Privacy Policy

Effective date: the date shown in your member account, onboarding flow, or checkout confirmation.

Operator: Jaybird Sim Center (“Jaybird,” “we,” “us,” “our”), operating at 2550 N Thunderbird Cir #132, Mesa, Arizona 85215 and any successor or additional locations.

You (“Member,” “User,” “you,” “your”): any person who visits our website, creates an account, books or attends a session, enters our Facilities, applies to instruct, submits a lead or contact form, or otherwise interacts with Jaybird.

This Policy explains what personal information Jaybird collects, why we collect it, who we share it with, how long we keep it, and the choices and rights you have. It applies to our website, member portal, admin and instructor surfaces, onboarding and compliance flows, email and SMS communications, and our physical premises. It is incorporated into the Terms of Service and works alongside the Identity & Flight Training Disclosure, the TSA Flight Training Security Program Compliance & Flow-Down Addendum, the Door Access & Facility Security Agreement, the Cookie & Tracking Technologies Policy, the Electronic Communications & E-Sign Consent, and the Photo, Video & Media Release. If you do not agree with this Policy, do not use our services.

1. Summary of the important points

• We collect what we need to run a membership, take bookings, bill you, keep the Facilities secure, and satisfy federal flight-training security law.
• We never receive your full card number. Card data goes directly to Stripe.
• We collect government identity documents and citizenship evidence because 49 CFR Part 1552 requires a flight training provider to verify identity and citizenship before flight training. Those records are retained for at least five (5) years and that obligation overrides a deletion request.
• We may capture a photograph of your face (an optional onboarding selfie and, where applicable, an in-person check-in photo). We use those photographs for human visual identity verification only. We do not run facial recognition and we do not create or store a biometric identifier or biometric template.
• We do not sell or rent personal information, and we do not share it for cross-context behavioural advertising.
• You can request access, correction, deletion, and portability, and you can opt out of marketing at any time by writing to privacy@jaybirdsims.com.

2. Who we are and how to reach us

Controller / business: Jaybird Sim Center, 2550 N Thunderbird Cir #132, Mesa, Arizona 85215, United States.

Privacy requests and questions: privacy@jaybirdsims.com

General support: support@jaybirdsims.com

If you prefer to write to us on paper, address your letter to “Privacy Request” at the postal address above. We do not currently operate a toll-free privacy line; email and post are the two intake channels, and both are treated identically.

3. Scope of this Policy

This Policy covers personal information Jaybird collects as a controller — that is, where Jaybird decides why and how the information is used.

It does not cover:

• Information an outside flight instructor, partner flight school, or training provider collects directly from you under their own privacy practices, even when they meet you at our Facilities. Those parties are independent and are responsible for their own records, including their own 49 CFR Part 1552 obligations where they are the responsible provider.
• Information you give to a third-party website or service you reach from a link on our site.
• Aggregated or de-identified information that can no longer reasonably be linked to you. We maintain de-identified data in de-identified form and do not attempt to re-identify it.

4. What we collect, why, and for how long

The tables below describe every category of personal information Jaybird handles. Where a legal basis is listed, it applies only to individuals protected by the GDPR or UK GDPR (see Section 14); U.S. residents should read the “Purpose” column, which governs regardless of location.

4.1 Account and contact information

Credentials note. Authentication is operated by Supabase Auth. Jaybird staff cannot see your password. We see only that a credential exists, when it was last used, and whether a reset was requested.

4.2 Payment and billing information

Jaybird never receives your full card number. Checkout and billing are handled by Stripe, which is PCI-DSS Level 1 certified. What returns to us is a token and the metadata listed above.

4.3 Government identity documents and citizenship evidence

Identity documents are stored in a private, access-restricted storage bucket that is not publicly addressable and is readable only by the member who uploaded the file and by authorised Jaybird compliance staff. See Section 11.

4.4 Facial images and photographs

Section 6 explains our biometric position in full. In short: these are photographs, used by human eyes, and no biometric template is generated from them.

4.5 Aviation qualification and medical information

4.6 Emergency contact and volunteered health information

We do not ask for a diagnosis, a medical record, or documentation from a physician. Anything you tell us about your health is volunteered by you, is used only for safety and accommodation, and is never used for marketing or profiling.

