Template notice: this is a general-purpose Privacy Policy template written for Astra Pilot Academy's specific business (an exam-prep course that collects an account email and processes payment via Stripe). It is provided as a starting point, not legal advice. Have a qualified attorney review this policy — including against any privacy laws that apply where your users are located (e.g. GDPR, CCPA) — before relying on it in production.
1. What we collect
We collect only what's needed to run the Service:
- Account information: your email address (and password, or sign-in provider identifier) used to create and access your account.
- Payment information: handled by Stripe. We never receive or store your full card number, CVC, or bank details. We do receive payment status, transaction amounts, and limited billing metadata (like card last-4 and card brand) needed to grant access and handle refunds.
- Course progress data: lesson completion, quiz and practice-exam attempts and scores, chart-trainer activity, streaks, and certificates — used to power your readiness score, dashboards, and (if applicable) your organization's team-progress reporting.
- Support & communications: messages you send us through the support inbox, and any guarantee-claim materials (like proof of test scheduling or a failed test report) you choose to upload.
- Basic technical data: standard server logs (IP address, browser/device type, timestamps) used for security and abuse prevention.
2. How we use it
- To create and maintain your account and deliver the course you paid for.
- To process payments, receipts, and refunds (including pass-guarantee refunds) through Stripe.
- To calculate your readiness score, track progress, and issue completion certificates.
- To send transactional email (receipts, reminders to keep studying, guarantee-window notices) and respond to support requests.
- To keep the Service secure and prevent fraud or abuse.
- If you're on a team/enterprise plan, to share your progress and completion status with your organization's admin.
3. We do not sell your data
Astra Pilot Academy does not sell your personal data to third parties, and we don't share it for third-party advertising purposes. We share data only with the service providers described below, as needed to run the Service, or when required by law.
4. Service providers we use
- Stripe — payment processing. Stripe handles your card details directly under its own privacy policy; we never see or store full card numbers.
- Supabase — our database and authentication provider, used to store account, progress, and course data securely.
- Email delivery provider — used to send transactional email (receipts, reminders, support replies).
5. Data retention
We keep your account and course data for as long as your account is active, and for a reasonable period afterward to comply with legal, tax, and accounting obligations, and to resolve disputes (including guarantee claims). You can request deletion — see "Your choices" below.
6. Your choices
- You can access and update most account information from your account settings.
- You can request a copy of the personal data we hold about you.
- You can request that we delete your account and associated personal data, subject to reasonable exceptions (e.g. records we're required to keep for billing, tax, or fraud-prevention purposes).
- You can unsubscribe from non-essential emails at any time; we'll still send transactional email tied to your account and purchases.
To exercise any of these, contact us at privacy@astrapilotacademy.com.
7. Security
We use industry-standard safeguards — including encryption in transit, access controls, and a PCI-compliant payment processor (Stripe) so card data never touches our servers — to protect your information. No system is 100% secure, and we can't guarantee absolute security.
8. Children's privacy
The Service is intended for adults preparing for an FAA certification and is not directed to children under 13. We don't knowingly collect personal data from children under 13.
9. Changes to this policy
We may update this Privacy Policy from time to time. If we make material changes, we'll update the effective date above and, where appropriate, notify you directly.