Check a certificate Sign out Book a demo

Company terms

Last updated October 27, 2026Applies to certiflyers.com and the CertiFlyers apps

CertiFlyers LLC, 4730 S. Fort Apache Rd, Suite 300, Las Vegas, NV 89147 · support@certiflyers.com · Version October 27, 2026

These Company terms are an agreement between CertiFlyers LLC ("CertiFlyers", "we") and a company that uses CertiFlyers to train its people (the "Company"). They add to the Terms of use and the Privacy policy; where they differ on a company matter, these terms apply. The Data processing agreement below is part of them.

The person who starts a company trial, buys a company plan, or turns their own account into a company account accepts these terms for the Company by ticking the box “I can accept these terms for <company>”, which confirms they are allowed to. When CertiFlyers sets up a company and invites its first manager, the manager accepts them the same way when accepting the invitation. We record who accepted, when, and which version.

A company account gives the Company a hub where its managers invite people, put them in teams, assign CertiFlyers courses, and follow their progress, certificates and team record. Features arrive in stages; what a plan includes is the description on the pricing page when it is bought. In these terms:

  • Manager: someone the Company makes a manager. Managers act for the Company.

  • Technician: someone the Company trains. QA reviewers and team leads are other roles a Company can give.

  • Seat: one person with an active place in the Company on a yearly plan, managers and QA reviewers included.

  • Course place: one course for one person, bought in advance on the per-course plan.

  • The trial lasts 14 days and needs no card. It starts when the Company is created, or, when CertiFlyers sets up the Company, when its manager accepts.

  • During the trial, everyone the Company invites can take the trial's free course at no charge. Certificates earned are theirs.

  • The hub shows made-up sample technicians so there is something to look at. They are not real people, and a manager can remove them in one click.

  • If the trial ends without a plan, the Company's record becomes read-only: nobody can be invited or assigned, and no reminders are sent. People can still sign in, see their certificates and finish a course they started before the trial ended, certificate included. A course not started waits for a plan.

  • 90 days after a trial ended without a plan, we delete the Company's record, and we email its managers 30 days before. People keep their accounts, their certificates and the certificates' check pages, and a course someone started stays with them. A company that has ever paid is never deleted this way.

The Company pays in one of two ways, at the prices on the pricing page:

  • Per course. The Company buys course places for chosen courses. A place is taken when a course is assigned. If the assignment is canceled, or the person leaves before starting the course, the place comes back. Unused places do not expire: they carry over until used.

  • Yearly plan ("Company Subscription"). A yearly subscription for a number of seats. Everyone with an active place in the Company holds a seat, managers and QA reviewers included; an invitation takes a seat only once it is accepted. The plan's tier (Technician, Crew, Hangar or Fleet) follows the number of seats.

On a yearly plan:

  • Seats can be added at any time, at the full yearly price whatever is left of the year, and they renew with the plan.

  • When every seat is taken, a manager can add seats and send an invitation at once, or send it to wait for a seat. Waiting invitations are filled oldest first as seats free up.

  • Fewer seats take effect at the next renewal, never below the number of people holding a seat. Time already paid is not refunded.

Courses the Company assigns use the Company's places or plan. A person's own purchases, receipts and own yearly plan stay theirs and private, including when they turn their own account into a company account.

Company plans are paid by card through Stripe, in US dollars. The price, and any sales tax, is shown before paying. Receipts are in Billing, where per-course purchases made before company accounts existed appear as past receipts. A price change applies only from the next renewal or the next purchase. Managers are told at least 30 days before a renewal at a new price, in the renewal reminder.

A yearly plan renews automatically for another year, at the price then current, for the seats held, until it is stopped. Every manager is emailed before each renewal. Any manager can stop the renewal in Billing; it applies to the whole Company. The plan then runs to the end of the year already paid, after which the Company pays per course. Until then, "Keep it renewing" undoes it. Every manager is emailed when the renewal is stopped or turned back on.

