Privacy Policy

RotorLab.app: Privacy Policy

Effective date: November 1, 2026

This Privacy Policy explains how RotorLab, Inc., a Delaware corporation with its headquarters in Dubuque, Iowa ("RotorLab", "we", "us") collects, uses, and shares information when you use our websites, applications, and services (the "Service"). It is written for what the Service has become: a design tool, and a system of record for drone operators. If you use the Service as a member of an organization, that organization is the controller of the records it keeps in the Service and of your membership in it, and its administrators manage that membership. Your sign-in is yours: with one sign-in you may belong to several organizations, and each is the controller of what it keeps about you. This Policy describes what we do as each organization's processor as well as what we do with the information we hold as controller (your sign-in, the list of organizations you belong to, and our own logs).

1. Two roles. For your sign-in (your email address, password, second factors and passkeys, and the sessions and throttle that protect it), the list of organizations you belong to and the invitations sent to your address, the credentials you keep on your own sign-in, an organization's account and billing details, our security logs, the messages sent through our contact and quote forms, the support requests sent to us, and our own analytics, we are the controller; our security log is our own record, kept apart from an organization's activity log. For the Records an organization keeps in the Service (aircraft, flights and flight logs, maintenance, pilots and their credentials and training, occurrences, authorizations, insurance, safety records, attached documents, and the organization's activity log), the organization is the controller and we are its processor under the Data Processing Addendum, which is available on request and incorporated by reference for every organization account. Where you belong to more than one organization, each is the controller of the Records it keeps, including the flights you flew for it and your membership in it. We never show one organization's Records to another, and we never tell an organization which other organizations you belong to. The summary of your own flights, hours and currency on your account page is drawn from each organization's Records on that organization's instruction, shown only to you, and kept nowhere else. A copy you share with an organization is that organization's record.

2. Information we collect. a. Account information: name, email, the organizations you belong to and your role in each, the invitations sent to your address and your answer to each, the credentials you keep on your sign-in and which organizations you share each with, authentication credentials (passwords stored only as salted hashes; an authenticator's secret sealed at rest where the Service runs with its encryption key, as Section 7 says), and the sessions you open (the device as read from your browser, the address it came from, and when). b. Billing information you enter for invoicing (contact, address, tax identifier, and any tax exemption certificate) and what our payment processor returns (a confirmation, the card brand and last digits; never a full card number). c. Records an organization files: what its members enter, what its ground stations send, and what is read from the flight logs it uploads (which can include the aircraft's position, altitude, speed, battery and sensor readings, the airframe's serial, and the pilot on the flight). Records can name people who are not members, such as a requesting agency's contact, a supervising officer, or an applicator and their certification number on a service record. d. Log and device data: IP address, browser type, timestamps and pages requested; usage and diagnostic data about how the Service is used, including a daily count, for each organization, of how many times each of its tools was opened, which names no person and holds no content; and cookies used for authentication, security and preferences. Our own page counts use no cookie, and the key that counts a visitor once a day is replaced every day; an organization can switch usage analytics, and with them that daily count, off for its members. Google Analytics is loaded only where we set it up and only after you accept analytics cookies (Section 4A). The Service also keeps information in your browser's own storage on your device: drafts not yet saved or filed (a mission, or a flight, defect or checklist run recorded while offline, which can include positions) and uploads that failed, until they are saved, filed or discarded; the choices you made on a form last, to fill in the next one; and, for use without a connection, your organization's aircraft list, their status and its checklist cards, until you sign out or switch to another organization. A draft is kept with the organization it was started in and can be filed only there. e. Position data. An organization chooses what a flight keeps of where it flew: its exact position (the default); only a rounded area, in which case an exact position from a log, the flight form, a ground station or the API is reduced to the area before it is stored, while stored flight log files are kept as before; or no position, in which case no position is written to the flight and a flight log file is read for its hours, faults and health and then not kept. The choice applies from when it is made; positions already on the record follow the position window below. Where the Service runs with its encryption key, a flight's precise position is sealed with authenticated encryption before it reaches the database, and its take-off and landing points, the position in its stored analysis, a corrected position in its history and its copy in the void ledger are sealed the same way; so are stored flight log files, live recordings, saved missions, area outlines and frozen area dossiers, as they are written. A flight log waiting in File Flights to be filed is sealed the same way while it waits, and items stored before the Service held its key stay unsealed unless they are written again or a pass we run seals them. Where the Service runs without its key, all of these are stored unsealed and protected by the other measures in Section 7. Either way, positions on a flight are reduced to a rounded area once the position window the organization sets has passed, unless the flight is on legal hold. A stored flight log file keeps the full track the aircraft recorded until the stored-log window the organization sets deletes it. The exact point never appears on a public page.

