Legal

Privacy Policy

Effective Date: September 28, 2026. Last updated: 2026-09-28.

1. Who We Are

This policy is from AMTIL Inc., a Delaware corporation. We operate from 7308 E Independence Blvd #1118, Charlotte, NC 28227. AMTIL builds aviation maintenance training software, including the AMTIL Encyclopedia, for students, instructors, FAA Part 147 schools, airlines, and Maintenance, Repair & Overhaul (MRO) providers. When this policy says "we," "us," or "our," that is AMTIL Inc.

The short version: we collect what we need to run the product, we name the companies that process data for us, we do not sell personal information, and you can email privacy@amtil.co about anything below.

2. What This Policy Covers

This policy applies to the sites and apps we operate: amtil.co (this marketing site), app.amtil.co (the AMTIL Encyclopedia learning app, including when you install it to your device), admin.amtil.co (our internal CMS, used by AMTIL staff), command.amtil.co (the partner portal for schools, airlines, and MROs), and connect.amtil.co (the community module).

It does not cover third-party sites we link to. If you follow a link to LinkedIn, YouTube, or a partner school, that site's own privacy policy applies.

3. Information We Collect

3.1 Information you give us.

When you create an Encyclopedia account: your first and last name, email address, and a password. Passwords are stored only in hashed form by our authentication provider; we cannot read them.
When you finish setting up your profile: your date of birth, your profession or role (for example student, instructor, or technician), your region, your school or training institution (required for U.S. students and instructors), and, if you choose, your gender. We use your date of birth to confirm you are at least 13 (see section 13). Access to it is restricted to our back end and authorized administrators.
When you subscribe: Stripe collects your card details. We store the card brand, the last four digits, and the expiry month and year, plus your Stripe customer and subscription identifiers, your plan, its renewal date, and any promo code you entered. We never see or store your full card number.
When you use the app: your assessment answers, the questions you ask the MX-AI assistant, and any class schedule you choose to upload for the calendar feature.
When you contact us on amtil.co: your name, email address, message, and, if you choose to give them, your LinkedIn profile URL and how you heard about us. Newsletter and waitlist forms collect your email address and, if you choose, which updates or module you are interested in.
With each form submission and each acceptance of our terms: we store your IP address and browser user agent alongside that record, to prevent abuse and, for terms acceptances, as proof of what you agreed to and when.

3.2 Information we collect automatically. Our hosting providers log each request (IP address, page requested, browser user agent, time). We also count some page views and sign-up button clicks on amtil.co as plain totals on our own server, with no cookie or identifier attached. In the app we record your learning activity, such as which terms and 3D models you open and your assessment results; that is the data the product is built around. We also measure how the sites are used and when they break, as described in section 6 and in our Cookie Policy. On amtil.co, analytics load only if you accept them.

3.3 Information from third parties. If you sign in with Google, Discord, or Twitch, that service shares your name or username, your email address, and your profile picture with us. We do not receive your password for those services and we do not post to them. If a school or employer sets up your access, they may give us your name, email address, and program details.

4. How We Use Your Information

Running the product: creating and securing your account, checking your age at sign-up, saving your learning progress, answering your MX-AI questions, processing payments through Stripe, and sending account email (confirmations, password resets, receipts).

Communicating with you: service messages about your account, and marketing email only if you signed up for it. Every marketing email has an unsubscribe link. If you talk to our team, we keep notes so the next person you speak with is not starting from zero.

Improving the product: aggregate measurement of which pages and features are used, and error reports that help us fix bugs. We do not build advertising profiles of individual users.

Security and legal: preventing fraud and abuse (including bot checks on sign-up and forms), enforcing our Terms of Service, responding to lawful requests, and keeping tax and accounting records.

5. Legal Bases (GDPR Article 6)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we rely on four legal bases:

Contract: to provide the services you signed up for (your account, the learning content, payments).
Legitimate interest: to keep our services secure, to fix errors, to measure use of the app in aggregate without cookies, and to market to aviation schools and employers. You can object at any time.
Consent: for marketing email and for the optional analytics on amtil.co. You can withdraw consent at any time.
Legal obligation: to keep tax records and respond to lawful requests.

6. Who We Share Data With

These service providers ("sub-processors") process data on our behalf. Each is listed with its role and where it is based.

