Privacy Policy
Privacy Policy
Last updated: 22 July 2026
Overview
This policy describes how the Waypoint mobile app ("the App") collects, uses, discloses and safeguards personal information. The App is provided by ALIS Business Ventures Pty Ltd ("we", "us", "our") and is a hot air balloon operations management tool used by administrators, pilots and ground crew. By using the App you consent to the practices described below.
What we collect
•
Account details: email, full name, phone number, role (Admin / Pilot / Ground Crew) and password. Passwords are hashed with bcrypt — we never see or store your plaintext password.
•
Compliance credentials: licence number & type, medical class & expiry, BFR, ASIC, emergency-procedures training, DAMP, fatigue-mgmt currency, PIL/CIL, and photos of the supporting documents.
•
Operational data: flight logs, fuel usage, aircraft hours, passenger counts, weather snapshots, roster assignments, duty/fatigue time.
•
Device / session: app version, platform, and a JWT access token stored on your device (in the iOS Keychain / Android Keystore).
•
What we do NOT collect: precise location (GPS), advertising identifiers (IDFA/AAID), device contacts, browsing history, financial, health or biometric data. We use no analytics or advertising SDKs.
Why we collect it
•
To operate your account and enforce role-based access.
•
To meet CASA record-keeping obligations for hot air balloon operators (flight logs, fatigue tracking, currency, maintenance).
•
To send you SMS roster notifications (via Twilio) when your admin dispatches a roster containing your phone number.
•
To send you email reminders (via Resend) about expiring compliance items.
•
To fix bugs and improve the App's reliability.
Third parties who process data on our behalf
•
Twilio — SMS roster dispatch. Data shared: your phone number, roster date and duty code. See Twilio's privacy policy.
•
Resend — transactional email. Data shared: your email address and reminder text. See Resend's privacy policy.
•
Bureau of Meteorology (bom.gov.au) — public weather observations. No personal data is transmitted.
•
Emergent LLM (Google Gemini) — on-demand OCR of licence photos when you tap "Scan expiry". Only the photo bytes are transmitted and deleted immediately after extraction.
•
We do not sell your data. We do not use advertising or analytics processors.
How we protect your data
•
In transit: TLS 1.2 / 1.3 (HTTPS) for every request.
•
At rest: data stored in MongoDB on secure infrastructure; passwords hashed with bcrypt; session tokens in the iOS Keychain / Android Keystore.
•
Access control: role-based access enforced server-side; photos served only to authenticated users.
Data retention
•
Account identifiers (email, name, phone, password hash) — kept while your account is active; deleted when you delete your account.
•
Compliance photos — kept while your account is active; deleted when you delete your account.
•
Flight logs, maintenance logs, rosters — retained per CASR/CAO record-keeping obligations (typically 7 years). Your name is preserved on those records as an audit reference. On request we can replace it with an anonymised identifier, subject to CASA guidance.
Your rights
•
Access: view your data inside the App (crew record, flights, currency, fatigue). We'll provide an export on request.
•
Correction: Admins can update your details on the crew screen.
•
Deletion: permanently delete your account and personal data from Settings → Delete my account. This removes your login, personal identifiers and photos. Business/audit records covered by CASA obligations are retained.
•
Object / restrict / portability / complain: email us at clay@habom.com.au. Australian users may also lodge a complaint with the OAIC (oaic.gov.au).
International transfers
Some processors (Twilio, Resend, Emergent) store data in the United States. Transfers rely on standard contractual clauses or equivalent safeguards required by Australian privacy law and, where relevant, the EU/UK GDPR.
Children
Waypoint is a professional aviation tool and is not directed at, and must not be used by, anyone under 16. We do not knowingly collect data from children.
Changes to this policy
We may update this policy. When we do, the "Last updated" date at the top changes and, if the changes are material, a notice will appear in the App. Continued use after an update constitutes acceptance.
Contact
Questions, complaints or requests: email clay@habom.com.au.
© 2026 ALIS Business Ventures Pty Ltd — All rights reserved.