3. How we use information. As controller: to operate, secure, and improve the Service; to sign you in and keep your account safe (including the sign-in throttle and session policy); to bill and to answer you; to send the notices the Service and the law require; and, with your consent, the newsletter. When you use the free log analyzer without an account, your first reading needs nothing from you; after that we ask for an email address, which we keep with that browser's access for up to a year so the analyzer stays open there. If you ask us to email you a reading, we send it to the address you give and note that address. Joining the newsletter is a separate choice. As processor: only to provide the Service to the organization, on its instructions, as the Addendum describes. Model annotations in the Service score an organization's own records for its own use; no record is used to train a model that serves another organization unless that organization opts in to training inclusion, which is off by default and can be withdrawn.

4. How we share information. We do not sell personal information and we do not share Records with anyone but the organization that keeps them and, for a person's own flights, hours and currency, that person on their own account page, except: with the subprocessors listed in the Addendum (hosting, offsite backup, payment processing, email delivery, and, where the organization enables it, the flight-record decryption service of the aircraft's manufacturer), each bound to protect it; with a third party the organization itself directs us to (a webhook endpoint, a linked manufacturer, an auditor it hands a package to, a public transparency page it publishes); with the outside services in Section 4A, only what that section says each receives; with a RotorLab partner, only what Section 4B says a partner sees; when the law requires it, in which case we tell the organization unless the law forbids it; and in a merger or sale, where the successor takes on this Policy. A support request is read by RotorLab's support and by the person who sent it; one sent while working in an organization is also shown to that organization's administrators unless the sender chooses not to share it, and a security or accessibility report is never shown to them. A manufacturer an organization linked keeps, after the link ends, the organization's name, the day the link ended and the standing the link last reported, and nothing read after it. We do not tell an organization whether an address it invites already has a sign-in, or which other organizations a person belongs to.

4A. Outside services. These are every outside party the Service can call, and what each receives: a. Independent timestamps: RFC 3161 timestamping authorities and OpenTimestamps calendars receive one hash a day over the day's records, never a record. b. Map imagery and terrain: Esri, USGS The National Map, OpenStreetMap and the AWS elevation tiles are fetched by your browser when a map is drawn; each request says which square of the map is wanted. A copy of the Service can instead draw its maps from a tile server its operator runs. c. DJI log reading: reading a current, encrypted DJI flight record sends its key identifiers to DJI's keychain service (DJI is a company based in China), only for an organization whose administrator switches it on, and never for a signed-out visitor. d. Airspace, airport and advisory data: the FAA, the airspace publishers we read and uasvs.org are asked for their published files; the request carries nothing about an organization. e. Weather: MET Norway, aviationweather.gov and api.weather.gov receive the coordinates of a planned point or of a flight's place. f. Place and elevation lookups: OpenStreetMap Nominatim receives an address typed to place a map, and the USGS elevation service receives a point's coordinates. g. Google Analytics: only where we set it up, and only after you accept analytics cookies; it receives the page visited and the browser's usual request details. h. Address autocomplete: Google Maps Places receives an address as it is typed into a billing or sign-up form, where we have it switched on. i. Email: the mail relay the Service is set to use carries the messages it sends: invitations, password resets, notices and replies to support requests. j. Card payments: Stripe receives what checkout needs, the plan and the organization's billing details; card numbers go to Stripe and never to us. k. Single sign-on: the identity provider an organization sets takes part in the sign-in exchange OpenID Connect defines. l. Webhooks, traffic sources and alert hooks: the addresses an organization or we enter receive the events and requests each one is set up for, and nothing else. m. Sales and account contacts: RotorLab uses GoHighLevel (HighLevel, Inc.), a customer-relationship service, to keep its own sales and account contacts. It also keeps the addresses of people who subscribe to our newsletter, after they confirm by email, and sends each issue; a subscriber's address is used for nothing else. It is told when someone starts a trial, asks for a quote, writes to sales or asks to talk after a plan has ended; when a plan changes; when a trial is near its end or has ended; when an organization on a trial reaches a size we set; and when an administrator answers our question about talking to our team before adding more. Each time, it receives the name, email address and phone number of the person who asked or answered or, for an organization, of its first administrator (or, failing one, its billing contact), with the organization's billing phone; the organization's name, RotorLab account number, jurisdiction and profile answers; the plan and the trial's end date; the number of aircraft and members; for a size question, the size, the number reached and where in the Service it was asked; what was entered in a quote or sales form; and what happened, when, and the page it came from. It receives no Record, no flight, position or file, and no sign-in credential, and nothing is sent through it by text message. We use it only to answer the request and to manage the customer relationship, and we do not sell the information. A copy of the Service run in offline mode sends nothing to it. The quote, contact, sales and newsletter forms on our website, which GoHighLevel shows (Section 4B), use Google reCAPTCHA to keep out automated spam. When a page with one of those forms opens, your browser loads reCAPTCHA from Google, and reCAPTCHA collects hardware and software information, such as device and browser data, and sends it to Google to provide, maintain and improve reCAPTCHA and for general security purposes, under Google's Privacy Policy and Terms of Service. No page of the application at app.rotorlab.app loads reCAPTCHA. n. Regulatory sources: the Federal Register, eCFR, and the regulators and legislatures whose published rules the Regulation Tracker follows, with any source we add, are asked for their published pages and feeds so that a change to a rule is noticed; the request names RotorLab and carries nothing about an organization or a person. An organization can switch off, for its own members, map imagery and terrain from outside services, weather, place and elevation lookups, and address autocomplete, and can switch off usage analytics. A copy of the Service run in offline mode calls none of these, except single sign-on, email and webhooks to hosts inside its own network that its operator lists.

