relationship with your aviation organisation.
3.1 Identity & Contact Information
| Data Element | Description | Source |
|---|---|---|
| Full Name | First name, last name, display name | Provided by employer at account creation |
| Email Address | Primary login identifier and OTP delivery address | Employer / user registration |
| Phone Number | Optional contact number | User-provided |
| Employee ID | Unique identifier assigned by employer | Employer system |
| Job Title | Professional title within the organisation | Employer system |
| Nationality | Country of citizenship | Employer system (HR module) |
| Passport Number & Expiry | Travel document details for international operations | Employer system |
3.2 Authentication & Security Data
| Data Element | Description | Storage |
|---|---|---|
| Password (Hashed) | Password stored using bcryptjs with 12 salt rounds — plain-text password is never stored | Server database |
| One-Time Password (OTP) | 6-digit numeric code delivered by email for two-factor authentication; expires in 5 minutes | Temporary server cache |
| JWT Access Token | Session authentication token; 7-day validity | Device encrypted storage (iOS Keychain / Android EncryptedSharedPreferences) |
| JWT Refresh Token | Long-lived token for session renewal; 30-day validity | Device encrypted storage + server database |
| Login Attempt Records | Failed login counter and account lockout timestamp (2-hour lockout after 5 failed attempts) | Server database |
| Last Login Timestamp | Date and time of most recent successful authentication | Server database |
3.3 Aviation Professional Credentials
| Data Element | Description |
|---|---|
| Pilot License Number | Government-issued aviation licence identifier |
| Licence Type | e.g., CPL (Commercial Pilot Licence), ATPL (Airline Transport Pilot Licence) |
| Licence Expiry Date | Validity period of aviation licence |
| ARN Number | Aviation authority registration number |
| Medical Certificate Expiry | Aviation medical certification validity date |
| Pilot Ratings | Array of type ratings and endorsements held |
| Currency Records | IFR, VFR, and Night currency expiry dates |
| Total Flight Hours | Cumulative flight hours (precision decimal) |
| Monthly Flight Hours | Current and previous month flying hours against monthly limits |
3.4 Financial & Payroll Information
| Data Element | Description |
|---|---|
| Basic Salary | Base remuneration (multi-currency: AED, SGD, INR) |
| Allowances | Flying, Per Diem, Night Stop, Technical, Housing, Transport, Uniform, Communication, Incentive, Overtime, Grooming, Shift, HRA, Medical, Performance |
| Deductions | CPF (Singapore), PF (India), ESI (India) — both employee and employer portions |
| Gross & Net Salary | Computed payroll totals |
| Bank Account Number | For salary disbursement |
| Bank Name | Name of employer's designated bank |
| Payslip Records | Monthly payslip PDFs and associated line items |
3.5 Flight Operations Data
| Data Element | Description |
|---|---|
| Crew Assignment | Names and roles of up to 8 crew members per operation (Captain, First Officer, Flight Engineer, Cabin Crew, etc.) |
| Aircraft Registration | Aircraft tail number / registration identifier |
| Flight Routes | Departure and arrival airport codes (ICAO/IATA), technical stop locations |
| Departure & Arrival Times | Scheduled and actual UTC times |
| Flight Duration | Block time, airborne time, flying time |
| Passenger Count | Number of passengers on board |
| Mission Type & Date | Nature of the operation and scheduling date |
3.6 Post-Flight & Maintenance Records
Post-flight data includes aircraft systems status, fuelling records (quantities, vendor, cost, slip numbers), oil servicing data, cabin safety checks, defect/snag reports, and aircraft utilisation metrics (airframe hours, cycles, engine hours, APU hours). This data is operationally linked to specific crew members and flights.
3.7 Biometric Data — Digital Signatures
The App captures handwritten digital signatures as PNG image files for regulatory sign-off purposes. See Section 9 for full biometric data disclosure.
