Check a certificate Sign out Book a demo

Privacy policy

Last updated October 26, 2026Applies to certiflyers.com and the CertiFlyers apps

What changed

  • If you sign up but never enter the code we email you, and the account has nothing in it (no purchase, course or certificate), we now delete it 30 days after the last code we sent.

CertiFlyers is an online training platform for aviation and workplace safety courses, run by CertiFlyers LLC, 4730 S. Fort Apache Rd, Suite 300, Las Vegas, NV 89147 ("CertiFlyers", "we", "us"). This policy explains what personal information we collect when you use certiflyers.com and the CertiFlyers apps for iPhone and Android, why we use it, who receives it, and the choices and rights you have.

There are two ways to use CertiFlyers, and they affect who is responsible for your information:

  • Individual learners create their own account and buy courses themselves. For them, CertiFlyers decides how personal information is used and is responsible for it.

  • Company accounts are run by a Manager who adds employees (company learners) and assigns them courses. The company decides whose information is entered and why, and is responsible for telling its employees; CertiFlyers processes that information on the company's behalf to provide the training. Questions about a company account can go to that company or to us.

We do not show advertising, we do not follow you across other websites, and we do not sell personal information. We count visits to certiflyers.com with Plausible Analytics, which sets no cookies and does not identify you (sections 2 and 4).

We collect only what the platform needs to run your account, your training and your purchases. We do not collect your phone number, your location (other than the approximate country of a website visit, below), your contacts or any health or biometric data.

  • Account — Email address, first and last name, a securely hashed password (none if you sign in with Google or Apple), your account type (individual learner, Manager or company learner), your company if you belong to one, and an optional profile photo. Comes from you, or your Manager when they add you; Google or Apple when you sign in with them.

  • Sign-in — Which sign-in method you use (email, Google or Apple) and the identifier that service gives us; if you hide your email with Sign in with Apple, we receive Apple's relay address instead. Comes from Google or Apple.

  • Sessions — A record for each device you are signed in on: a one-way fingerprint (hash) of the sign-in token (never the token itself), an optional device name, and when it was created, last used and expires. We do not store your IP address. Comes from your device.

  • Training — The courses you are enrolled in, your video progress, quiz attempts and scores, and the certificates you earn. Comes from your use of the courses.

  • Certificates — Certificate number, your name, the course, the issue and expiry dates, and the certificate files. Created by us when you pass a course.

  • AI course assistant — The questions you type to the assistant and its answers. Comes from you.

  • Feedback and support — Course ratings and comments you choose to leave; your name, email, subject and message when you contact support (also from people without an account). Comes from you.

  • Purchases — Which courses or plans you bought, the amount, whether you paid by card or with Apple Pay, and reference numbers from Stripe or Apple. We never receive or store your card details. Comes from Stripe (website) or Apple (iPhone app).

  • Account deletion — Your email, a one-time confirmation code and the scheduled deletion date while a deletion request is open. Comes from you.

  • Error reports — When an error happens, technical details of the error together with your internal user number and account type, but not your name, email, request contents or IP address. Comes from our systems.

  • Website visits — The address of the page you open, with certificate numbers, links from our emails and payment references removed; the website that sent you; your browser, operating system and type of device; and your approximate country. When you sign up or buy, the fact that it happened and, for a purchase, its amount. Never your name, email or account number. Comes from your browser, through Plausible (section 4).

  • Email requests — For the emails about new courses and Hangar Cards: your email address, and when you asked, confirmed and unsubscribed. Comes from you.

  • Demo requests — Your name, work email, company, role, team size and anything you ask us to prepare. Comes from you.

We use personal information only for the purposes below. If you are in the European Union or the United Kingdom, the legal basis we rely on follows each purpose.

  • Create and run your account, sign you in and keep you signed in on your devices. Information used: account, sign-in, sessions. Legal basis (EU and UK): performing our contract with you.

  • Deliver courses, track your progress and quizzes, and issue certificates. Information used: training, certificates. Legal basis (EU and UK): performing our contract with you; for company learners, the company's legitimate interest in training its staff.

  • Let Managers assign courses and see their learners' progress and certificates. Information used: account, training, certificates of that company's learners. Legal basis (EU and UK): the company's legitimate interest in training and documenting its staff.

  • Take payment and give access to what you bought, and handle refunds and disputes. Information used: purchases, account. Legal basis (EU and UK): performing our contract with you.

  • Answer questions through the AI course assistant. Information used: your typed questions. Legal basis (EU and UK): performing our contract with you.

  • Send service emails: welcome, password reset, course assigned, certificate about to expire, account deletion code. Information used: email, name, course names. Legal basis (EU and UK): performing our contract with you.