4B. Our website and shop. Our website at rotorlab.app is a separate site from the RotorLab application at app.rotorlab.app. It is hosted for us by 20i, in Dallas, Texas, holds no Records, and shares no session or cookie with the application. Its analytics are Google Analytics, loaded only after you accept analytics cookies, with cookies set for rotorlab.app alone. Its quote, contact, sales and newsletter forms send what you enter straight to GoHighLevel, as Section 4A(m) describes, with the page the form was on and, if you arrived through a RotorLab partner's link, that partner's code. Those forms use Google reCAPTCHA, as Section 4A(m) says. Its shop takes orders through WooCommerce on that site: card numbers go to Stripe and never to us, and the shop keeps each order, with your name, email address and billing details, as our financial record for our accounting period. You can sign in to the shop with your RotorLab sign-in; the application then tells the shop an identifier for your sign-in, your email address and the part of it before the @, whether the address is confirmed, and your name, and nothing about your organizations or Records. When you buy a Fleet Server or Bridge license there, the shop sends the paid order to the application, which issues the license key and emails it to you; when you next sign in to the application, the license is attached to the organization you are working in, where its administrators can see it. When you follow a RotorLab partner's link to the application, the application counts the click and keeps a random reference to it in a cookie on app.rotorlab.app for up to thirty days, so that a sign-up from that browser is credited to the partner; a partner's link to our website carries the partner's code in the address, and the website keeps the code in your browser's storage for the same period so that a form you send is credited. A partner sees only its own referrals: counts of clicks, sign-ups and quotes credited, their dates, and the commission on what each referred organization paid, never an organization's name or Records. Our course site at learning.rotorlab.app and our documentation at docs.rotorlab.app are separate sites too, also hosted for us by 20i, in Dallas, Texas; they hold no Records and share no session or cookie with the application. On the course site you can open an account, which keeps your name, email address and password (stored only as a hash), the courses you enroll in, your progress and quiz results, and any certificate it issues. We keep a course account until you ask us to delete it, and delete it within thirty days after you ask, except any order record, which is kept as Section 6 says. 20i backs up the website, the shop, the course site and the documentation on its own schedule, apart from the application's backups; those backups hold no Records, and information deleted from those sites leaves them as their copies expire.

5. What a public page shows. An organization that publishes a transparency page chooses what it shows; only rounded areas, counts and periods it approved appear, never an exact position, a name, or an unpublished record, and each published period is frozen and hashed.