3.8 Compliance & Documentation Records
| Data Element | Description |
|---|---|
| Visa Information | Visa number, country, validity dates for international operations |
| Insurance Policies | Policy ID, coverage type, sum insured, premium, validity |
| Training Records | Course name, duration, completion status, validity expiry |
| Document Assignments | Mandatory company documents assigned, read confirmation status |
3.9 Technical & Audit Data
| Data Element | Description |
|---|---|
| IP Address | Client IP address logged for all briefing authorisation events in the immutable audit log |
| Action Audit Log | Immutable record of: user ID, user name, action type, action details (JSON), IP address, and UTC timestamp |
| Device Information | Device model and operating system version (collected via device_info_plus for compatibility purposes) |
| HTTP Request Logs | Server-side access logs (Morgan) capturing endpoint, method, status, and response time; retained for security and debugging |
| Session Timestamps | created_at, updated_at, and action-specific timestamps (e.g., briefing_signed_on, pilot_signed_on) |
3.10 Data We Do NOT Collect
- GPS / Real-time Location: We do not collect your device GPS coordinates or real-time location. Airport codes in flight operations refer to planned routes, not your physical position.
- Camera Access: The App does not access your device camera. Signatures are captured using an on-screen drawing interface.
- Third-Party Analytics: We do not use Google Analytics, Firebase Analytics, Mixpanel, Segment, Amplitude, or similar tracking services.
- Advertising Data: We do not collect data for advertising purposes and do not serve advertisements.
- Social Media Data: We do not integrate with social media platforms.
- Minors' Data: We do not knowingly collect data from persons under 18 years of age. See Section 18.
How We Use Your Data
We use collected personal information solely for the following purposes:
| Purpose | Data Used |
|---|---|
| User Authentication & Account Security | Email, hashed password, OTP, login timestamps, JWT tokens |
| Pre-Flight Briefing Workflow | Crew identity, maintenance checks, digital signatures, aircraft data |
| Post-Flight Documentation | Flight times, fuel records, defect reports, aircraft utilisation data |
| Regulatory Compliance Verification | Licence, medical certificate, currency, ARN, visa, training records |
| Payroll Processing | Salary, allowances, deductions, bank details (under employer direction) |
| Role-Based Access Control | User role, department, crew assignments |
| Operations Scheduling & Crew Assignment | Name, role, availability, contact details |
| Security Audit Trail & Forensic Logging | IP address, action log, timestamps, user identity |
| Platform Performance & Debugging | HTTP logs, error logs, device information |
| Reporting & Analytics (Operational) | Aggregated flight hours, utilisation metrics (employer-facing only) |
| Leave & Roster Management | Name, role, leave records |
| Asset Management | Device assignment records linked to employee ID |
Legal Bases for Processing (GDPR)
For individuals in the European Economic Area (EEA) or United Kingdom, we rely on the following lawful bases under Article 6 of the GDPR for processing your personal data:
| Processing Activity | Lawful Basis | GDPR Article |
|---|---|---|
| Authentication & platform access | Performance of a contract (your employment/service agreement) | Art. 6(1)(b) |
| Pre-flight & post-flight operations | Performance of a contract; Legal obligation (aviation safety regulations) | Art. 6(1)(b), (c) |
| Payroll processing | Performance of a contract; Legal obligation (labour law) | Art. 6(1)(b), (c) |
| Compliance & credential verification | Legal obligation (aviation authority regulations, EASA, ICAO) | Art. 6(1)(c) |
| Security audit logging (including IP) | Legitimate interests (platform security, fraud prevention, regulatory accountability) | Art. 6(1)(f) |
| Device information collection | Legitimate interests (app compatibility and stability) | Art. 6(1)(f) |
| Digital signatures (biometric) | Explicit consent; Vital interests (aviation safety); Legal obligation | Art. 9(2)(a), (c), (b) |
| Visa and passport data | Legal obligation (immigration & regulatory compliance) | Art. 6(1)(c) |
Where we rely on legitimate interests as a legal basis, we have conducted a Legitimate Interests Assessment (LIA) and determined that our interests do not override the fundamental rights and freedoms of data subjects. You may request a copy of our LIA by contacting us at contact@ailabtech.com.sg.
