Privacy Policy

This Privacy Policy applies to all products and services offered by Barshe Tech Solutions Corporation, a corporation incorporated in the State of Delaware, USA on September 15, 2025. This includes our flagship platform AeroDeck, our healthcare AI tools, and any other enterprise AI solutions we operate (collectively, the "Services").

This policy applies to:

• Registered users — individuals who create an account on any Barshe Tech platform.
• Organization administrators — users who manage accounts on behalf of a company, flight department, or other entity.
• End data subjects — individuals whose information is entered into the platform by users (such as flight crew members, passengers, and maintenance personnel), even if those individuals are not registered users themselves.
• Website visitors — people who visit barshe-tech.com without creating an account.

If you are using AeroDeck or other Barshe Tech Services on behalf of an organization, your organization's agreement with us (including any Data Processing Addendum) also governs how we handle data. Where there is a conflict, the organizational agreement controls with respect to organizational data.

By using our Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this policy, do not use our Services.

We collect several categories of data depending on which features you use. We collect only what is necessary to provide and improve our Services.

Account & Identity Data

• Name, email address, and password (stored as a secure hash).
• Organization name, role, and account preferences.
• Two-factor authentication credentials (device tokens, authenticator app seeds — never stored in recoverable form).
• Billing contact information.

Aviation Operational Data

AeroDeck is purpose-built for aviation operations. As such, we handle aviation-specific data that is inherently sensitive:

• Flight data: routes, origin and destination airports, departure and arrival times, flight logs, and trip records.
• Aircraft data: registration (N-numbers and equivalents), make, model, serial numbers, aircraft specifications, weight-and-balance profiles, and maintenance records including squawks, write-ups, and MEL references.
• Crew data: pilot and crew names, certificates (pilot certificates, type ratings, medical certificates), duty time and rest period records, FRAT (Flight Risk Assessment Tool) submissions, and training records.
• Crew duty & medical tracking: certificate expiration dates, medical class and expiration, duty hour logs, and rest period compliance data.
• Dispatch & planning data: trip dispatch records, handler contacts, hotel information, catering orders, ground transportation data, and NOTAMs reviewed in connection with specific flights.
• Safety reports: NASA ASRS and EASA safety report content if filed through the platform.

Passenger Data

• Passenger names, dates of birth, nationality, and gender (for manifests and international filings).
• Passport numbers, passport expiration dates, and country of issuance.
• Visa and travel document information where required for international operations.
• eAPIS / APIS submission data (as required by U.S. Customs and Border Protection and equivalent authorities).
• General Declarations (GenDec) and passenger manifest data for international operations.

Financial & Expense Data

• Expense records and receipt images uploaded to the platform.
• Vendor names, transaction amounts, currencies, and dates extracted from receipts (via our AI Expense Extraction feature).
• Trip cost data, fuel purchase records, and operator billing summaries.
• Payment instrument data (credit/debit card details, ACH information) — this is processed directly by our payment processor and is not stored on Barshe Tech servers.
• Subscription and invoicing records.

Quote & Charter Data

• Trip parameters provided by operators for generating quotes (origin, destination, dates, passenger count, special requirements).
• Fuel pricing, handling fee, and ancillary cost data used in quote calculations.
• Finalized quote documents and associated client information.

Device & Usage Data

• Device type, operating system, browser type and version, and screen resolution.
• IP address (used for security purposes and general geographic analytics — not precise location tracking).
• Pages and features accessed, timestamps, session duration, and navigation paths.
• Error logs, crash reports, and performance telemetry (used to identify and fix bugs).
• Offline activity logs that are synced when connectivity is restored (see Section 7).

Communications Data

• Any information you send us via email, through a contact form, or in support communications.

Data You Do Not Provide Directly

We do not purchase data about you from data brokers. We do not collect social media profile data. We do not build behavioral advertising profiles.

We use the data we collect for the following purposes:

Providing and Operating the Services

• Authenticating users, managing accounts, and enforcing role-based access controls.
• Processing and displaying flight operations data, trip records, crew schedules, and maintenance logs.
• Generating AI-powered quotes, processing expense receipts, and compiling operational reports.
• Facilitating eAPIS/APIS and international filing submissions on behalf of operators.
• Enabling offline functionality and syncing data when connectivity is restored.