  • Answer support requests. Information used: support messages. Legal basis (EU and UK): our legitimate interest in helping people who contact us.

  • Keep the platform secure and fix errors. Information used: sessions, error reports. Legal basis (EU and UK): our legitimate interest in a secure, working service.

  • Keep records the law requires, such as payment records for tax. Information used: purchases. Legal basis (EU and UK): legal obligation.

  • Send the emails about new courses and Hangar Cards that you sign up for. Information used: email requests. Legal basis (EU and UK): your consent, which you can withdraw at any time with the unsubscribe link in every email.

  • Answer demo requests and set up the call. Information used: demo requests. Legal basis (EU and UK): our legitimate interest in answering people who ask us for a demo.

  • Count visits, sign-ups and sales, to see which pages help people and fix the ones that don't. Information used: website visits. Legal basis (EU and UK): our legitimate interest in understanding how the website is used, without identifying anyone.

  • Keep the email forms free of spam. Information used: the IP address a form is sent from, held in memory for one hour and never saved with your request. Legal basis (EU and UK): our legitimate interest in a secure, working service.

The only marketing emails we send are the emails about new courses and Hangar Cards that you ask for. We do not use your information for advertising and we do not build marketing profiles. The only automatic decision is that passing a course quiz, at the pass mark shown in the course, issues a certificate; if you think a result is wrong, contact us and a person will look at it.

We share personal information only with the service providers that run parts of CertiFlyers for us, under contracts that limit them to providing that service, and in the cases below. All of these providers are based in the United States, except Plausible, which is based in the European Union.

  • Google Cloud — Receives all the information in this policy, stored on our servers, database and file storage. Why: hosting the platform.

  • Stripe — Receives the payment details and billing address you enter on Stripe's checkout page, and our reference for the purchase. Why: taking payments on the website and calculating sales tax or VAT.

  • Apple — When you sign in with Apple or buy in the iPhone app: receives the sign-in details Apple returns, an anonymous account reference we attach to purchases, and the purchase details. Why: Sign in with Apple and iPhone in-app purchases.

  • Google (sign-in) — Receives the sign-in details Google returns when you choose Sign in with Google. Why: Sign in with Google.

  • OpenAI — Receives the question you type to the AI course assistant, together with that course's content; never your name or email. Why: generating the assistant's answer.

  • AssemblyAI — Receives course videos, to make transcripts; no information about you. Why: course content.

  • Postmark — Receives your email address and the content of the emails we send you, including the emails about new courses and Hangar Cards that you ask for, and the demo requests we pass to our support inbox. Why: sending email.

  • Sentry — Receives error reports with your internal user number and account type, when error tracking is switched on. Why: finding and fixing errors.

  • Plausible Analytics — Receives the website visit details in section 2. It also receives your IP address and browser details, which it uses only to estimate your country and to count each visitor once a day. It does not store them, and the count starts again every day, so you are not recognized on later visits. Never your name, email or account number. Based in Estonia, with its data stored in the EU. Why: counting visits, sign-ups and sales.

  • Microsoft 365 — Hosts the support@certiflyers.com inbox. Receives what you send us there, and your Book a demo request: the details you give in the form. Based in the United States. Why: answering you and arranging your demo.

  • Google Meet and Google Calendar — If you book a demo, receive your name and email in the invitation, and your image and voice during the call if you turn them on. We don't record demo calls. Based in the United States. Why: holding the demo.

Other people who may see your information:

  • Your company. If you are a company learner, your company's Managers can see your name, email, assigned courses, progress, quiz results and certificates.

  • Apple, if you pay with Apple Pay. On Stripe's checkout page you can pay by card or, on an Apple device, with Apple Pay. If you choose Apple Pay, Apple handles the payment details in your Apple Wallet under its own terms and privacy policy.

  • Anyone you show a certificate to. See section 5.

  • Authorities and advisers, when the law requires it or to protect our rights, and a buyer or successor if CertiFlyers is sold or merged, who would remain bound by this policy.

Certificates. When you pass a course we issue a certificate showing your name, the course, a certificate number, and the issue and expiry dates. Each certificate carries a QR code that opens a public verification page, so an employer or auditor can check it; anyone who has the QR code or the link, or who enters the certificate number together with the learner's last name on our check page, can see that certificate's status (valid, expired or revoked) and the learner's name, the course, the certificate number and its issue and expiry dates. The verification page does not show your quiz score. The certificate files themselves are stored privately and can be opened only by you, your company's Managers (for company learners) and our administrators, through links that expire after a short time.

A certificate can be revoked if the purchase it depends on is refunded or reversed, or if it was issued in error. Your training record stays and the verification page then shows "revoked".