6. Retention. Your sign-in is kept while you belong to at least one organization; once you belong to none, it is kept for ninety days, so an invitation can bring you back, and then deleted, and we email you before that happens. A credential you keep on your sign-in is kept while your sign-in is, and deleted with it. A copy you shared with an organization is that organization's record and follows its retention; stopping sharing ends updates, not the copy. Your membership in an organization, and the account information that organization holds, is kept while its plan is active and, when its plan ends, for the periods in Section 15 of the Terms: ninety days read-only with export, then twelve months retained with no access, then deletion with everything the organization kept, counted and recorded, after an alert thirty days and a final notice seven days before. That deletion ends your membership in that organization only. Buying or restoring a plan before the deletion restores full access. Within the Service, an organization sets its own retention for stored flight logs and precise positions, including "keep for life", and a legal hold keeps a record past every window; a filed record is voided rather than destroyed, and a person on a record is deactivated rather than deleted, because the records of flying and of maintenance are records of record for as long as the organization keeps them. An organization can also set a window after which a person who has left is minimized (their name and handle stay on the records they are on; their email, phone, medical date and the notes on their pilot profile are removed from that organization, and so is the link to their sign-in, which stays theirs for any other organization they belong to; a medical certificate kept as a credential is blanked), and a window after which a photo or document removed from a record, kept hidden until then, is deleted; neither has a default. The organization's activity log is its own record, kept for as long as the organization keeps its records. Our own security logs are kept for twelve months, the page views we count for thirteen months, the daily tool counts for four hundred days, and the messages sent through our contact and quote forms for twenty-four months, and support requests with their replies for twenty-four months after each was last written to or changed in status. An address given to the free log analyzer is kept with that browser's access for up to a year, and the count of messages sent to an address, which limits how often we write to it, for one day. When an organization is deleted, we keep its billing records (the amounts, tax, dates, and invoice and payment references of what it paid, and our decisions on its billing requests) as our own financial record for our accounting period, seven years unless our accountant sets another, with their notes, subscription references and the reasons given removed. For a RotorLab partner, we keep the record of its signed partner agreement (who signed it for the partner, with their title and email address, who signed for us, the dates and the terms), its referral codes, its commission records and the tax form it gives us for seven years after the partnership ends, as our contract and financial record, and then delete them. A partner's sign-in, which belongs to no organization, is kept while the partnership lasts, is closed when it ends, and is deleted ninety days after that. The application's backups are kept in a second location and expire on the schedule stated on the trust page; information deleted from the application is gone from every one of its backup copies within ninety days of its deletion. Our website, shop, course site and documentation are backed up as Section 4B says.

7. Security. Sessions are server-side and hashed; passwords are salted hashes; where the Service runs with its encryption key, authenticator secrets, precise positions, the service credentials an organization stores (payment provider keys, single sign-on client secrets, mail passwords and webhook signing secrets), and the flight log files, live recordings, saved missions and area outlines Section 2(e) names are sealed at rest with authenticated encryption as they are written; traffic is encrypted with TLS from the browser to our edge provider and again from the edge provider to our server; the activity log is a hash chain; roles gate every read and write; pilot licenses and certificates, whether an organization keeps them or a person keeps them on their sign-in, are not sealed this way and are protected by the other measures here; and the trust page states the rest, including what we do not claim.

8. Your choices and rights. You may see and correct your account information in the Service, end your own sessions, turn two-factor on, see which organizations you belong to, and download your own data from My Account: what the organization you are working in holds about you, with your sign-in details and the credentials you keep there, scoped to you and never to a colleague's records; each organization you belong to has its own download. An organization's administrators can export everything the organization holds about a person, and minimize a person who has left, as Section 6 describes. Depending on where you live, you may have rights to access, correct, delete, port, or restrict information about you, and to object to certain processing. For information an organization holds about you, that organization is the controller and will answer the request, with our help. Where you belong to several, each answers for its own: a request you send us is passed to each organization it concerns separately, without telling one about another, and we tell you which we passed it to. A request about your sign-in we answer ourselves; closing your sign-in ends your access to every organization, and each keeps the records that name you as this section describes; a request to delete a record of flying or maintenance is answered by deactivation and voiding as Section 6 describes, because the record itself must stay. Contact us through the support channel in the Service; we answer within thirty days.

9. International users. We store information in the United States and process it there; traffic between you and the Service may first be decrypted and routed at a Microsoft edge location near you. If you use the Service from elsewhere, you agree to that transfer, and the Addendum carries the standard contractual clauses where they apply. Where an organization switches DJI log reading on, the key identifiers of its encrypted DJI flight records go to DJI's keychain service, as Section 4A(c) says.

10. Children. The Service is not directed to children under 16 and we do not knowingly collect their personal information.

11. Changes. We may update this Policy. If a change is material we give notice in the Service or by email at least thirty days before it takes effect, and ask you to accept it in the Service.

12. Contact. For privacy questions or requests, contact us through the support channel shown in the Service, or write to security@rotorlab.app for a security concern. RotorLab, Inc. is the controller named in Section 1; its address for written requests is RotorLab, Inc., 7709 Commerce Park, Suite 1, Dubuque, Iowa 52002, and its email for legal notices is legal@rotorlab.app.

These documents have changed since you last accepted them. Read the ones that matter to you from the list, then confirm to continue to RotorLab.