Security & Fraud Prevention

• Detecting and preventing unauthorized access to accounts.
• Investigating suspicious activity and enforcing our Terms of Service.
• Maintaining audit logs for security and compliance purposes.

Product Improvement

• Analyzing aggregated, de-identified usage patterns to understand how features are used and how to improve them.
• Diagnosing performance issues and bugs from crash reports and error telemetry.

Communications

• Sending transactional emails (password resets, account notifications, subscription confirmations).
• Sending product update announcements and important service notices.
• Responding to support requests and inquiries.

Legal Compliance

• Complying with applicable laws, regulations, legal process, and government requests.
• Enforcing our Terms of Service and other agreements.
• Protecting the rights, property, and safety of Barshe Tech, our users, and the public.

What We Do Not Do

• We do not sell your personal data to third parties.
• We do not use your flight operations data, passenger data, or crew data to train general-purpose AI models that benefit other customers or third parties.
• We do not use your data for targeted advertising.
• We do not profile you for automated decision-making in ways that produce legal or similarly significant effects without human review.

AI Quote Engine

The AeroDeck AI Quote Engine generates trip cost estimates based on route parameters, aircraft specifications, fuel pricing, handling fees, and other operational inputs you provide. To generate a quote:

• Trip parameters (origin, destination, dates, passenger count, aircraft type) are transmitted to our third-party AI service provider.
• The AI provider processes this data to generate pricing estimates, cost breakdowns, and recommendations.
• The processed results are returned to AeroDeck and displayed to you.

Trip parameters sent to the AI provider do not typically include passenger names, passport numbers, or other personally identifying information about passengers. The operator is responsible for ensuring no unnecessary personal data is included in quote inputs.

AI Expense Extraction

The AI Expense Extraction feature analyzes photographs of receipts to extract structured data (vendor name, amount, currency, date, and description). When you upload a receipt image:

• The receipt image is transmitted to our third-party AI service provider for optical character recognition and data extraction.
• The image and extracted text may temporarily reside on the AI provider's infrastructure during processing.
• Extracted structured data is returned to AeroDeck and linked to the relevant trip record.

Receipt images may contain personal information (cardholder names, partial card numbers, addresses, employee names). We recommend redacting sensitive information from receipts before uploading where operationally feasible.

Third-Party AI Provider Obligations

Our AI service providers are contractually bound to:

• Process data only to provide the AI services to us — not for their own business purposes.
• Not use your data to train generalized models that benefit other customers.
• Maintain appropriate security measures.
• Delete or return data upon termination of our agreement.

We select AI providers that offer Data Processing Agreements (DPAs) consistent with GDPR Article 28 and applicable U.S. data protection standards. However, we cannot guarantee the practices of third-party providers beyond the terms of our agreements with them. For the identity of our current AI providers, contact us at info@barshe-tech.com.

Disabling AI Features

If your organization requires that no data be transmitted to third-party AI providers, you may opt out of AI features at the account or organization level. Opting out disables AI Quote Engine automation and AI Expense Extraction; manual entry remains fully functional.

We do not sell your personal data. We share data only in the following limited circumstances:

Service Providers

We engage trusted third-party vendors to help us operate our Services. These vendors act as data processors and are contractually required to handle data only on our instructions, implement appropriate security measures, and not use data for their own purposes. These categories include:

• Cloud infrastructure providers — for hosting, storage, and computation.
• AI service providers — for the Quote Engine and Expense Extraction features (see Section 4).
• Payment processors — for billing and subscription management. Payment processors receive your payment card or bank account details; Barshe Tech does not store full payment instrument data.
• Email delivery services — for transactional and notification emails.
• Analytics providers — for aggregated, de-identified usage analytics. We do not share individually identifiable data for analytics purposes.
• Security services — for fraud detection and authentication services.

Aviation Regulatory Submissions

AeroDeck facilitates the submission of required regulatory filings on your behalf, including eAPIS/APIS submissions to U.S. Customs and Border Protection and equivalent authorities in other jurisdictions. When you use these features, the relevant data (passenger manifests, crew data, aircraft details) is transmitted directly to the applicable government authority. This transmission is at your direction and instruction as the operator. You remain legally responsible for the accuracy and completeness of all regulatory submissions.

Legal Requirements

We may disclose your information if required to do so by law, court order, subpoena, or government request, or to protect the rights, property, or safety of Barshe Tech, our users, or the public. Where legally permitted, we will notify you before disclosing your data in response to a legal request.

