Privacy Policy

This Privacy Policy explains how BSO Aeromaintenance (“Aerowise”, “we”, “us”) collects, uses, discloses, and protects Personal Data when you access or use Aerowise Inventory and related services (the “Service”).

If you do not agree with this Privacy Policy, please do not use the Service.

1. Who we are

Provider / Legal entity: BSO Aeromaintenance (sole trader, France)
Registered address: Rue des Acconiers 135, 34070 Montpellier, France
SIRET: 99239352000018
Contact email: support@aerowise.app

2. B2B notice: roles under data protection laws

Aerowise Inventory is provided to organizations (each a “Customer”). If you use the Service through a Customer workspace (for example, as an employee, contractor, or authorized user):

• The Customer is the data controller for Personal Data in the Customer workspace (“Customer Data”).
• Aerowise acts as a data processor for Customer Data and processes it on the Customer’s instructions, under the applicable contract and/or a Data Processing Addendum (“DPA”) (currently in preparation).

If you want to exercise rights relating to Customer Data, please contact your Customer administrator (your employer). We will assist the Customer as required by law.

Aerowise may act as controller for limited data such as business contact details used for onboarding, contract administration, and support communications.

3. Personal Data we process

Depending on how the Service is used, we may process:

A. Customer organization data

Company name, address, phone number, and business email.

B. User account data

Name, business email, role/permissions, and identifiers needed for authentication and access control.

C. Operational records (Customer Data)

Inventory and maintenance-related records created in the workspace (e.g., parts/tools records, work orders, transactions, audit references).

D. Documents uploaded to the Service (Customer Data)

Typically EASA Form 1, certificates of conformity, and tool calibration certificates. These documents may contain personal data (e.g., names, signatures) depending on what the Customer uploads.

E. Audit trail and activity logs (Customer Data)

Actions performed in the Service (e.g., create/update records, issue/reverse transactions), timestamps, and the user account that performed the action. We do not intentionally store IP addresses as part of standard logging.

F. Support communications

Messages exchanged with support (currently via an Intercom-like tool). Attachments are not supported at this time.

4. Purposes of processing

Where the Customer is controller (Customer Data):

Customer Data is processed to provide, secure, and operate the Customer workspace, including traceability/auditability and customer-requested support.

Where Aerowise is controller (limited cases):

We process Personal Data to:

• Communicate with Customers and business contacts (onboarding, contracts, support)
• Provide customer support and respond to requests
• Maintain Service security and prevent abuse
• Comply with legal obligations (e.g., accounting/tax records, where applicable)

5. Legal bases (when Aerowise acts as controller)

Where applicable under EU/EEA laws, Aerowise relies on:

• Contract necessity (to provide support and manage the B2B relationship)
• Legitimate interests (security, preventing abuse, maintaining service reliability)
• Legal obligations (where required)

For Customer Data, the Customer determines the legal bases and purposes.

6. Sharing and disclosure

We do not sell Personal Data. We may share or disclose data:

A. With the Customer (administrators)

Customer administrators can manage accounts, permissions, and access the workspace data according to the Customer’s internal policies.

B. With our service providers (subprocessors)

We use Google Firebase / Google Cloud to host and operate the Service (database, authentication, and file storage). These providers may process Personal Data on our behalf to deliver the Service.

C. For legal and security reasons

We may disclose data if required by law or to protect rights, safety, and security (for example, responding to lawful requests).

7. International transfers

The Service is hosted using Google Firebase / Google Cloud, with Firestore configured in the EUR3 (Europe) multi-region. Depending on Google’s infrastructure and support operations, some processing may occur outside your country. Where required, appropriate safeguards are used for international transfers (e.g., contractual safeguards).

8. Data retention and deletion

Customer Data (including documents):

Upon termination of the Customer’s contract, we delete Customer Data within 3 months, unless legally required to retain certain data longer.

Audit trail / activity logs:

Retained for the duration of the contract plus 3 months.

Backups:

We maintain periodic backups for resilience and disaster recovery. Backup copies (if they include Customer Data) may persist for up to 30 days after deletion.

Support communications:

Retained as needed to resolve issues and maintain support history.

9. Security

We implement appropriate technical and organizational measures designed to protect data, including access control, least-privilege permissions, and encryption in transit (HTTPS/TLS). Data at rest is protected by our cloud provider’s security controls. No system is perfectly secure; we cannot guarantee absolute security.

Two-factor authentication (2FA): not currently enforced by Aerowise.

10. Your rights

Depending on applicable law, individuals may have rights such as access, rectification, deletion, restriction, objection, and portability, and the right to lodge a complaint with the competent supervisory authority (in France, the CNIL).

If you are an end user in a Customer workspace: contact your Customer administrator first.

If Aerowise is acting as controller for your data (e.g., direct business contact): contact us at support@aerowise.app.

11. Cookies and similar technologies

The Service uses strictly necessary cookies or similar storage (e.g., local storage) for authentication, session management, and security. We do not currently use analytics or advertising cookies.

12. Children

The Service is intended for business users and is not directed to children. We do not knowingly collect personal data from children.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version and change the “Last updated” date. If changes are material, we may provide additional notice within the Service.

14. Contact

BSO Aeromaintenance
Rue des Acconiers 135, 34070 Montpellier, France
Email: support@aerowise.app