Supabase, Inc. (United States): database, authentication, file storage, and Vault (encrypted secret storage). Most of your account data lives here.
Stripe, Inc. (United States): payment processing and the billing portal where you manage or cancel a subscription.
Resend, Inc. (United States): email delivery.
Vercel, Inc. (United States): hosting for amtil.co and app.amtil.co, plus Vercel Web Analytics and Speed Insights (cookieless, aggregate measurement).
Cloudflare, Inc. (United States): storage and delivery of images and 3D model files (R2), and Turnstile, the human-verification check on sign-up, log-in, and our forms.
Railway (United States): hosting for some of our back-end services, including our self-hosted Umami analytics.
GlitchTip (hosted error monitoring): receives error reports from our apps (the error, the page, and browser and device details). It does not record your screen.
Google LLC (United States): Sign in with Google; the Gemini API, which generates MX-AI (Hangar Mate) answers from your question, the conversation and related Encyclopedia content, searches Encyclopedia content for MX-AI, and reads class schedules you upload; and Google Workspace for our own email and documents.
Anthropic, PBC (United States): reads class schedules you upload so we can add the dates to your calendar.
Discord Inc. and Twitch Interactive, Inc. (United States): only if you choose to sign in with them.
OpenReplay: session recording on our internal CMS (admin.amtil.co) only, to debug staff tools. Learners on amtil.co and app.amtil.co are not recorded.
Upstash, Inc. (United States): rate limiting on our API endpoints to prevent abuse.
Rapid Email Verifier (a third-party email-validation service hosted on Fly.io): receives the email address you enter in our contact and waitlist forms, to check that it can receive mail and is not a disposable address. It does not receive your name or message.
LinkedIn Corporation (United States, a subsidiary of Microsoft Corporation): Marketing Developer Platform for managing and reporting on our own paid campaigns. See section 7.
TikTok Inc. (United States): Ads Manager for paid social campaigns, used manually.
OpenAI, L.L.C. (United States): used in a narrow set of internal content-production workflows; no end-user personal data is sent.

Please do not put personal information in MX-AI questions; they are sent to the AI providers above to generate an answer. We do not sell personal information. We do not license email lists to advertisers. If we add a sub-processor that handles user data, we update this list first.

7. Advertising and Marketing Platforms

This section is about our own marketing tools. It does not involve your learner account, and nothing here is used when you sign in or learn.

AMTIL is a developer on the LinkedIn Marketing Developer Platform (approved, or applying for approval at the time you read this). Our internal CMS at admin.amtil.co integrates the LinkedIn Advertising API to plan, launch, and measure paid LinkedIn campaigns for AMTIL's own products and services. We are a Direct Advertiser. We do not provide ad-platform tooling to third parties.

The OAuth 2.0 scopes we request from LinkedIn are r_ads, rw_ads, r_ads_reporting, and r_organization_social, against AMTIL's own LinkedIn Ad Account and Company Page (linkedin.com/company/amtiledutech). We do not request, store, or process individual LinkedIn member personal data through these scopes. We receive campaign metadata, creative content we wrote, and aggregate performance metrics (impressions, clicks, spend, conversions, and demographic and firmographic breakdowns at LinkedIn's standard aggregation thresholds).

LinkedIn refresh tokens are stored encrypted at rest in Supabase Vault. They are never logged, never exposed to client-side JavaScript, never emailed, and never sent to any other system. Only AMTIL staff with the marketing-admin role in the CMS can use them, enforced by Supabase Row Level Security and our role-based permissions.

We comply with the LinkedIn API Terms of Use and the LMDP policies. We do not resell, sublicense, or proxy LinkedIn API access. We do not scrape LinkedIn member profiles. We do not build audience lists from LinkedIn data. We do not use LinkedIn data to train machine-learning models.

We do not run advertising pixels (such as the LinkedIn Insight Tag, Meta Pixel, or TikTok Pixel) or Google Analytics on amtil.co or app.amtil.co. We use Google Ads and TikTok Ads Manager manually, not through an API. If we add another ad platform we will update this section before it goes live.