Business Transfers

If Barshe Tech Solutions Corporation is involved in a merger, acquisition, asset sale, or bankruptcy proceeding, your data may be transferred as part of that transaction. We will provide notice before your data is transferred and becomes subject to a different privacy policy. Any successor entity would be required to honor commitments made in this policy, or obtain your consent for any material changes.

With Your Consent

In any circumstance not described above, we will ask for your explicit consent before sharing your data with any third party.

No Sale of Data

Barshe Tech does not sell personal information as defined under the California Consumer Privacy Act (CCPA) or any other applicable law. We do not share personal information for cross-context behavioral advertising.

Where Data Is Stored

Data is stored on cloud infrastructure located primarily in the United States. For international operations, data may be processed in or transited through additional regions as required by the Services or by law. See Section 9 for information about international transfers.

Security Measures

We implement industry-standard technical and organizational measures to protect your data, including:

• Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher. We enforce HTTPS across all endpoints.
• Encryption at rest: Data stored in our databases and file storage is encrypted at rest using AES-256 or equivalent.
• Two-factor authentication (2FA): AeroDeck supports and recommends 2FA for all user accounts. Enterprise accounts may require 2FA as a condition of access.
• Role-based access control (RBAC): Access to data within an organization is governed by role-based permissions. Administrators control which users can access which data. Pilots, crew, maintenance personnel, and accountants see only the data relevant to their role.
• Audit logs: Platform access and key data operations are logged for security review and compliance purposes.
• Internal access controls: Barshe Tech employees and contractors access customer data only on a need-to-know basis, under non-disclosure obligations.
• Security testing: We perform regular security reviews of our infrastructure and application code.

Breach Notification

In the event of a data breach that is likely to result in risk to your rights and freedoms, we will notify affected users and, where required, applicable supervisory authorities, in accordance with applicable law. Notification timelines are as required by law (e.g., 72 hours for GDPR-covered breaches where feasible).

Your Responsibility

You are responsible for maintaining the security of your account credentials. We recommend using a strong, unique password and enabling 2FA. Do not share your credentials with unauthorized individuals. Notify us immediately at info@barshe-tech.com if you suspect unauthorized access to your account.

AeroDeck is designed to function in environments with limited or no internet connectivity — on the ramp, in remote locations, or in airspace with degraded connectivity. This section explains how offline data is handled.

Local Storage

When you use AeroDeck in offline mode, data you create or modify (flight logs, passenger entries, expense records, maintenance squawks, etc.) is stored locally on your device. This locally-stored data is subject to your device's own security controls. We strongly recommend that devices used with AeroDeck be protected by a strong passcode, biometric authentication, and device-level encryption.

Sync Behavior

When your device reconnects to the internet, AeroDeck automatically syncs locally-stored data to our servers. During sync:

• All data created offline is encrypted in transit to our servers.
• Conflict resolution logic handles cases where the same record was modified offline on multiple devices.
• Sync events are logged for audit purposes.

AI Features Offline

AI-powered features (Quote Engine and Expense Extraction) require an active internet connection to function, as they depend on third-party AI service providers. These features are disabled in offline mode and will process queued inputs upon reconnection if you have enabled that behavior in settings.

Data Remaining on Device

When you log out of AeroDeck or when your session expires, locally cached data is cleared from active memory. Depending on your device and operating system, some residual data may remain in device storage caches. For security-sensitive deployments, we recommend using the explicit "Clear Local Data" function before returning a device to an uncontrolled environment.

Retention During Active Accounts

We retain your data for as long as your account is active or as needed to provide the Services. Aviation operational records (flight logs, maintenance records, crew duty records) may have longer default retention periods to support regulatory compliance needs common in the aviation industry. You can configure retention settings for certain data types from your account settings.

After Account Termination

When you close your account or your subscription expires:

• You have a 90-day data export window during which all your data remains accessible for export (see Section 14).
• After 90 days, personal data is deleted or de-identified from our active systems unless retention is required by law.
• Backup copies may persist for up to an additional 90 days before being purged from backup archives.

Legal Hold

If we are required by law, regulation, legal process, or legitimate business necessity (such as an ongoing legal dispute) to retain data beyond the periods above, we will do so. We will notify you if practicable.