If a renewal payment fails, every manager is emailed, the card is tried again on Stripe's retry date (otherwise on day 3), and courses stay open for 7 days. If the payment is still missing after 7 days, the Company waits, as after a trial that ended: no assigning, invitations or reminders, while signing in, finishing a started course and certificates keep working. Paying lifts this at once. The Terms of use say the same.

  • A yearly plan can be stopped at any time and ends when the year already paid ends. Part-years and added seats are not refunded unless the law requires it.

  • Unused course places are refunded in full if asked within 14 days of buying them. After that, they stay available until used (section 4).

  • To close the Company's account, a manager writes to support@certiflyers.com. Section 13 and the Data processing agreement say what is then kept and deleted.

  • Everyone has their own CertiFlyers account and signs in for themselves. A manager invites someone by email; the invitation works for 7 days and the person chooses their own password when accepting.

  • For technicians without an email address, a manager can create an account with a printed sign-in card. The person signs in with the card's starting code and then sets their own code. An email address can be added later; it counts only once the person confirms it, by a code or by a link a manager sends (it works once, for 24 hours).

  • A person can belong to more than one company. Each company sees only the courses it assigned, and earlier certificates only if the person chooses to share them.

  • For the courses it assigned, the Company sees each person's name, email address (if any), team, role, progress, quiz results, certificates with their expiry dates, and whether its emails to them were sent, delivered or bounced. We do not track whether an email was opened. A person's own purchases stay private.

The Company confirms that it may give us the names and email addresses of the people it invites, that it has told them how their information is used for their training, and that it removes people who leave.

The Company may invite people aged 16 or 17 for their training; it agrees to these terms for them, as the Terms of use (section 1) allow. Nobody under 16 can be invited.

  • Managers act for the Company: they invite and remove people, assign courses, buy, change and stop plans. The Company is responsible for what its managers do. A Company can have several managers.

  • A Company always has a manager who can sign in. The last manager cannot step down, leave or delete their account until someone else accepts the role; a request to take it over lasts 7 days. A manager who steps down becomes a technician.

  • If a Company has no manager left, someone at the Company can ask support. We check two of three things (an email address at the Company's domain, the date and amount of a recent payment, a call to the Company's public number) and give the former manager 7 days to object before giving access.

  • CertiFlyers staff act on a Company's account only to support it, with a reason, and every such action is recorded in a log that cannot be edited.

  • A manager can remove someone; the person is emailed that they are no longer part of the Company.

  • A course they had not started is canceled and its place comes back. A course they had started is stopped where they were and its place stays used; they can pick it up on their own, from where they stopped, by buying it at the individual price (the quiz starts again).

  • Removing someone who has no email address closes their account, unless an email address is added and confirmed first. Their certificates' check pages keep working.

  • The Company keeps the record of the training done while the person was with it, for as long as the Company's account is open. A manager can delete a leaver's record sooner; the deletion is logged, and the person's own certificates stay theirs.

A certificate is issued in the person's name and stays theirs: when they leave, when a trial ends, when the Company stops paying, and when the Company's record is deleted. Its check page keeps working. A certificate is revoked only for the reasons in the Terms of use (section 4). Refunding course places never affects a certificate: only places nobody has used can be refunded.

  • A trial that ended without a plan: as section 3, read-only, then deleted after 90 days.

  • A Company that stops paying: its record stays, read-only, until a manager asks to close the account, and it can buy per course again at any time.

  • When a Company's account is closed, the Data processing agreement (section 9) says what is deleted and what is kept.

The acceptable-use rules in the Terms of use (section 7) apply to everyone in the Company. In addition, the Company must not:

  • invite anyone who does not work for or with it, or who is under 16;

  • let one seat or one sign-in card be used by more than one person, or hand a card to anyone but the person it is for;

  • resell or pass on access to CertiFlyers or its courses;

  • use CertiFlyers to send its people anything other than their training.

15. Courses, content and no regulatory guarantee

  • The courses and their materials belong to CertiFlyers or its licensors. The Company's people may use them for their own training only, as the Terms of use (section 3) say.

  • Courses are general training. They do not replace the Company's own procedures, the manufacturer's instructions, the regulations that apply to the work, or the practical training and supervision a job requires. Completing a course does not by itself authorise anyone to perform maintenance or any other regulated task.