8. How Long We Keep Your Data

Account, profile, and learning data: for as long as your account is open. When you ask us to delete your account, we delete it within 30 days. Copies in our database provider's rolling backups expire within a further 30 days.
Payment and tax records: 7 years, as US tax law requires. Stripe keeps its own records under its policies.
Contact-form messages and sales correspondence (including the IP address and user agent stored with a form submission): for as long as the conversation or business relationship is active, plus up to 36 months.
Newsletter sign-ups: while you are subscribed. After you unsubscribe we keep your subscriber record (your email address, sign-up and unsubscribe dates, where you signed up, the interest you picked if you picked one, and the IP address and user agent recorded when you signed up), as a record of your consent and so that we do not email you again. Ask us at privacy@amtil.co if you want that record deleted.
Waitlist sign-ups (with the IP address and user agent recorded when you joined): until you ask us to delete them at privacy@amtil.co.
Records of your acceptance of our terms (document version, time, IP address, user agent): for as long as your account is open and for as long afterwards as we may need them to show what you agreed to.
Hosting request logs and error reports: kept by our hosting and error-monitoring providers for their standard retention periods, typically 90 days or less.
Marketing campaign performance data: 36 rolling months. This is aggregate campaign data, not data about you.

9. How We Protect Your Data

Traffic to our sites and apps is encrypted in transit with TLS. Our database provider encrypts data at rest. OAuth tokens, API keys, and other secrets are kept in Supabase Vault or our secrets manager, not in application code. Access to user data is limited by role and enforced by Supabase Row Level Security; most AMTIL staff cannot read production user data. Your date of birth can be written only by our back end and changed only by an authorized administrator.

No system is perfectly secure. If we learn of a breach that affects your personal information, we will notify you and any authority as the law requires. We welcome responsible disclosure of vulnerabilities at security@amtil.co.

10. Your Rights

Wherever you live, you can ask us to:

Tell you what we have on you (access).
Fix anything that is wrong (rectification).
Delete it, subject to the retention exceptions in section 8 (erasure).
Export it in a portable format (portability).
Stop using it for marketing (objection).
Restrict processing while you contest something (restriction).
Withdraw consent for anything we do on a consent basis (withdrawal).

Email privacy@amtil.co from the address on your account. Account deletion is handled by email today; there is no delete button in the app yet. You can cancel a subscription yourself in the app under Profile, then Billing, then Manage Subscription. We respond within 30 days. If we need to confirm your identity, we will ask through your account email; we will not ask for a passport scan for a routine request.

If you are in the EEA or the UK and think we have mishandled your data, you can complain to your national supervisory authority (in the UK, the ICO; in Ireland, the DPC). We would rather you came to us first so we can fix it.

11. California Residents (CCPA / CPRA)

If you live in California, the CCPA and CPRA give you the right to know, delete, and correct your personal information, and to opt out of its "sale" or "sharing." We do not sell personal information as the CCPA defines it, and we do not share it for cross-context behavioral advertising, so there is nothing to opt out of. We honor the Global Privacy Control (GPC) signal: on amtil.co it declines optional analytics automatically, and in the app it stops our product-event analytics. To see the categories of personal information we hold about you and how we use them, email privacy@amtil.co.

You also have a right to non-discrimination. If you exercise a privacy right, we will not charge you a different price, give you a worse service, or treat you differently.

12. International Data Transfers

We are a US company and our services run in the United States. If you use AMTIL from the EEA, the UK, or Switzerland, your data is transferred to and processed in the US. Where required we rely on the European Commission's Standard Contractual Clauses (2021) and on adequacy decisions where they exist (for example the UK extension and the Swiss-US Data Privacy Framework). Our sub-processors publish Data Processing Agreements that include these clauses.

13. Children

You must be at least 13 to use AMTIL. The Encyclopedia asks for your date of birth before it saves the rest of your profile. If you are under 13, the account is blocked and deleted. If you believe a child under 13 has given us personal information, email privacy@amtil.co and we will delete it.

Users aged 13 to 17 may use AMTIL with a parent's or guardian's involvement (see section 2 of our Terms of Service). In some countries, including parts of the EEA, the law sets a higher age (up to 16) for using online services without parental consent; if that applies to you, use AMTIL only with your parent's or guardian's permission. A parent or guardian can ask us to delete a minor's account at privacy@amtil.co, and we will do so within 14 days.

14. Changes to This Policy

If we make a material change (a new sub-processor that handles user data, a change to a retention period, or collecting something new), we will tell you by email before it takes effect, normally at least 30 days ahead. Smaller changes, such as clearer wording, get a new "Last updated" date. We keep prior versions and will send you the one you signed up under if you ask.

15. Contact

Email: privacy@amtil.co

Mail: AMTIL Inc., 7308 E Independence Blvd #1118, Charlotte, NC 28227, United States.

We aim to respond to privacy correspondence within five business days.