For processing of special categories of data (biometric data — digital signatures; health data — medical certificates; professional regulatory data — licences), we rely on Article 9(2) grounds including: explicit consent, substantial public interest (aviation safety), legal claims, and preventive or occupational medicine obligations as applicable.
How We Share Your Data
We do not sell, rent, trade, or otherwise transfer your personal information to third parties for monetary or other consideration. We limit sharing to the following necessary disclosures:
6.1 Your Employer / Licensed Organisation
All personal data processed through Aeroxperess is shared with and accessible to the aviation organisation that has licensed the Platform and employs you or engages you as a contractor. Your employer has authorised access to all data generated through the Platform in connection with your employment.
6.2 Infrastructure Service Providers
We may engage third-party service providers strictly for infrastructure, hosting, and technical operations. All such providers are bound by data processing agreements (DPAs) and are prohibited from using your data for any purpose other than providing services to us. These may include cloud hosting providers, database infrastructure providers, and email delivery services (for OTP delivery).
6.3 Legal & Regulatory Disclosure
We may disclose personal information when required to do so by applicable law, court order, governmental authority, or aviation regulatory body (e.g., DGCA, CAAM, GCAA, CAAS, EASA, FAA) to the extent required for compliance with aviation safety and licensing obligations.
6.4 Business Transfers
In the event of a merger, acquisition, restructuring, or sale of assets, personal information may be transferred as part of that transaction. We will provide notice and, where required by applicable law, seek your consent before personal information is transferred and becomes subject to a different privacy policy.
6.5 With Your Consent
We may share your information with other parties with your explicit prior consent.
Data Retention
We retain personal information for as long as necessary to fulfil the purposes outlined in this Policy, comply with our legal obligations, resolve disputes, and enforce our agreements.
| Data Category | Retention Period | Basis |
|---|---|---|
| Account & Identity Data | Duration of employment + 7 years post-termination | Legal obligation (employment law, regulatory compliance) |
| Aviation Credentials | Duration of employment + 7 years | Aviation regulatory obligations (ICAO Annex 1, national CAA requirements) |
| Flight Operations Records | Minimum 3 years; up to 10 years for accident/incident records | ICAO Annex 6, national aviation authority regulations |
| Digital Signatures (Briefings) | Minimum 3 years post-operation | Aviation regulatory record-keeping obligations |
| Payroll Records | 7 years post-termination | Tax and labour law obligations (applicable by jurisdiction) |
| Audit Logs (including IP addresses) | 3 years | Legitimate interests (security, forensic investigation); legal obligation |
| Authentication Tokens | Access: 7 days active; Refresh: 30 days active; Revoked on logout | Security best practice |
| OTP Records | 5 minutes (auto-expired) | Security (minimal retention) |
| Server Access Logs | 90 days (rolling, 5 files × 5 MB) | Security monitoring |
| Device Information | Duration of active session | Technical compatibility |
| Post-Termination Backup | 7 years maximum | Legal holds, regulatory investigations |
Upon expiry of the applicable retention period, we will securely delete or anonymise personal information. Where deletion is not immediately possible (e.g., backup systems), information is isolated from further processing until it can be deleted.
Security Measures
We implement comprehensive technical and organisational security measures appropriate to the sensitivity of aviation operations data:
8.1 Technical Safeguards
- Password Hashing: All passwords are hashed using bcryptjs with 12 salt rounds. Plain-text passwords are never stored or logged.
- Two-Factor Authentication (2FA): All logins require email OTP verification in addition to password (time-limited to 5 minutes).
- Encrypted Device Storage: Authentication tokens are stored using iOS Keychain (iOS) and Android EncryptedSharedPreferences (Android) — device-level hardware encryption.