  • The Company decides which training its people need, how often it is repeated, and whether a CertiFlyers course meets the requirements of a regulator, a customer, or its own training programme. We do not promise that any authority, auditor or customer will accept a course or a certificate.

  • The team record and the certificates show what was done on CertiFlyers. The Company remains responsible for keeping the training records the rules that apply to it require.

The Terms of use (section 8) apply: CertiFlyers is provided as it is, and we may change or remove features. We will not remove a feature a Company has paid for during the year it paid for without refunding the unused part.

  • To the extent the law allows, neither side is liable to the other for indirect or consequential losses, such as lost profits or lost business.

  • The Company is responsible for its people's use of CertiFlyers through its account, and for the personal data it gives us.

  • The most either side can owe the other, for all claims together, is the fees the Company paid CertiFlyers in the 12 months before the claim. Claims about personal data have their own cap of twice those fees. Neither cap applies to fees owed, to fraud or wilful misconduct, or to the indemnities below.

  • The Company covers CertiFlyers against claims about people's data it had no right to give us. CertiFlyers covers the Company against claims that its courses infringe someone else's rights.

  • We may suspend a Company that breaks these terms, or that has not paid 7 days after a failed renewal (section 7), and we tell its managers why unless the law or a security reason prevents it.

  • The Company can stop at any time (sections 6 and 8).

  • Sections 12, 13, 15, 17 and 19 and the Data processing agreement continue after the Company stops using CertiFlyers.

These terms are governed by the laws of the State of Nevada, USA, and disputes go to the state and federal courts in Clark County, Nevada, as in the Terms of use (section 9).

We may update these terms. For significant changes we email every manager at least 30 days before they take effect. A Company on a paid year keeps the version it accepted until its next renewal, except for changes the law requires. We record which version each Company accepted.

We send notices to the Company by email to its managers. The Company sends notices to support@certiflyers.com, or by post to CertiFlyers LLC, 4730 S. Fort Apache Rd, Suite 300, Las Vegas, NV 89147.

This agreement is between CertiFlyers LLC and the Company, and is part of the Company terms. It covers the personal data about the Company's people that CertiFlyers handles for the Company.

  • For the training the Company organises (its people's places in the Company, teams and roles, invitations, the courses it assigns, their progress and quiz results, the team record, and the delivery status of its emails), the Company is the controller and CertiFlyers the processor. Under US state privacy laws, the Company is the business and CertiFlyers its service provider.

  • CertiFlyers is responsible on its own account for each person's own account and sign-in, their certificates and the check pages (which stay with the person), their own purchases, billing and tax records, and security logs.

  • People: the Company's managers, QA reviewers, team leads and technicians, and the people it invites. The trial's sample technicians are made up and are not people.

  • Data: name; email address (none for technicians on a sign-in card); team and role; invitation dates and status; courses assigned, progress and quiz results; certificate numbers, issue and expiry dates; whether each email was sent, delivered or bounced (kept 90 days); and the log of actions taken on the Company's account.

  • Not collected: phone numbers, IP addresses on sign-ins, card numbers (Stripe holds them), whether an email was opened, and sensitive data such as health information.

  • Purpose: giving the Company and its people the training service, support, security and billing.

  • Duration: while the Company uses CertiFlyers, then as section 9.

  • Handles the data only on the Company's instructions: these terms and the choices its managers make in the hub, unless the law requires otherwise, in which case we tell the Company first unless the law forbids it.

  • Does not sell the data, use it for advertising, or use it to train AI models.

  • Makes sure everyone at CertiFlyers who can access the data is bound to keep it confidential. Staff access a Company's account only to support it, with a reason, recorded in a log that cannot be edited.

  • Helps the Company, as far as it reasonably can, with requests from people (section 8), with security, with breach notices, and with any impact assessment the law requires.

CertiFlyers keeps the security measures in Annex A, at the end of this agreement. We keep them up to date and never make them weaker during the Company's term.

