PRIVACY POLICY

Last updated September 5, 2026

This Privacy Policy describes how Cubic Insights LLC ("we," "us," or "our") collects, uses, shares, and protects information in connection with ProvenFlight, our website at https://www.provenflight.com, and related services (together, the "Services"). ProvenFlight is a professional tool used by military aviators, aviation organizations, and others to track flights, maintain flight logs, and parse aviation documents.

If you have questions about this policy or our privacy practices, contact us at admin (remove this) @ (remove this) provenflight.com.

TABLE OF CONTENTS

1. WHO WE ARE AND WHAT THIS POLICY COVERS
2. OUR TWO ROLES: WHOSE DATA IS IT?
3. WHAT INFORMATION WE COLLECT
4. HOW WE USE INFORMATION
5. WHEN WE SHARE INFORMATION
6. COOKIES AND ANALYTICS
7. HOW LONG WE KEEP INFORMATION
8. HOW WE PROTECT INFORMATION
9. CHILDREN'S INFORMATION
10. YOUR PRIVACY RIGHTS AND HOW TO EXERCISE THEM
11. US STATE PRIVACY DISCLOSURES
12. INTERNATIONAL USERS
13. UPDATES TO THIS POLICY
14. HOW TO CONTACT US

1. WHO WE ARE AND WHAT THIS POLICY COVERS

Cubic Insights LLC is a Florida limited liability company. This policy applies to information we handle when you visit our website, create an account, use the ProvenFlight application, or communicate with us (for example, through our contact form or by email).

This policy uses three defined terms throughout:

• "Customer Data" means all data, records, files, and content submitted to the Services by or on behalf of a customer through the application, including flight and flight logs, aircraft and aircrew information, mission and training records, uploaded aviation documents, voice recordings, transcripts, and parsed output derived from those inputs. Customer Data belongs to the customer.
• "Account Data" means information about you as a user or account holder: your name, email address, password credentials, profile image, organization membership, role, and billing contact information.
• "Usage Data" means technical logs and product-analytics data about how the Services are used, such as IP address, device and browser information, pages viewed, and feature events.

2. OUR TWO ROLES: WHOSE DATA IS IT?

We handle information in two distinct roles, and your rights and our responsibilities differ depending on which role applies. This distinction is the backbone of this policy.

Role 1: Data controller for Account Data and Usage Data

For Account Data and Usage Data - information about you as a user of the Services - we decide how and why the data is processed. In privacy-law terms, we act as the "controller" or "business." The rest of this policy describes what we collect in this role, how we use it, and the rights you can exercise directly with us.

Role 2: Service provider for Customer Data

For Customer Data - including flight records, flight logs, and information extracted from uploaded aviation documents - we process the data only on behalf of, and according to the instructions of, the customer (the account holder or their organization). In privacy-law terms, we act as a "service provider" or "processor."

We do not use Customer Data for our own purposes. We access and process it only: (a) to provide, secure, support, and maintain the Services; (b) as instructed by the customer; (c) as required by law; or (d) in de-identified or aggregated form that does not identify any individual or customer, as described in our Terms of Service. We never sell Customer Data, never use it for advertising, and never attempt to re-identify de-identified data.

If your information appears in Customer Data - for example, if another user entered flight or personnel records that reference you - please direct requests to access, correct, or delete that information to the organization or account holder that controls the record. They control the data; we support them in fulfilling such requests as required by law and our agreements with them.

3. WHAT INFORMATION WE COLLECT

Account Data

When you create an account or manage a subscription, we collect:

• Name and email address
• Password (stored only in hashed form)
• Profile image (if provided, including through a supported sign-in provider)
• Organization membership and role (for example, pilot or administrator)
• Billing contact information for paid plans
• Purchase and subscription records, including store transaction identifiers

Payment card data. Website payments are processed by Stripe. In-app purchases are processed by Apple or Google, depending on your device. Your payment provider handles your card number and payment credentials; we never store payment card data on our systems. We receive purchase and subscription information to provide paid access and handle billing support. Stripe's privacy notice is available at https://stripe.com/privacy.

Single sign-on (SSO). If you choose to sign in with Apple or Google, we receive an account identifier and the name, email address, and profile image that the provider makes available. Apple may provide a private relay email address. We do not receive your contacts, files, or calendar contents.

Usage Data

When you use the Services, we automatically collect technical information: IP address, device and browser characteristics, operating system, pages viewed, feature events, and log data (such as timestamps and error reports). We collect this through server logs and PostHog, our hosted product analytics, session replay, and error reporting provider. Analytics can be linked to your account identifier, name, and email address. See Section 6 for details.

Support and contact data

When you contact us - for example, through the contact form or by email - we collect your name, email address, and the contents of your message. Contact-form messages, new-signup events, and plan-change events generate internal alerts to our team so we can respond and help new customers get started; see Section 5 for how those alerts are delivered.