- Transport Encryption: All API communications use TLS/HTTPS. Unencrypted HTTP connections are rejected.
- HTTP Security Headers: Helmet.js middleware enforces Content Security Policy (CSP), HTTP Strict Transport Security (HSTS), X-Frame-Options, and other OWASP-recommended headers.
- SQL Injection Prevention: All database queries use Sequelize ORM parameterised queries — raw SQL string concatenation is not used.
- Rate Limiting: Login attempts limited to 50 per 5-minute window; OTP requests limited to 3 per minute.
- Account Lockout: Accounts are automatically locked for 2 hours after 5 consecutive failed login attempts.
- HTTP Parameter Pollution Protection: hpp middleware prevents parameter pollution attacks.
- Immutable Audit Trail: Security-critical events are recorded in an append-only audit log table.
- Signature Data Integrity: Biometric signatures are stored as binary data (BYTEA) with server-side base64 encoding/decoding — not as plain-text strings.
8.2 Organisational Safeguards
- Role-based access controls limit data visibility to the minimum necessary for each user role (principle of least privilege).
- CEO and administrative roles see complete organisational data; pilot accounts are filtered to only their assigned operations.
- All access to sensitive financial and biometric data requires authenticated sessions.
- Data processing agreements (DPAs) are in place with all infrastructure providers.
8.3 Breach Notification
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by Article 33 of the GDPR. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay, as required by Article 34 of the GDPR.
Biometric Data — Digital Signatures
9.1 What We Collect
The Aeroxperess App captures handwritten digital signatures using an on-screen drawing interface. Two types of signatures are collected:
- Maintenance Authorisation Signature: Captured by the Maintenance Officer to authorise the pre-flight briefing checklist. Stored in the
briefing_signaturefield. - Pilot Authorisation Signature: Captured by the Pilot in Command to authorise their pilot briefing checks. Stored in the
pilot_signaturefield.
9.2 How Signatures Are Stored
Signatures are captured as PNG image files on the device and transmitted over HTTPS to our server, where they are stored as binary data (PostgreSQL BYTEA format). The signer's name, designation, and UTC timestamp are recorded alongside each signature. Signatures are not processed for biometric identification or authentication — they serve solely as a legal record of authorisation in the aviation operations workflow.
9.3 Legal Basis
Collection of signatures is:
- Required by aviation regulatory frameworks (ICAO, national civil aviation authority regulations) as part of the mandatory pre-flight and post-flight documentation chain;
- A contractual obligation under your employment or service agreement with your aviation organisation;
- Subject to your explicit in-app consent at the point of signature capture.
9.4 Retention & Deletion
Signature data is retained for a minimum of 3 years post-operation in compliance with aviation regulatory record-keeping obligations. After the applicable retention period, signature data is securely deleted. You may not request deletion of signatures that are subject to ongoing aviation regulatory record-keeping obligations.
9.5 Illinois BIPA / State Biometric Law Compliance
If you are a resident of Illinois, Texas, Washington, or another jurisdiction with specific biometric privacy statutes, please contact us at contact@ailabtech.com.sg for our jurisdiction-specific Biometric Data Collection Notice and to exercise any additional rights available to you under applicable state law.
Financial Data Handling
Financial and payroll data processed through Aeroxperess is done exclusively under the direction of your employer organisation acting as the data controller / data principal for employment purposes. AI Lab Technologies processes this data as a data processor on behalf of your employer.
Access Controls
Payroll and salary data is accessible only to:
- The individual employee (their own payslips only);
- Authorised HR and finance personnel designated by your employer with elevated access roles.
Bank Account Data
Bank account numbers are stored in encrypted form and used solely for salary disbursement coordination. We do not process payment transactions directly — disbursement is managed by your employer's payroll processes.
Multi-Currency Operations
The Platform supports payroll processing in UAE Dirham (AED), Singapore Dollar (SGD), and Indian Rupee (INR). All financial records are denominated and stored in the applicable payroll currency as configured by your employer.