4.7 Booking, session, and facility data

Camera monitoring at the Facilities is also described in Section 8 of the Door Access & Facility Security Agreement. Cameras are for security. They are not used for productivity monitoring, behavioural profiling, or advertising, and we do not apply facial recognition to footage.

4.8 Device, log, and technical data

4.9 Communications, leads, and marketing

Where a conversion event is sent from our servers to Meta, direct identifiers such as your email address and phone number are hashed before transmission. See the Cookie & Tracking Technologies Policy for the full description of these tags and how to control them.

5. Sensitive information

Some of what we hold is sensitive personal information under U.S. state privacy laws and special category data under the GDPR. Specifically:

• Citizenship and immigration status, and the documents evidencing them.
• Health information you volunteer on a medical-fitness disclosure.
• Facial images, which some state laws treat as biometric-adjacent.
• Government identifiers such as passport and certificate numbers appearing on documents you upload.

For all of it, the following is true:

• We collect it because federal aviation-security law requires it, or because you volunteered it for your own safety. We do not collect sensitive information speculatively.
• We use it only for the purpose it was collected for — regulatory compliance, identity verification, or safety. We do not use it to infer characteristics about you.
• We never sell it, never rent it, and never use or disclose it for advertising, including cross-context behavioural advertising.
• Access is restricted. Sensitive records are visible only to Jaybird staff with a compliance or safety role, and access is logged.
• We do not use it to profile you or to make any decision about you other than the compliance and safety decisions described in this Policy.

Where a U.S. state law gives you the right to limit the use and disclosure of sensitive personal information, you may exercise it under Section 13. We will honour that limit for every use except the ones the law itself exempts — in particular, retention and disclosure that is legally required under 49 CFR Part 1552 and 49 U.S.C. 44939.

6. Biometric and facial image information

This section states our position plainly, because it matters and because it is easy to get wrong.

6.1 What we capture

• An optional selfie during onboarding. You may skip it; the flow continues without it, and an ambassador can take a photo when you arrive instead.
• An in-person check-in photo, taken by a Jaybird ambassador when you present for a session and used to record that identity was visually verified.
• The photograph on the government identity document you upload or present, which necessarily contains your face.

6.2 What we do with it

We display the photograph to a human being — a Jaybird ambassador or compliance reviewer — who compares the face in front of them to the face on file and to the face on your identity document. That is the entire use.

6.3 What we do not do

• We do not perform facial recognition. No automated matching, scoring, or identification is applied to any photograph.
• We do not generate a biometric identifier or biometric template. We do not compute a faceprint, face geometry vector, embedding, hash of facial features, or any other mathematical representation of your face.
• We do not use voiceprints, fingerprints, iris or retina scans, or hand or facial geometry scans.
• We do not sell, lease, trade, or otherwise profit from any photograph of you.
• We do not disclose photographs except to Jaybird staff who need them for identity verification, to a sub-processor that stores them on our behalf, and to TSA, FAA, DHS, or law enforcement on lawful request where the photograph forms part of a compliance record.

Because we do not create a biometric identifier, we do not believe the Illinois Biometric Information Privacy Act (BIPA) or the Texas Capture or Use of Biometric Identifier Act (CUBI) applies to the photographs described here. We nonetheless follow their framework as a matter of policy: we tell you in writing that we are capturing an image, we tell you why and for how long, we obtain your consent before capture, we do not sell the image, and we destroy it on the schedule below.

6.4 Consent

The onboarding selfie is captured only after you are told what it is for, and it is optional. The check-in photo is captured in person by a staff member who tells you what they are doing; you may decline, in which case identity is verified against your government photo ID alone. Signing this Policy, the Photo, Video & Media Release, or the Identity & Flight Training Disclosure does not authorise any use of your image beyond what those documents describe.

6.5 Retention and destruction schedule

The periods below are targets rather than guarantees, for the reason given in Section 17. The five-year floor on compliance records is the one binding figure.

Destruction means deletion from the primary store and expiry from routine encrypted backups on the normal backup cycle. Where a legal hold, an open claim, or the 49 CFR 1552.23 retention floor applies, destruction is deferred until that obligation ends, and then carried out. You can ask us to delete a specific image at any time under Section 13, and we will do so unless the five-year floor or a legal hold prevents it.