Customer Data, including operational and personnel information

Customer Data may include operational, personnel, and mission-related information entered by users or extracted from uploaded aviation documents. We process all such information solely as a service provider on the customer's behalf as described in Section 2. You are responsible for ensuring that you have the right to upload and process any documents and records you submit to the Services.

Voice drafts

If you choose to record a voice draft, we upload and process the recording to transcribe your speech and suggest flight details for your review. We retain the recording, transcript, and suggested details with your account as Customer Data. The recording is not discarded immediately after transcription. Service providers may process these inputs on our behalf to provide transcription and draft extraction. Voice recording is optional; you can enter flights manually. We do not use recordings to create voiceprints or identify you by voice.

4. HOW WE USE INFORMATION

We use Account Data, Usage Data, and support data to:

• Provide, operate, and maintain the Services, including authentication, account management, and document parsing
• Onboard and support customers, including internal new-signup and plan-change alerts so our team can help new customers get started and respond to questions
• Process purchases, subscriptions, and billing through Stripe, Apple, or Google
• Protect the security of the Services and prevent fraud and abuse
• Understand how the product is used and improve it (product analytics)
• Communicate with you: transactional email (such as welcome, verification, and password-reset messages) and occasional product updates, which you can opt out of in Settings
• Comply with legal obligations and enforce our agreements

We use Customer Data only as described in Section 2.

We do not sell personal information. We do not use Customer Data - your uploaded records and flight data - for advertising, and we never use it to market to anyone. Advertising measurement is confined to our public marketing pages and the sign-up page; see Section 6.

5. WHEN WE SHARE INFORMATION

We share information only in the situations listed below - nothing else.

• Service providers under contract. We use a small number of vendors to run the Services, each bound by written contracts limiting their use of data to providing services to us, including hosting and database providers, payment processing through Stripe, Apple, or Google, PostHog analytics and error reporting, AI-assisted document and voice processing, transactional email delivery, and identity providers if you choose SSO. Operational and personnel data in Customer Data is processed only to provide the Services.
• Advertising measurement. If you reach us from a Google ad and then create an account, Google receives the fact that a sign-up occurred along with the identifiers its tag set in your browser. It does not receive your uploaded records, your flight data, or anything you enter inside the product.
• Compelled disclosure. We may disclose information if required to do so by law or valid legal process, such as a subpoena, court order, or warrant, or to protect the rights, safety, or property of Cubic Insights LLC, our users, or others. Where a third party seeks Customer Data (such as flight or personnel records), our practice is to redirect the request to the customer that controls the record and, unless legally prohibited, to notify the affected customer before disclosing and to reasonably cooperate with efforts to contest or limit overbroad requests.
• Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction. Any successor will be bound by this policy with respect to previously collected information.
• With your direction or consent. We share information when you direct us to or otherwise consent.

6. COOKIES AND ANALYTICS

We keep tracking technologies to a minimum:

• Essential cookies. We use authentication and session cookies (set as httpOnly and secure) to keep you signed in and protect your account. The Services do not work without them.
• Functional preferences. We may store interface preferences (such as display settings) in your browser.
• First-party campaign attribution. When you arrive from a Google ad, we may store its click ID in a first-party cookie on our domain, then attach it to your analytics profile if you sign up. We use this only to attribute sign-ups to ads - not for cross-site profiling.
• Google Ads and OpenAI Ads conversion measurement. Our public marketing pages and the sign-up page load Google's advertising tag and OpenAI's ChatGPT Ads measurement pixel, which set cookies that let each network report whether an ad click led to a new account. Those tags are limited to those pages: they are never loaded inside the signed-in product and never receive your records or flight data. You can block them with your browser's cookie settings or a content blocker, and signing up still works.
• Product analytics and session replay. We use PostHog to understand how the product is used and diagnose errors. This includes feature events, device information, error reports, and session replays of app interactions. Session replays may include text, images, and other content displayed or entered in the app. These records can be linked to your account identifier, name, and email address. PostHog processes this data on our behalf for product improvement and support, not for advertising. Its privacy notice is available at https://posthog.com/privacy.

No advertising technology runs inside the signed-in product. No advertising tag is present on any page that displays your logbook, documents, or flight records, and we do not build advertising audiences or profiles from what you do in the product.

Most browsers let you remove or block cookies through their settings; blocking essential cookies will prevent you from signing in, while blocking advertising cookies affects only ad measurement. We do not sell personal information. To the extent conversion measurement counts as "sharing" for cross-context behavioral advertising under applicable law, we honor universal opt-out signals such as Global Privacy Control.