Your Rights — GDPR (EEA / UK)
If you are located in the European Economic Area or United Kingdom, you have the following rights under the General Data Protection Regulation (EU) 2016/679 and UK GDPR:
Right of Access
Request a copy of the personal data we hold about you (Art. 15 GDPR).
Right to Rectification
Request correction of inaccurate or incomplete personal data (Art. 16 GDPR).
Right to Erasure
Request deletion of your data where retention is no longer necessary, subject to legal retention obligations (Art. 17 GDPR).
Right to Restriction
Request we restrict processing of your data in certain circumstances (Art. 18 GDPR).
Right to Portability
Receive your personal data in a structured, machine-readable format (Art. 20 GDPR).
Right to Object
Object to processing based on legitimate interests or for direct marketing (Art. 21 GDPR).
Right to Withdraw Consent
Where processing is consent-based, withdraw consent at any time without affecting prior lawful processing.
Right to Lodge a Complaint
Lodge a complaint with your local supervisory authority (Art. 77 GDPR).
How to Exercise GDPR Rights
Submit your request in writing to contact@ailabtech.com.sg with the subject line "GDPR Data Subject Request". We will respond within 30 days; this may be extended by a further 2 months for complex requests. Identity verification will be required before processing requests.
Supervisory Authorities
EEA residents may contact their national data protection authority. UK residents may contact the Information Commissioner's Office (ICO) at ico.org.uk. Irish residents may contact the Data Protection Commission (DPC) at dataprotection.ie.
Data Protection Officer (DPO)
We have designated a Data Protection Officer. DPO enquiries may be directed to: contact@ailabtech.com.sg — Subject: "Attention: Data Protection Officer".
Your Rights — CCPA / CPRA (California)
This section applies to residents of the State of California and is provided pursuant to the California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act of 2020 (CPRA), effective 1 January 2023. These rights are in addition to any other rights you may have.
12.1 Categories of Personal Information Collected
Under the CCPA/CPRA, over the past 12 months, we have collected the following categories of personal information:
| CCPA Category | Examples (as collected by Aeroxperess) | Collected |
|---|---|---|
| A. Identifiers | Real name, email address, employee ID, IP address, device identifier | Yes |
| B. Personal information (Cal. Civ. Code §1798.80) | Name, telephone number, passport number, bank account number, employment details | Yes |
| C. Protected classification characteristics | Nationality (for visa/compliance), country of residence | Yes |
| D. Commercial information | Salary, allowances, payslip data | Yes |
| E. Biometric information | Handwritten digital signatures (PNG images) | Yes |
| F. Internet / network activity | IP addresses, HTTP access logs | Yes |
| G. Geolocation data | Airport ICAO/IATA codes (route data, not GPS location) | Limited |
| H. Professional / employment information | Job title, department, pilot licence, flight hours, training records | Yes |
| I. Sensitive Personal Information (CPRA) | Government ID numbers (licence, passport, ARN), financial account information, biometric data — see 12.2 below | Yes |
| J. Inferences | Compliance status inferred from licence/medical expiry dates; flight hour utilisation percentages | Yes |
12.2 Sensitive Personal Information (CPRA — Civil Code §1798.121)
Under the CPRA, the following categories of information we collect are classified as Sensitive Personal Information (SPI):
- Government-issued identifiers: pilot licence number, ARN, passport number
- Financial information: bank account numbers, salary, deductions
- Biometric data: handwritten digital signatures
- Health-related data: medical certificate status and expiry
We do not use or disclose Sensitive Personal Information for any purpose other than those permitted under CPRA Section 1798.121(a), namely: providing the services reasonably expected by the consumer; ensuring security; short-term transient use; performing services on our behalf; undertaking internal research; and verifying quality of our services.
You have the right to limit the use and disclosure of your Sensitive Personal Information to these permitted purposes. To exercise this right, contact us at contact@ailabtech.com.sg.
