Privacy Notice

Oluwaseyi Aerospace LLC (Delaware, United States) operates SeyAero. This notice explains how we handle personal data and applies worldwide. It covers two distinct relationships, and the difference matters legally.

• Account data — information about you as a platform user (name, work email, organisation, role, authentication and audit records). For this we are the controller (GDPR/UK GDPR), the business (CCPA/CPRA), and the equivalent under LGPD, PIPEDA, APPI, POPIA, PIPL and Singapore/Thailand PDPA.
• Case data — personal data inside investigation files: flight crew, cabin crew, ATC personnel, maintenance staff, witnesses, passengers and next of kin. For this we are the processor / service provider acting only on the instructions of the customer organisation that opened the case. That organisation is the controller and its own notice governs the underlying processing.

If you are a crew member, witness, passenger or relative whose data appears in a case file, contact the investigating organisation first; we will refer your request to them and support them in answering it.

Account data:

• Identity and contact — full name, work email address, employing organisation or agency, professional role.
• Jurisdiction and consent record — the country or region you declared at registration, the privacy and terms versions you accepted, the timestamp and the acceptance IP address. This record exists to satisfy GDPR Article 7(1) accountability.
• Authentication — password hashes (we never see plaintext), federated identity subject IDs from Google or Microsoft, MFA enrolment state and recovery status.
• Usage and security telemetry — sign-in events, IP address, user agent, case actions written to the tamper-evident audit chain, and error diagnostics.
• Billing contact and subscription metadata where you hold a paid plan.

Case data, uploaded by customers and processed on their instruction, can include special-category and highly sensitive material:

• Cockpit voice recordings and transcripts, ATC audio, and interview recordings — capable of revealing voice biometrics and health or emotional state.
• Crew licensing, medical certification status, duty and rest records, and training history.
• Passenger manifests, seat allocation and, in fatal occurrences, identification and next-of-kin information.
• Maintenance personnel records and named sign-offs.
• Witness statements including the witness's location, contact details and assessed reliability.

We do not deliberately collect children's data. Where a passenger manifest contains a minor, it is processed under the customer's controller responsibility for the statutory purpose of the investigation.

• Contract, Art. 6(1)(b) — creating and operating your account, providing the platform, billing.
• Legitimate interests, Art. 6(1)(f) — platform security, abuse prevention, audit integrity, service improvement and direct business communication with professional users. We have documented balancing tests and will supply a summary on request.
• Legal obligation, Art. 6(1)(c) — tax, accounting, export-control screening and lawful requests.
• Consent, Art. 6(1)(a) — optional marketing email and non-essential analytics only. Withdrawal is available at any time and does not affect prior processing.
• Public interest / official authority, Art. 6(1)(e) — relied on by customer authorities conducting a statutory safety investigation; the controller is that authority, not us.
• Special-category data, Art. 9(2)(g) and 9(2)(j) — substantial public interest and archiving/statistical purposes in the field of transport safety, as implemented by national law and by ICAO Annex 13 obligations. Customers must confirm the Article 9 condition they rely on before uploading medical, biometric or health-revealing material.

European Economic Area and United Kingdom — you have rights of access, rectification, erasure, restriction, portability, objection (including to legitimate-interests processing), and the right not to be subject to solely automated decisions producing legal or similarly significant effects. SeyAero performs no such automated decision-making about individuals; hypothesis ranking is about events, not people, and is always reviewed by a human investigator. You may complain to your supervisory authority or the Information Commissioner's Office.

California (CCPA/CPRA) — we do not sell personal information and do not share it for cross-context behavioural advertising. You may request to know, delete, correct, and limit use of sensitive personal information, and you will not be discriminated against for exercising those rights. Where we handle case data we act as a service provider under a written contract that prohibits any other use. Other US state laws (Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana) are honoured on equivalent terms.

Brazil (LGPD) — you may request confirmation, access, correction, anonymisation, portability, deletion and information about shared parties; our contact point acts as encarregado.

Canada (PIPEDA) — access and correction rights apply; complaints may be made to the Office of the Privacy Commissioner.

Japan (APPI) — we obtain consent for third-party provision where required and disclose transfer destinations by country.

South Africa (POPIA) — the information officer may be reached at the contact address; you may complain to the Information Regulator.

Australia (Privacy Act / APPs), New Zealand, Singapore and Thailand (PDPA), Switzerland (revFADP), Saudi Arabia (PDPL), UAE, India (DPDP Act) — equivalent access, correction and complaint rights are honoured through the same channel, and we apply the strictest applicable standard rather than maintaining divergent practices.

China (PIPL) — the platform is not offered for the processing of personal information originating in mainland China without a separate agreement addressing cross-border transfer assessment.

SeyAero is hosted on cloud infrastructure and processes data in the region selected for your tenancy. Default production hosting is in the European Union; United States and Asia-Pacific residency options are available on enterprise plans. Support and engineering personnel may access data from the United States and Nigeria under contractual and technical controls.

Where personal data leaves the EEA, the UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses (2021/914), the UK International Data Transfer Addendum, and the Swiss addendum, supported by a transfer impact assessment and supplementary measures: encryption in transit and at rest, key separation, access logging on the audit chain, and a policy of challenging any unlawful government access demand and notifying you unless legally prohibited.

We publish a subprocessor register with hosting regions and will notify you of additions with a right to object.

• Account records — for the life of the account, then twenty-four (24) months, to defend claims and evidence consent history.
• Consent and acceptance records — six (6) years, as accountability evidence.
• Audit-chain entries — retained for the life of the case file plus ten (10) years, because evidential integrity depends on an unbroken chain; entries record who did what and when, not case content.
• Case data — under the customer's control. On termination, exportable for ninety (90) days, then deleted or irreversibly anonymised within thirty (30) days.
• Security and sign-in logs — twelve (12) months.
• Billing records — as required by tax law, typically seven (7) years.

Investigation records are frequently subject to statutory retention under national aviation law; those periods override our defaults where the customer instructs us accordingly.

TLS 1.2+ in transit and AES-256 at rest; row-level authorisation so a case file is reachable only by its assigned members; SHA-256 hash-chained audit logging that makes silent alteration of the evidence record detectable; optional TOTP multi-factor authentication; least-privilege internal access with no standing production data access. Full detail is in the Security Policy.

Write to privacy@seyaero.com. We verify identity proportionately — for professional accounts, from the registered address; for sensitive requests, with additional verification. We respond within thirty (30) days (GDPR one month, extendable by two where complex; CCPA forty-five days, extendable by forty-five).

Requests concerning case data are forwarded to the controlling organisation within five (5) business days and we assist them in responding. We will not unilaterally delete evidence from a live safety investigation, because doing so could obstruct a statutory process; that decision rests with the controller and its regulator.

EU/UK representatives under Article 27 are appointed for customers requiring one and named in the order form.

Material changes are notified by email and in-product at least thirty (30) days before taking effect, with the version history retained. Continued use after that date constitutes acceptance where consent is not the basis relied on.

Oluwaseyi Aerospace LLC — privacy@seyaero.com · Data protection contact: dpo@seyaero.com · Security: security@seyaero.com.