AI course assistant. If you ask the course assistant a question, we send your question and the course's content to OpenAI to generate the answer; we do not send your name or email. We keep the question and the answer for one day so the conversation can continue, then delete them; OpenAI's own handling of the request is governed by its API terms. Please do not type personal or sensitive information into the assistant.

Website. certiflyers.com does not set cookies and uses no advertising trackers. Plausible, which counts visits, stores nothing on your device. To keep you signed in, it stores your sign-in tokens, a copy of your basic profile (name, email, account type, photo) and your light or dark display choice in your browser's local storage. These are needed for the site to work, and the sign-in items are removed when you sign out.

Apps. The iPhone and Android apps keep your sign-in tokens and basic profile in the phone's secure storage, plus two settings for unlocking the app with Face ID, Touch ID or your fingerprint. Biometric unlock is handled entirely by your phone: we never receive or store your face or fingerprint. Sign-in items are removed when you sign out.

  • Sign-in sessions — Until you sign out on that device or 30 days after you signed in on it, then deleted the next day.

  • AI course assistant questions and answers — 1 day.

  • Account, training records and certificates — While your account is open. After it is closed, completed training records and certificates are kept so that you or your employer can still prove the training, until you ask us to delete them.

  • Accounts that are never confirmed — If you sign up but never enter the code we email you, and the account has nothing in it (no purchase, course or certificate), we delete it 30 days after the last code we sent.

  • Purchase records — 7 years after the purchase, as tax and accounting rules require (10 years for sales on which EU VAT was charged).

  • Support messages — While the request is open, then one year after it is resolved.

  • Account deletion requests — Until the deletion is complete.

  • Error reports — 30 days in Sentry (90 days if we move to a paid Sentry plan).

  • Backups — Up to 30 days, then overwritten.

  • Emails about new courses and Hangar Cards — Until you unsubscribe, then deleted within 30 days. An address that is never confirmed is deleted after 7 days.

  • Demo requests — One year after our last contact about the request, then deleted.

  • Website visit statistics — Kept by Plausible while our account is open. They hold no IP address, cookie or other identifier.

  • Spam checks — IP addresses for one hour, in memory only.

Deleting your account. You can delete your account from your account settings on the website or in the app, or by writing to support@certiflyers.com. We email you a confirmation code; once confirmed, the account is deleted straight away, or at the end of the period you have already paid for if you have an active plan. Deletion removes your profile, photo, AI assistant history and any course you have not completed. We keep your completed training records and certificates, which show your name, so that you or your employer can still prove the training, unless you ask us to delete them as well; and we keep purchase records for the period above. Both are then used only for those purposes.

Where it is stored. CertiFlyers runs on Google Cloud in the United States, and the providers in section 4 are US-based, except Plausible, which is based in the EU and keeps its data there. If you are in the EU or the UK, your information is therefore transferred to the United States; we rely on the European Commission's standard contractual clauses, with the UK addendum and the changes Switzerland requires, to protect it.

How we protect it. All connections use HTTPS. Passwords are stored only as secure one-way hashes. Course files, photos and certificates are kept in private storage and opened only through links that expire after a short time, and only for people allowed to see them. You can sign out any device, which ends its access at once. Access to our systems is limited to the people who run them. No system is perfectly secure, so please tell us at support@certiflyers.com if you think your account has been misused.

Everyone. You can see and correct your profile in your account settings, download your certificates, and delete your account at any time. Every email about new courses and Hangar Cards has an unsubscribe link that works in one click, without signing in. You can also write to us at support@certiflyers.com to ask for a copy of the personal information we hold about you, or to have it corrected or deleted. We typically answer within 7 days, and always within the time the law allows (one month in the EU and UK); we may need to confirm your identity first. Company learners can also ask their company, which controls the account.

EU and UK. You also have the right to restrict or object to our use of your information, to receive it in a portable format, and to complain to your data protection authority (in the UK, the Information Commissioner's Office). Where we rely on legitimate interests, you can object, and we will stop unless we have strong grounds to continue.

US states. Depending on where you live, state law may give you the right to know what personal information we collect and how we use it, to correct it, to delete it and to receive a copy, without being treated differently for asking. We do not sell personal information and we do not share it for targeted advertising. To make a request, write to support@certiflyers.com; you may use an authorized agent.

CertiFlyers is workplace training and is not meant for anyone under 16. We do not knowingly collect information from children; if you believe a child has created an account, tell us and we will delete it.

If we change this policy we will update the date at the top, and for significant changes we will tell signed-in users by email or in the website and apps before the change takes effect.

CertiFlyers LLC, 4730 S. Fort Apache Rd, Suite 300, Las Vegas, NV 89147. Email: support@certiflyers.com.