7. Federal flight-training security compliance

Jaybird operates inside the Flight Training Security Program (FTSP) framework at 49 CFR Part 1552, adopted under 49 U.S.C. 44939. This has consequences for your privacy that you should understand before you upload anything.

• 49 CFR 1552.7 requires a flight training provider to verify a candidate’s identity and U.S. citizenship, or to confirm a TSA Determination of Eligibility for a non-U.S. person, before flight training begins. That is why we ask for the documents in Section 4.3.
• 49 CFR 1552.19 requires a recorded citizenship attestation from every candidate.
• 49 CFR 1552.23 requires the resulting records to be retained for at least five (5) years and made available to TSA on request.
• Records may be disclosed to the Transportation Security Administration, the Federal Aviation Administration, the Department of Homeland Security, and federal, state, or local law enforcement in response to a lawful request, subpoena, warrant, audit, or inspection. We do not need your permission to comply with such a request, and in some cases we may be prohibited from telling you it was made.
• Where an outside instructor or partner flight school is the responsible flight training provider for your training, we share with them the minimum compliance information they need to discharge their own Part 1552 duties — typically your name, citizenship classification, whether required documents are approved, and the clearance status of your account. We do not send them your payment data, health disclosures, or marketing preferences. The TSA Flight Training Security Program Compliance & Flow-Down Addendum governs that relationship.

A deletion request cannot override this retention obligation. If you ask us to delete your data, we will delete everything we are permitted to delete and we will tell you exactly which records we are legally required to keep, why, and when the five-year clock ends. See Section 13.5.

8. Sub-processors and service providers

Jaybird uses the vendors below to operate the service. Each is bound by a contract that limits them to processing personal information on our documented instructions, requires appropriate security, and prohibits them from selling it or using it for their own purposes.

We may add or replace a sub-processor. When we do, we will update this table, and where the change is material we will note it in the change log described in Section 18. Vendors are selected in part on their security posture, and we review that posture as part of our FTC Safeguards Rule service-provider oversight.

9. How we share personal information

We disclose personal information only as described here.

• Service providers and sub-processors. As listed in Section 8, for the purposes listed there.
• Outside instructors, flight schools, and training partners. Limited to what compliance and scheduling require: your name, contact details you chose to share for the booking, the session details, and the compliance clearance status of your account. Where an outside provider is the responsible flight training provider, the additional Part 1552 sharing in Section 7 applies. These parties are independent controllers for what they collect from you directly.
• Ambassadors, staff, and contractors. On a need-to-know basis and under confidentiality obligations.
• Insurers, auditors, accountants, and legal counsel. Where necessary to place insurance, respond to a claim, close the books, or obtain advice.
• Regulators and law enforcement. TSA, FAA, DHS, and federal, state, or local law enforcement, in response to a lawful request as described in Section 7; and any court or agency where required by subpoena, warrant, or court order.
• In a business transfer. If Jaybird is involved in a merger, acquisition, financing, reorganisation, or sale of assets, personal information may be transferred as part of that transaction. The recipient will remain bound by this Policy, or you will be given notice and a choice where the law requires it.
• To protect rights and safety. Where we reasonably believe disclosure is necessary to prevent physical harm, investigate suspected fraud or a security incident, enforce our agreements, or defend a legal claim.
• With your direction. Where you ask us to share something, for example by naming an instructor or a guardian.

We do not sell or rent personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the twelve months preceding the effective date of this Policy. We do not knowingly sell or share the personal information of anyone under 16 years of age.

10. Automated decision-making

Jaybird applies rule-based automated checks at two points:

• The compliance gate. Before a booking is created, our systems check whether the account has the required approved documents, an approved government photo ID, a recorded citizenship attestation, and — for instructional use, or for a non-U.S. person — the corresponding proof or TSA determination. If a required item is missing, expired, or rejected, the booking is blocked and the portal tells you exactly what is missing.
• The booking gate. Scheduling rules check entitlement balances, membership status, resource availability, cancellation history, and instructor eligibility, and may block or restrict a booking accordingly.