Regulatory Considerations

Certain aviation data may be subject to FAA, EASA, or other regulatory recordkeeping requirements that mandate retention for specified periods. If you are operating under such requirements, you are responsible for ensuring that your own retention settings comply. Barshe Tech does not provide legal compliance advice.

Deletion Requests

You may request deletion of your personal data at any time (see Section 14). Deletion requests are fulfilled within 30 days subject to legal retention requirements. We will notify you if any data cannot be deleted and explain the reason.

Barshe Tech is a U.S. company. Aviation is a global industry. Our users include operators, crew, and passengers from around the world. If you are located outside the United States, your data will be transferred to and processed in the United States and potentially other jurisdictions.

Transfers from the European Economic Area (EEA)

When we receive personal data from individuals in the EEA, we rely on appropriate legal mechanisms for cross-border transfers, which may include:

• Standard Contractual Clauses (SCCs) — we implement EU-approved SCCs in our agreements with data processors located outside the EEA.
• Adequacy decisions — where the European Commission has determined that a destination country provides adequate protection.
• Your explicit consent — where applicable and where the above mechanisms are not available.

Transfers from the United Kingdom

For transfers of personal data from the United Kingdom, we rely on the UK International Data Transfer Agreement (IDTA) or equivalent legal mechanisms as applicable under UK GDPR.

Passenger Data for International Operations

Passenger data for international flights is, by the nature of aviation operations, submitted to government authorities in multiple countries (eAPIS, APIS, GenDec, advance passenger information). These submissions are at the direction of the operator. Barshe Tech facilitates these submissions as a data processor acting on your instructions; the operator is the data controller for regulatory filing purposes.

Data Residency

Enterprise customers with specific data residency requirements should contact us at info@barshe-tech.com to discuss available options.

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) gives you specific rights regarding your personal information.

Categories of Personal Information Collected

In the preceding 12 months, we have collected personal information in the following categories as defined by the CCPA:

• Identifiers (name, email address, IP address, account ID).
• Personal information categories listed in Cal. Civ. Code § 1798.80(e) (name, address, passport number).
• Internet or other electronic network activity information (usage data, device information).
• Professional or employment-related information (crew certifications, duty records).
• Sensory data (receipt images uploaded for AI processing).

Your California Rights

• Right to Know: You have the right to request information about the categories and specific pieces of personal information we have collected about you, the categories of sources from which we collected it, the business or commercial purpose for collecting it, and the categories of third parties with whom we share it.
• Right to Delete: You have the right to request deletion of personal information we have collected from you, subject to certain exceptions.
• Right to Correct: You have the right to request correction of inaccurate personal information.
• Right to Opt Out of Sale / Sharing: We do not sell personal information and do not share it for cross-context behavioral advertising. Therefore, there is nothing to opt out of with respect to this right.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.
• Right to Limit Use of Sensitive Personal Information: We use sensitive personal information (such as passport numbers) only as necessary to provide the Services. We do not use it for inferring characteristics about you or for advertising.

How to Exercise California Rights

Submit a verifiable consumer request by emailing info@barshe-tech.com with the subject line "CCPA Request." We will respond within 45 days. We do not charge a fee for processing a reasonable request. We may need to verify your identity before fulfilling your request.

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) or equivalent law may apply to how we process your personal data.

Legal Bases for Processing

We process personal data on the following legal bases:

• Contract performance (Art. 6(1)(b)): Processing necessary to provide the Services you have contracted for — operating accounts, executing transactions, delivering features.
• Legitimate interests (Art. 6(1)(f)): Processing for security, fraud prevention, product improvement, and communication — balanced against your rights and interests.
• Legal obligation (Art. 6(1)(c)): Processing required to comply with applicable law.
• Consent (Art. 6(1)(a)): Where we rely on consent (e.g., optional communications), you may withdraw it at any time without affecting lawfulness of prior processing.
• Special category data (Art. 9): Where we process special category data such as health-related information (medical certificate status), we rely on explicit consent or the necessity for reasons of substantial public interest as applicable in the aviation safety context.

Your GDPR Rights

• Right of access (Art. 15) — obtain a copy of your personal data.
• Right to rectification (Art. 16) — correct inaccurate or incomplete data.
• Right to erasure / "right to be forgotten" (Art. 17) — request deletion, subject to retention obligations.
• Right to restriction (Art. 18) — limit how we use your data in certain circumstances.
• Right to data portability (Art. 20) — receive your data in a structured, machine-readable format.
• Right to object (Art. 21) — object to processing based on legitimate interests.
• Rights related to automated decision-making (Art. 22) — we do not make solely automated decisions with legal or similarly significant effects about you.