7. HOW LONG WE KEEP INFORMATION

• Account Data: retained while your account is active. After you delete your account or request deletion, we delete Account Data within 90 days, except for limited records we must keep to prevent fraud, resolve disputes, or comply with legal obligations.
• Usage Data: retained for a limited period consistent with our analytics and log-retention practices, then deleted or aggregated.
• Customer Data: retained for the duration of the customer's subscription and processed per the customer's instructions. After termination, Customer Data is deleted within 90 days, with residual copies in backups purged on our standard backup rotation. Customers can export their data during the subscription term and should export any records they are required to retain under applicable aviation record-keeping or other laws before closing their account - record-retention obligations belong to the customer or organization, not to us.

8. HOW WE PROTECT INFORMATION

We maintain technical and organizational safeguards designed to protect the information we process, including encryption in transit and at rest, role-based access controls, two-factor authentication for user accounts, audit logging, and automated backups. Our security practices are described in more detail in our Security Overview.

Breach notification. If we become aware of a security incident affecting your personal information or Customer Data, we will notify affected customers without undue delay, consistent with applicable law, and we will provide information reasonably needed for customers to meet their own notification obligations.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security; we work continuously to protect the Services against unauthorized access.

9. CHILDREN'S INFORMATION

Accounts are for adults only. ProvenFlight accounts may be created and used only by individuals 18 years of age or older. We do not direct the Services to children, do not knowingly allow children to create accounts, and do not knowingly collect information directly from children. If we learn that a child has created an account, we will delete it.

10. YOUR PRIVACY RIGHTS AND HOW TO EXERCISE THEM

Account Data

You can access and correct your Account Data at any time in your account settings, export your organization data from within the application, and delete your account from account settings, from our account deletion page, or by emailing admin (remove this) @ (remove this) provenflight.com with the subject line "Privacy Request." Depending on where you live, you may have legal rights to access, correct, delete, or obtain a copy of your personal information, and to non-discrimination for exercising those rights.

When you submit a request, we will verify your identity (usually by confirming control of the email address on your account) and respond within 45 days, extendable once by an additional 45 days where permitted by law, in which case we will tell you. Authorized agents may submit requests on your behalf with proof of valid authorization. If we decline your request, you may appeal by replying to our response or emailing admin (remove this) @ (remove this) provenflight.com with the subject line "Privacy Request Appeal"; we will respond in writing with the reasons for our decision within the period required by applicable law (generally 60 days). If your appeal is denied, you may submit a complaint to your state attorney general.

Customer Data

If your request concerns information entered by another user or organization (Customer Data), please direct it to that account holder or organization, which controls the record. If you send such a request to us, we will refer it to the customer and assist them in responding.

EEA, UK, Switzerland, and Canada

The Services are hosted in and intended for use in the United States. If you are located in the European Economic Area, United Kingdom, Switzerland, or Canada, applicable law may give you rights to request access to, rectification or erasure of, restriction of, or portability of your personal information, or to object to its processing or withdraw consent. You can exercise these rights by contacting us as described in Section 14; withdrawing consent does not affect the lawfulness of processing before withdrawal. You also have the right to complain to your local data protection or supervisory authority (in Switzerland, the Federal Data Protection and Information Commissioner).

11. US STATE PRIVACY DISCLOSURES

This section applies to residents of US states with comprehensive privacy laws, including California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia. It describes the categories of personal information we have collected in the preceding twelve (12) months, acting as a business/controller, except where noted. Rights and exercise mechanics are described in Section 10; retention periods are described in Section 7.

Categories of Personal Information We Collect

No sale or sharing. We have not sold or shared personal information in the preceding twelve (12) months and will not sell or share personal information. We disclose personal information to service providers for business purposes only, as described in Section 5. We do not engage in targeted advertising, do not profile individuals in furtherance of decisions that produce legal or similarly significant effects, and do not offer financial-incentive programs in exchange for personal information.

California "Shine the Light"

We do not disclose personal information to third parties for their direct marketing purposes. California residents may request further information by contacting us as described in Section 14.

12. INTERNATIONAL USERS

The Services are hosted and operated in the United States, and information we process is stored in the United States. If you access the Services from outside the United States, your information will be transferred to, stored in, and processed in the United States, where privacy laws may differ from those in your jurisdiction. We apply the safeguards described in this policy and our Security Overview to all information we process, wherever the user is located. If you have questions about international use, contact us at admin (remove this) @ (remove this) provenflight.com.

13. UPDATES TO THIS POLICY

We may update this policy from time to time. The updated version will be indicated by the "Last updated" date at the top of this page. If we make material changes, we will notify account holders by email or by a prominent notice in the application before the changes take effect.

14. HOW TO CONTACT US

To ask a question about this policy or exercise your privacy rights, email admin (remove this) @ (remove this) provenflight.com (use the subject line "Privacy Request" for rights requests) or write to us at:

Cubic Insights LLC
216 N 2nd St, Fernandina Beach, FL 32034, USA
+1 (404) 825-2866