These checks compare records against a fixed rule set. They do not score you, profile you, or infer anything about you.

A human reviews every approval and rejection decision. No document is approved or rejected automatically. A Jaybird compliance reviewer inspects each upload, records their decision and their notes, and is identified in the record. If an automated gate blocks you and you believe it is wrong, email support@jaybirdsims.com and a person will look at it. Where the GDPR applies, you have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects; because a human decides every approval, that right is satisfied by design, and you may in any event request human intervention, express your point of view, and contest the outcome.

11. Security

We maintain an information security programme appropriate to the sensitivity of what we hold, informed by the FTC Safeguards Rule. It includes:

• Encryption in transit. All traffic to our website, portal, and APIs is served over TLS.
• Encryption at rest. The database, file storage, and backups are encrypted at rest by our infrastructure providers.
• Role-based access control. Database row-level security policies restrict each account to its own records. Compliance, admin, and instructor surfaces are separately gated, and staff receive the narrowest role that lets them do their job.
• Restricted document storage. Identity documents and photographs live in a private storage bucket that is not publicly addressable. Files are served only through short-lived signed links issued to an authorised viewer. There is no public URL for an identity document.
• Identity-establishing documents are captured in person. Passports, birth certificates, naturalization certificates, and government photo IDs are photographed by a Jaybird ambassador from the original document you present, rather than accepted as an emailed file, which both improves verification quality and reduces the number of copies in circulation.
• Least-privilege service credentials, secret management, and separation of production from development environments.
• Logging and monitoring, including error monitoring and access logging on sensitive records.
• Staff training on privacy, security awareness, and — for anyone touching compliance records — the requirements of 49 CFR Part 1552.
• Vendor diligence on sub-processors before onboarding and on review.
• Incident response. A documented process for detecting, containing, investigating, and notifying.

No system is perfectly secure. We cannot and do not guarantee that personal information will never be accessed, disclosed, altered, or destroyed by a breach of our safeguards. You also have a role: use a strong, unique password, do not share your credentials or door PIN, keep your devices patched, and tell us immediately at support@jaybirdsims.com if you suspect unauthorised access to your account.

12. Breach notification

If we determine that unencrypted and unredacted personal information of an Arizona resident has been acquired, or is reasonably believed to have been acquired, by an unauthorised person, and that the breach has caused or is reasonably likely to cause substantial economic loss, we will notify affected individuals as required by A.R.S. § 18-552, and we will notify the Arizona Attorney General and the three largest nationwide consumer reporting agencies where the statutory thresholds are met.

Notification will be made within the timeframe the statute requires, subject to the needs of law enforcement and any measures necessary to determine the scope of the breach and restore the integrity of our systems. Where you reside outside Arizona, we will additionally comply with the breach-notification law of your state or country. Where we process personal information on behalf of another party, we will notify that party without undue delay.

13. Your privacy rights

Depending on where you live, you may have some or all of the rights below. Jaybird extends the core rights — access, correction, deletion, portability, and marketing opt-out — to every member and visitor, regardless of residence, as a matter of policy.

13.1 The rights

13.2 How to submit a request

Email privacy@jaybirdsims.com from the address on your account, or write to “Privacy Request” at our postal address. Tell us which right you are exercising and, if it is a deletion request, whether you want your account closed. Members can also correct most account information directly in the portal, and can change marketing preferences there at any time.

13.3 Verification

Because these records include identity documents and compliance data, we verify requests before acting. For most requests, confirming control of the email address on the account is enough. For a request touching identity documents, compliance records, or photographs, we will ask for additional confirmation proportionate to the sensitivity — typically a signed-in portal action or matching two data points already on file. We will not ask you to upload a new identity document in order to make a privacy request. If we cannot verify you to the standard the law requires, we will tell you and explain why.

13.4 Timelines

We acknowledge requests within 10 business days and respond substantively within 45 calendar days. Where the request is complex or we have received several from you, we may extend once by a further 45 days and will tell you before the first period ends. Where the GDPR applies, we respond within one month, extendable by two further months for complex requests. Requests are free; we may charge a reasonable fee or refuse a request that is manifestly unfounded or excessive, and we will explain our reasoning if we do.