12.3 Sources of Personal Information
We collect personal information:
- Directly from you: Account credentials, signature capture, profile updates, post-flight data entry.
- From your employer: HR records, crew assignments, payroll data imported from the ERP system.
- Automatically: IP addresses, HTTP access logs, device information, authentication timestamps.
12.4 Business or Commercial Purposes for Collection
Personal information is collected for the business purposes described in Section 4 of this Policy. We do not use personal information for cross-context behavioural advertising.
12.5 Categories of Third Parties Receiving Personal Information
As described in Section 6, we may disclose personal information to: your employer organisation, infrastructure service providers (under DPA), and regulatory authorities (when legally required).
12.6 Your CCPA/CPRA Rights
Right to Know
Right to know what personal information is collected, used, shared, or sold about you (§1798.100).
Right to Delete
Right to request deletion of personal information, subject to exceptions (§1798.105).
Right to Correct
Right to correct inaccurate personal information we maintain about you (CPRA — §1798.106).
Right to Opt-Out of Sale/Sharing
Right to opt out of the sale or sharing of personal information. We do not sell or share personal information.
Right to Limit SPI Use
Right to limit use and disclosure of Sensitive Personal Information (CPRA — §1798.121).
Right to Non-Discrimination
We will not discriminate against you for exercising your CCPA/CPRA rights (§1798.125).
12.7 Do Not Sell or Share My Personal Information
12.8 How to Submit a CCPA/CPRA Request
Submit verifiable consumer requests to:
- Email: contact@ailabtech.com.sg — Subject: "California Privacy Rights Request"
We will acknowledge receipt within 10 business days and respond within 45 calendar days. If we require additional time (up to 90 days), we will notify you. You may submit up to two requests in any 12-month period. We will verify your identity before processing requests.
12.9 Authorised Agent
You may designate an authorised agent to make CCPA/CPRA requests on your behalf. The agent must provide signed written authorisation and you must verify your identity directly with us. We may deny requests from agents who do not submit proof of authorisation.
12.10 12-Month Lookback
Your Right to Know extends to personal information collected in the 12-month period preceding your request.
12.11 Financial Incentive Programmes
We do not offer financial incentives, price differences, or service differences in exchange for personal information.
Your Rights — CalOPPA (California)
Pursuant to the California Online Privacy Protection Act (Cal. Bus. & Prof. Code §§22575–22579), we provide the following specific disclosures for California residents:
13.1 Conspicuous Posting
This Privacy Policy is conspicuously posted and accessible from the Aeroxperess App and any associated web properties. It is available directly within the App and on our company website prior to account creation.
13.2 Effective Date
This Privacy Policy has an Effective Date of 18 March 2026, which is clearly displayed at the top of this page.
13.3 How to Review and Request Changes to Your Information
California residents may review and request changes to personal information held about them by:
- Logging into the Aeroxperess App and accessing Profile settings to update name, email address, and phone number directly.
- Submitting a written request to contact@ailabtech.com.sg specifying the information you wish to review or have corrected.
- Contacting your employer's HR or administrative designee who manages your Aeroxperess account.
13.4 How We Respond to "Do Not Track" Signals
See Section 17 for our complete Do Not Track disclosure.
13.5 Third-Party Tracking
We do not permit third parties to collect personally identifiable information about users' online activities over time and across different websites or apps through our Platform. We do not use, or permit the use of, tracking pixels, web beacons, or third-party analytics trackers within the Aeroxperess App.
Your Rights — India DPDP Act 2023
Pursuant to the Digital Personal Data Protection Act, 2023 (DPDP Act) of India, AI Lab Technologies, being a Data Fiduciary incorporated and operating in India, provides the following disclosures and rights to Data Principals (individuals whose personal data is processed):
14.1 Basis for Processing
We process personal data on the following bases under the DPDP Act:
- Consent: Where you have voluntarily provided consent for specific processing activities (e.g., signature capture).
