This publication provides a serious contractual baseline, but it is not a substitute for advice from qualified counsel in the countries where AirBoard will be sold or used.
Scope and roles
This Notice covers the AirBoard website, licensing, support and desktop software. Thoth Group LLC is the controller for its website, commercial, licensing and support records. For employee, crew, passenger, maintenance or operational data entered by a Customer, the Customer normally determines purpose and means and is responsible as controller; the Provider acts only in the role agreed in an Order Form or data-processing agreement.
Website data
Hosting and security systems may process IP address, request time, browser/device information, requested page, referrer and security events to deliver, secure and troubleshoot the site. The current public site does not activate checkout and does not intentionally use advertising trackers.
Business and license data
When purchasing, requesting support or activating a license, AirBoard may process company name, business contact, billing address, tax information, authorized administrator identity, license dates, seat allowance, device or installation status, transaction reference and support correspondence. Full payment-card details should be handled directly by the authorized payment processor rather than stored by AirBoard.
Desktop and operational data
AirBoard is designed as a local-first desktop product. Company, user, aircraft, crew, cost, maintenance, supplier, photo and document information remains on the Customer-controlled device or configured storage unless the Customer deliberately exports it or enables a connector, synchronization, licensing, support or AI function that transmits identified data.
AI and document processing
Before sending personal, confidential or regulated data to an external AI or document service, the Customer must enable the relevant policy, confirm a lawful basis and review the provider’s terms. AirBoard should minimize transmitted fields and show when a third party is involved. AI feedback metadata must not silently rewrite operational records.
Purposes and legal bases
Data may be used to perform a contract, provide and secure the product, verify licensing, issue invoices, support users, meet legal obligations, prevent fraud and improve reliability. Where required, consent is requested for optional processing. Legitimate interests are used only after considering the rights and expectations of the affected person.
Recipients
Data may be disclosed to contracted hosting, payment, accounting, support, security or connector providers only as needed for their task and subject to appropriate obligations. It may also be disclosed where required by law, to protect rights and security, or in a lawful business reorganization. The Customer controls recipients created by its own exports and integrations.
International transfers
Where personal data crosses borders, the responsible party must use an available lawful transfer mechanism and supplementary safeguards where required. The applicable processor list and transfer terms should be documented before production connectors are enabled.
Retention
Website security logs are kept only as long as reasonably needed for security and troubleshooting. Commercial, invoice and licensing records are retained for the contract and legally required accounting period. Support records are retained for service history and legal defense. Customer operational data follows Customer-configured retention and lawful export/deletion controls.
Security
Reasonable technical and organizational measures include role-based access, credential protection, least privilege, package integrity checks, protected local storage and audit trails. No system can guarantee absolute security. Customers must secure devices, backups, administrator credentials and connectors and must report suspected compromise promptly.
Rights
Depending on applicable law, a person may request access, correction, deletion, restriction, portability or objection and may withdraw consent without affecting earlier lawful processing. Requests concerning employer or airline records should normally go first to that Customer. Requests concerning Provider-controlled business or website records must use the official contact in the Order Form or invoice. Identity may be verified before action.
Cookies and local storage
The website may use strictly necessary storage for security, routing or user-requested functionality. Non-essential analytics, advertising or cross-site tracking should not be introduced without an appropriate notice and consent mechanism where required. The desktop application uses local storage for product configuration and user-selected preferences.
Children
AirBoard is a professional business product and is not directed to children. Customers must not use it to collect children’s data without a valid operational need, legal authority and appropriate safeguards.
Changes and complaints
Material changes will be published with a revised date. A person may contact the Provider through the official business details in the Order Form or invoice and may complain to the competent data-protection authority where that right applies.