If CertiFlyers becomes aware of a breach affecting the Company's data, we tell the Company's managers without undue delay, and within 72 hours, with what we know: what happened, which data and people are affected, what we have done and will do, and who to contact. We add to it as we learn more.

The Company agrees that CertiFlyers uses these providers, each bound by a contract that limits it to its service and protects the data at least as this agreement does. They are the providers in the Privacy policy (section 4); all are in the United States.

  • Google Cloud: hosting, database and file storage. All the data.

  • Postmark: sending email. Email addresses and the emails we send.

  • Stripe: card payments. The buyer's payment and billing details; none of the people's training data.

  • Sentry: error reports, with a person's internal user number and account type.

  • OpenAI: the course assistant. The question a person types, with the course's content; never their name or email address.

  • Anthropic: the help desk's automatic first answer, once it is switched on. The question typed and what is needed from the person's own account to answer it.

  • Apple and Google: only when a person chooses to sign in with them.

We email every manager at least 30 days before adding or replacing a subprocessor, saying who it is and what it does.

Where the Company's people's data is covered by EU or UK data-protection law, the Company may object to the change within those 30 days, giving its reasons. We discuss the objection in good faith; if we cannot address it, the Company may end these terms before the change applies to its data. CertiFlyers stays fully responsible to the Company for each subprocessor's handling of the data.

The data is stored in the United States. For people in the EU, the UK or Switzerland, CertiFlyers and the Company use the European Commission's standard contractual clauses (controller to processor), with the UK addendum and the changes Switzerland requires, as the Privacy policy says, and CertiFlyers has the same protection in place with its subprocessors. Where a subprocessor is certified under the EU-US Data Privacy Framework (and its UK and Swiss extensions), CertiFlyers also relies on that certification.

  • People can see and correct their own details in their account, and delete their account, as the Privacy policy says.

  • If CertiFlyers receives a request about data the Company controls, we pass it to the Company without undue delay and do not answer it ourselves unless the Company asks us to. Requests about a person's own account or certificates we answer ourselves.

  • We help the Company answer requests, for example by exporting a person's training record.

  • When someone leaves: their place in the Company ends. Their account and certificates stay theirs; the Company keeps the record of training done while they were with it (Company terms, section 11).

  • A trial that ended without a plan: the Company's record is deleted 90 days after the trial ended, with a notice to the managers 30 days before (Company terms, section 3).

  • When a Company closes its account: within 30 days of the request, CertiFlyers deletes the Company's data (places, teams, invitations, assignments, the team record and the action log), after giving the managers a chance to export the team record. We keep only what this agreement and the Privacy policy allow: people's own accounts and certificates, purchase records for 7 years as tax rules require, and backups until they are overwritten within 30 days.

  • Email delivery records: deleted after 90 days.

CertiFlyers gives the Company the information it reasonably needs to show this agreement is kept: this agreement, the security measures in Annex A, and answers to a reasonable security questionnaire once a year. An audit at CertiFlyers takes place only where the law requires it, with 30 days' notice, during business hours, under a confidentiality agreement and at the Company's cost.

On personal data, this agreement applies over the Company terms, and the Company terms apply over the Terms of use.

A Company that asks gets a copy of this agreement signed by CertiFlyers. The text is the same as the one accepted online.

What CertiFlyers does today:

  • The platform runs on Google Cloud in the United States, with Google's encryption of stored data; all traffic uses HTTPS.

  • Passwords are stored only as bcrypt hashes. Sign-in sessions and invitation links are stored only as hashes. A sign-in card's starting code is kept encrypted (AES-256-GCM) for 10 minutes at most and dropped once used.

  • Repeated wrong passwords or codes pause sign-in for 15 minutes after 5 tries.

  • Course files are served by short-lived links, only to people enrolled in the course.

  • Error reports leave out what people typed, sign-in headers and web-address details.

  • Backups are kept for up to 30 days, then overwritten.

  • Access to the servers is limited to named CertiFlyers people, and who has access is reviewed every 90 days.

  • Everyone at CertiFlyers with access to the data does security training once a year.

  • Every release is checked so that no source files or secret keys are published.