- Legitimate Uses: Processing for employment purposes, legal compliance, public interest safety obligations, and other legitimate uses as defined under Section 7 of the DPDP Act.
14.2 Notice to Data Principals
As required under Section 5 of the DPDP Act, we provide this notice in English. The personal data we collect, the purposes for which it is processed, and the manner in which you may exercise your rights are set out in this Policy.
14.3 Rights of Data Principals
Right to Information
Right to obtain information about personal data being processed and the identities of Data Fiduciaries and Processors (§11).
Right to Correction & Erasure
Right to correct inaccurate personal data and erase personal data where consent is withdrawn or retention is no longer necessary (§12).
Right to Grievance Redressal
Right to obtain readily available means of grievance redressal from the Data Fiduciary (§13).
Right to Nominate
Right to nominate another individual to exercise rights in the event of death or incapacity (§14).
14.4 Grievance Officer
In accordance with Section 13 of the DPDP Act, our Grievance Officer can be reached at:
AI Lab Technologies
15 Gowtham Nagar, Tamil Nadu, India 613001
Email: contact@ailabtech.com.sg
Subject: "DPDP Grievance – [Your Name]"
We will acknowledge grievances within 48 hours and endeavour to resolve them within 30 days.
14.5 Data Breach Notification
In the event of a personal data breach, we will notify the Data Protection Board of India and affected Data Principals in accordance with the requirements of the DPDP Act and associated rules.
Your Rights — Singapore PDPA
Given our Singapore operations (contact@ailabtech.com.sg domain and SGD payroll processing), we comply with Singapore's Personal Data Protection Act 2012 (PDPA), as amended by the Personal Data Protection (Amendment) Act 2020.
15.1 Purpose Limitation
We collect, use, and disclose personal data for the purposes for which consent was given or that fall within legitimate purposes under the PDPA. We will not use personal data collected for a different purpose without obtaining fresh consent.
15.2 Rights Under PDPA
- Right of Access: Request information about personal data held about you and how it has been used or disclosed in the 12 months preceding the request.
- Right of Correction: Request correction of personal data that is inaccurate or incomplete.
- Right to Withdraw Consent: Withdraw consent for collection, use, or disclosure of personal data (subject to legal/contractual consequences).
- Right to Data Portability: (Where applicable under PDPA amendments) receive personal data in a commonly used machine-readable format.
15.3 Data Protection Officer (DPO)
Our DPO for Singapore PDPA purposes may be contacted at: contact@ailabtech.com.sg — Subject: "Singapore PDPA Request".
15.4 Mandatory Data Breach Notification
In accordance with the PDPA mandatory data breach notification obligation, we will notify the Personal Data Protection Commission (PDPC) and affected individuals if a data breach is likely to result in significant harm to affected individuals or is of a significant scale.
International Data Transfers
AI Lab Technologies is headquartered in India and operates services that may involve processing personal data across multiple jurisdictions. Your personal data may be stored and processed in India and potentially in other countries where our infrastructure providers operate.
16.1 Transfers from the EEA/UK
Where personal data is transferred from the European Economic Area or United Kingdom to countries that do not benefit from an adequacy decision (including India, which does not currently hold EU adequacy status), we ensure appropriate safeguards are in place, including:
- Standard Contractual Clauses (SCCs): We use the European Commission's approved Standard Contractual Clauses (2021/914) for transfers to third countries.
- UK International Data Transfer Agreements (IDTA): For transfers from the UK, we use the ICO's approved IDTA or addendum to SCCs.
- Transfer Impact Assessments (TIAs): We conduct TIAs where required to assess the risk level of data transfer.
You may request a copy of the relevant transfer mechanism documentation by contacting contact@ailabtech.com.sg.
16.2 Transfers from Singapore
For transfers of personal data from Singapore to recipients in third countries, we comply with the PDPA's transfer limitation obligation and ensure comparable protection standards are contractually in place with data intermediaries and sub-processors.
