Privacy Policy

Aero Axios is a crew management platform operated by Eraaz Tech, Radhe Radhe, Madhyapur Thimi-5, Bhaktapur, Nepal. For data our customers put into the platform, the operator is the data controller and Eraaz Tech acts as a data processor on their instructions. For our own website and sales enquiries, we are the controller.

Depending on how you interact with us, this may include:

• Contact data you send us — name, email address, phone number, company and the content of your message.
• Account data for platform users — name, work email address, assigned roles and the operator they belong to.
• Crew records entered by our customers — names, staff and crew codes, dates of birth, nationality, passport numbers, contact details, licences, medical and training certificates, type ratings, duty and leave history.
• Uploaded documents — certificate scans and crew photographs.
• Technical data — IP address, browser type and timestamps, recorded in server logs for security and troubleshooting.

We do not use crew data to train models, and we do not sell personal data to anyone, ever.

• To provide the service our customer has asked for — rostering, compliance checking and record keeping.
• To authenticate users and keep accounts secure.
• To respond to enquiries and provide support.
• To meet our own legal and accounting obligations.

Where we act as a processor, the lawful basis for processing crew data is determined by the operator — typically the performance of an employment contract and compliance with aviation safety regulation.

Each operator’s data is stored in its own dedicated database schema. Separation is structural rather than a filter applied at query time, so one operator’s records are not reachable from another operator’s session. Uploaded files are held in private storage and are only ever served through an authenticated request — there is no public link to any document.

Customer data is retained for as long as the operator’s subscription is active, and is deleted or returned on request after it ends, subject to any retention period the operator is itself required to observe. Enquiry emails are kept for up to 24 months. Server logs are kept for a short operational period and then discarded.

We use a small number of infrastructure providers to run the service — cloud hosting, managed database and object storage, and a transactional email provider. They process data only on our instructions and under contract. We will tell customers before adding a sub-processor that handles personal data.

Depending on where you live, you may have the right to access, correct, export, restrict or delete your personal data, and to object to processing. If you are a crew member, please contact your employer first — they control your record. If we hold your data as a controller, write to contact@aeroaxios.com.

Passwords are stored using a memory-hard hashing algorithm and are never recoverable. Sessions use short-lived tokens held in HttpOnly cookies, so browser JavaScript cannot read them. Access within an operator is limited by role. See our Security page for detail.

We will update this page when our practices change and revise the date above. Material changes affecting customers will also be notified directly.