Controller vs. Processor

For data that registered users input into AeroDeck (flight ops data, passenger data, crew data), the customer organization is typically the data controller, and Barshe Tech acts as a data processor under Art. 28 GDPR. For account data and platform usage data, Barshe Tech is the data controller.

Data Protection Officer

We have not appointed a formal Data Protection Officer. Privacy inquiries from EEA residents should be directed to info@barshe-tech.com.

Supervisory Authority

You have the right to lodge a complaint with your local supervisory authority. In the EU, this is typically the data protection authority of the member state where you reside. In the UK, this is the Information Commissioner's Office (ICO).

AeroDeck and all Barshe Tech Services are designed for business use by adults in professional aviation, healthcare, and enterprise contexts. Our Services are not intended for children under the age of 13 (or under 16 in the EEA/UK where a higher age applies). We do not knowingly collect personal data from children.

If you believe we have inadvertently collected data from a child, please contact us immediately at info@barshe-tech.com. We will promptly delete such data upon verification.

Passenger data submitted through AeroDeck (for manifest and international filing purposes) may include information about minor passengers. This data is collected at the direction of the operator for regulatory filing purposes only and is not used for any other purpose.

We use cookies and similar technologies to operate and improve our Services.

Types of Cookies We Use

• Essential cookies: Required for the platform to function — authentication tokens, session management, CSRF protection. These cannot be disabled without breaking the Service.
• Functional cookies: Remember your preferences such as dark/light mode, language settings, and display preferences.
• Analytics cookies: Aggregated, de-identified data about how users interact with the platform — used to improve features and performance. We use privacy-conscious analytics and do not build individual behavioral profiles.

What We Do Not Use

• We do not use third-party advertising cookies or tracking pixels.
• We do not participate in behavioral advertising networks.
• We do not use social media tracking pixels.

Managing Cookies

You can control cookies through your browser settings. Blocking essential cookies will prevent you from logging in to the platform. To opt out of analytics tracking, you may use your browser's Do Not Track setting or contact us at info@barshe-tech.com.

Regardless of your jurisdiction, we believe in giving you meaningful control over your data. The following rights are available to all users:

Access

You can access most of your data directly within the AeroDeck platform. For a comprehensive data export, use the platform's export function or submit a written request to info@barshe-tech.com.

Correction

Most data in AeroDeck can be corrected directly by the user or administrator who entered it. If you need help correcting data, contact us.

Deletion

You may request deletion of your account and personal data by emailing info@barshe-tech.com. We will process deletion requests within 30 days, subject to legal hold and regulatory retention requirements. We will notify you of any data we are required to retain and the reason.

Data Export / Portability

You may export all data associated with your account in machine-readable formats (CSV, JSON) directly from within AeroDeck. We believe in no vendor lock-in — your operational data is yours and you can take it with you at any time. Export functionality remains available for 90 days after account termination.

Objection to Processing

Where we process your data on the basis of legitimate interests, you may object by contacting us. We will assess your objection and cease processing unless we have compelling legitimate grounds that override your interests.

Opt Out of Communications

Marketing communications include an unsubscribe link. Transactional and security communications are not optional while your account is active. You can manage notification preferences in your account settings.

How to Submit a Request

We may update this Privacy Policy from time to time. When we make material changes — such as changes to how we use sensitive data, who we share data with, or users' rights — we will notify you by:

• Posting the updated policy on this page with a new effective date.
• Sending an email notification to registered users at least 14 days before the changes take effect (for material changes).
• Displaying a notice within the AeroDeck platform.

Your continued use of the Services after the effective date of a revised policy constitutes your acceptance of the changes. If you do not agree to a material change, you may terminate your account and export your data before the changes take effect.

For minor, non-material changes (such as correcting typographical errors, updating contact information, or clarifying existing practices without changing their substance), we may update the policy without individual notification.

We encourage you to review this policy periodically. The date at the top of this page always reflects the current version.

If you have questions about this Privacy Policy, want to exercise your privacy rights, or have a privacy concern or complaint, please contact us:

We take all privacy inquiries seriously and aim to respond within 5 business days. For formal data subject requests under GDPR or CCPA, our response obligations are described in Sections 10 and 11 above.