13.5 The legal-retention exception to deletion

This is the most important limitation in this Policy, so we state it directly.

We cannot delete flight-training compliance records on request. Records collected under 49 CFR Part 1552 — your identity documents, citizenship evidence, immigration-status documents, citizenship attestation, compliance determinations, and the associated identity photographs — must be retained for at least five (5) years under 49 CFR 1552.23 and made available to TSA. That obligation is federal law and it overrides a deletion request. This limitation is expressly permitted by the CCPA/CPRA and by every U.S. state consumer privacy act, and it corresponds to the GDPR exception for processing necessary to comply with a legal obligation.

Similar limits apply, more narrowly, to:

• Financial records, which we retain for 7 years for tax and accounting purposes.
• Records subject to a legal hold, an open claim, an insurance matter, or an active investigation, which we retain until the matter closes.
• Suppression records, which we retain indefinitely so that we can continue to honour your opt-out.
• Waiver, release, and signed-agreement records, which we retain for the applicable Arizona limitations period so that both sides can prove what was agreed.

When you ask us to delete, we will delete everything outside those categories, tell you specifically what we kept, cite why, and give you the date the retention obligation ends. Retained compliance records are locked down: they are not used for marketing, analytics, or any purpose other than responding to a lawful regulatory or legal request.

13.6 Authorized agents

You may use an authorized agent. We will ask for written permission signed by you, or a valid power of attorney, and we will separately verify your identity and confirm with you that you authorised the request, except where the agent holds a power of attorney under applicable state probate law.

13.7 Appeals

If we refuse your request, our response will tell you why and how to appeal. To appeal, reply to our decision or email privacy@jaybirdsims.com with the subject line “Privacy Appeal.” A different person reviews the appeal and responds within 45 days with a written explanation. If we deny the appeal, we will give you a method to contact your state Attorney General. This appeal route is available to residents of every state, not only those whose law requires it.

14. International visitors, transfers, and the GDPR

Jaybird operates in the United States. Our Facilities are in Arizona and our infrastructure and sub-processors are located in the United States. If you use our services from outside the United States, your personal information will be transferred to, stored in, and processed in the United States, which may not provide the same level of data protection as your home country.

14.1 If the GDPR or UK GDPR applies to you

• Controller. Jaybird Sim Center, at the address in Section 2, is the controller.
• Legal bases. The tables in Section 4 state the legal basis for each processing activity. In summary we rely on contract (operating your membership), legal obligation (aviation-security compliance, tax, breach notification), legitimate interests (security, fraud prevention, service improvement, measuring demand), consent (marketing, the optional selfie, non-essential cookies), vital interests (emergencies), and, for special category data, explicit consent and substantial public interest in aviation security.
• Transfers. Where we transfer personal data out of the EEA or the UK, we rely on the Standard Contractual Clauses and the UK Addendum in our sub-processor contracts, supported by the technical measures in Section 11, or on your explicit consent or the necessity of the transfer for a contract with you.
• Your additional rights. Restriction, objection, and the right not to be subject to solely automated decision-making, as described in Sections 10 and 13.
• Data protection contact. We have not appointed a statutory Data Protection Officer. Privacy matters are handled by the privacy team at privacy@jaybirdsims.com, which is the correct route for any GDPR request or question, including a request to identify a representative.
• Complaints. You may lodge a complaint with your national supervisory authority, or in the UK with the Information Commissioner’s Office. We would appreciate the chance to address your concern first.

14.2 If you are in Canada, Australia, or elsewhere

We handle your request under Section 13 on the same terms, and we will apply any additional right your local law grants you where it applies to us.

15. Marketing, email, and SMS

15.1 Transactional messages

Booking confirmations, cancellation notices, receipts, invoices, payment failures, compliance requests, door-access instructions, safety notices, and legal notices are service messages. They are part of operating your account, they are not marketing, and you cannot opt out of them while your account is open. To stop them, close your account.

15.2 Marketing email

We send marketing email only where you opted in. Every marketing email carries a working unsubscribe link and our physical postal address, as required by the CAN-SPAM Act. We honour unsubscribes promptly and, in any event, within 10 business days. You can also change your preference in the portal or email privacy@jaybirdsims.com.