16.3 Cross-Border Transfers within Aviation Operations
Flight crew data (names, roles, routes) may be accessible to operator organisations in different countries as part of international aviation operations. This is inherent to the aviation context and constitutes a legitimate use necessary for the performance of the aviation service contract.
Do Not Track (CalOPPA)
Some browsers and mobile operating systems include a "Do Not Track" (DNT) feature or setting to signal your privacy preference not to have data about your online browsing activities monitored and collected.
The Aeroxperess App is a dedicated professional mobile application, not a web browser. However, we provide the following disclosures in accordance with California Online Privacy Protection Act (CalOPPA) requirements:
- The Aeroxperess App does not currently respond to browser DNT signals, as it is a native mobile application operating outside a browser context.
- The App does not track users across third-party websites or online services over time.
- The App does not engage in cross-context behavioural advertising or third-party tracking.
- Server-side HTTP access logs are collected for security and operational purposes only and are not used for cross-site tracking. These logs are retained for a maximum of 90 days.
- IP address logging is limited to the briefing audit trail for regulatory compliance and aviation safety purposes.
If industry-wide DNT standards for mobile applications are adopted and we update our practices, we will revise this disclosure accordingly.
Children's Privacy
The Aeroxperess App is designed exclusively for licensed aviation professionals and is not directed at or intended for use by persons under the age of 18 years.
We do not knowingly collect, solicit, or process personal information from any person under 18 years of age. If you believe that we have inadvertently collected personal information from a minor without appropriate parental consent, please contact us immediately at contact@ailabtech.com.sg and we will promptly delete such information.
All aviation personnel using Aeroxperess must, by the nature of their professional qualifications (minimum age requirements for commercial pilot licences vary by jurisdiction but are typically 18–21 years), be legal adults at the time of account creation.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or Platform functionality. We are committed to transparency about such changes.
How We Notify You of Changes
- Material Changes: For changes that are material to your rights or our data practices, we will provide at least 30 days' advance notice through a prominent in-app notification and/or email to your registered address.
- Minor Changes: For non-material updates (e.g., typo corrections, clarifications), we will update the "Last Updated" date at the top of this Policy without separate notification.
- GDPR Users: Where material changes affect legal bases or processing purposes for EEA/UK users, we will seek fresh consent where required.
- CCPA/CPRA Users: We will provide at least 30 days' advance notice of material changes to our CCPA/CPRA disclosures.
How to Review Changes
The current version of this Policy is always available within the Aeroxperess App under Settings → Privacy Policy, and at our company website. The "Effective Date" and "Last Updated" dates at the top of this document indicate when the Policy was last revised.
Your continued use of the App following the effective date of a revised Policy constitutes your acceptance of the updated terms.
Policy Version Archive
Prior versions of this Privacy Policy are available upon request by emailing contact@ailabtech.com.sg with the subject "Privacy Policy Version Request".
Contact & Data Protection Officer
For any questions, concerns, or requests relating to this Privacy Policy or our data practices, please contact us through the following channels:
AI Lab Technologies — Privacy Contact
AI Lab Technologies
15 Gowtham Nagar, Tamil Nadu, India 613001
contact@ailabtech.com.sg
contact@ailabtech.com.sg
Subject line: "Attention: Data Protection Officer"
Response Timelines
| Request Type | Acknowledgement | Full Response |
|---|---|---|
| GDPR Data Subject Request | Within 5 business days | Within 30 days (extendable to 90 days for complex requests) |
| CCPA/CPRA Consumer Request | Within 10 business days | Within 45 calendar days (extendable to 90 days) |
| India DPDP Grievance | Within 48 hours | Within 30 days |
| Singapore PDPA Request | Within 5 business days | Within 30 days (extendable to 60 days) |
| General Privacy Enquiry | Within 2 business days | Within 14 calendar days |