15.3 SMS and text messages

We send promotional and lead-follow-up texts only if you opt in — for example, by checking the SMS consent box on our contact form, by opting in during onboarding, or by confirming consent with an instructor. The contact-form consent reads: “Text me about membership, intro flights, and availability at the number above. Message frequency varies. Reply STOP to opt out.”

• Consent is express and is not a condition of purchase. You do not have to agree to marketing texts to become a member, book a session, or buy anything.
• Message frequency varies.
• Reply STOP to any message to opt out. Reply HELP for help, or email support@jaybirdsims.com.
• Message and data rates may apply. Carriers are not liable for delayed or undelivered messages.
• We maintain records of your consent and of any opt-out, consistent with the Telephone Consumer Protection Act (TCPA).

Separate, fuller SMS terms appear in the Electronic Communications & E-Sign Consent.

15.4 Advertising

We advertise on Google and Meta and measure whether those ads worked. We do not upload your identity documents, compliance status, health disclosures, or photographs to any advertising platform, ever. See the Cookie & Tracking Technologies Policy for what the tags do and how to control them.

16. Children and minors

Our services are intended for adults 18 years of age or older. You must be 18 to create an account, hold a membership, sign a waiver on your own behalf, or receive a door credential.

A person under 18 may participate only under the Minor Participation & Guardian Consent Agreement, which requires a parent or legal guardian to provide the minor’s information, sign on the minor’s behalf, and accept responsibility for supervision. In that case we collect the minor’s name, date of birth, emergency contact, any safety-relevant disclosure the guardian makes, session records, and — where flight training is involved — the identity and citizenship records 49 CFR Part 1552 requires of any candidate regardless of age. The guardian may exercise every right in Section 13 on the minor’s behalf.

We do not knowingly collect personal information from a child under 13 and we do not direct our services to children under 13, consistent with the Children’s Online Privacy Protection Act (COPPA). If we learn that we have collected personal information from a child under 13 other than through a verified guardian under the Minor Participation & Guardian Consent Agreement, we will delete it promptly. If you believe a child under 13 has given us information, email privacy@jaybirdsims.com.

17. Retention summary

We keep personal information only as long as we need it for the purpose it was collected, plus the period any law, claim, or legitimate business need requires.

The five-year floor on flight-training compliance records is a legal requirement under 49 CFR 1552.23 and we treat it as binding. Every other period in the table below is our current target, not a guarantee. We are still building the automated deletion that would let us promise an exact date, and until that exists a record may persist past the stated period — in a backup, an export, or a system we have not yet brought into the schedule. We will not keep anything longer than the purpose or the law requires, and you can ask us to delete a specific record at any time under Section 13.

When a retention period ends, we aim to delete or de-identify the record and let it expire from encrypted backups on the normal backup cycle. Deletion of compliance records subject to the five-year floor is carried out once that floor has passed.

18. Governing law

This Policy and any dispute arising out of it are governed by the laws of the State of Arizona, without regard to conflict-of-law rules. You consent to exclusive jurisdiction and venue in the state and federal courts of Maricopa County, Arizona, except that Jaybird may seek injunctive relief in any court of competent jurisdiction. Nothing in this section limits any non-waivable right you have under the privacy law of your own state or country, including the right to complain to your Attorney General or supervisory authority.

19. Changes to this document

We may update this Policy as our services, vendors, or legal obligations change. When we do, we will revise the effective date shown in your member account and post the updated version. Where a change materially affects your rights or expands how we use personal information, we will give you advance notice by email or portal notice and, where the law requires it, obtain your consent before the change applies to information already collected.

Continued use of the services after the effective date of an update constitutes acceptance, except where applicable law requires otherwise. If you do not agree to an update, stop using the services and contact us to close your account, subject to the Membership Agreement and the No Refund Policy. Prior versions are available on request from privacy@jaybirdsims.com.

20. Contact

Privacy requests, questions, complaints, and appeals: privacy@jaybirdsims.com

General support and account help: support@jaybirdsims.com

Post: Jaybird Sim Center, Attn: Privacy Request, 2550 N Thunderbird Cir #132, Mesa, Arizona 85215

Questions: support@jaybirdsims.com