Privacy Policy
Amhage Technology Group LLC (“Amhage”, “we”) operates AeryxIQ™. This policy explains what we collect, why, who else processes it, and what you can ask us to do about it. Short version: we collect the minimum needed to run the Service, we do not sell anything, and your imagery belongs to you.
1. What we collect
| Category | Examples | Why |
|---|---|---|
| Account data | Organization name, your name, work email, hashed password, role, sign-in timestamps, IP address of security-relevant events | To create your workspace, authenticate you, and protect accounts |
| Customer Data | Uploaded imagery and video, EXIF metadata including capture time and GPS coordinates, findings, annotations, voice dictation clips and transcripts, reports, elevation models | To provide the Service — this is the product |
| Billing data | Plan, subscription status, Stripe customer and subscription identifiers | To operate subscriptions. We never see or store full card numbers — Stripe handles payment details directly |
| Operational logs | Chain-of-custody events (upload, grade, seal, share, acknowledge) with the acting user and timestamp; server error logs | Evidence integrity, security, and debugging |
We do not use advertising trackers, third-party analytics scripts, or cross-site cookies. The application uses a single browser storage entry to hold your session token. Our marketing site sets no cookies.
2. Location data in imagery
Drone imagery routinely carries precise GPS coordinates, and may incidentally capture people, vehicles, and private property. That material is Customer Data: you control it, you decide who in your workspace sees it, and you are responsible for having the right to collect it under the aviation, privacy, and surveillance laws that apply where you fly. Consider your own retention rules before uploading imagery of people.
3. How we use data
- To operate, secure, and support the Service.
- To process payments and manage subscriptions.
- To send service messages: welcome and password-reset emails, and critical-finding alerts to workspace administrators. (These send only when an email provider is configured for the platform.)
- To investigate abuse, fraud, or security incidents.
- To improve the Service in aggregate — for example, counting how often a feature is used. This never involves exposing one customer’s content to another.
We do not sell personal information or Customer Data, and we do not share it for cross-context behavioural advertising. We do not use Customer Data to train machine-learning models for other customers.
4. Who else processes data (sub-processors)
| Provider | Purpose | Data reaching them |
|---|---|---|
| Amazon Web Services | Hosting, storage, DNS (US East, Ohio) | All Service data at rest and in transit |
| Stripe, Inc. | Payments and subscriptions | Billing contact email, plan, payment details you enter on Stripe’s own page |
| Email delivery provider | Transactional email, when configured | Recipient address and message content |
| Speech-to-text provider | Dictation transcription, when enabled | The audio clip submitted for transcription |
Server-side transcription is off by default. When it is off, dictation is transcribed by your own browser or stored as audio only, and no clip leaves our infrastructure. We will update this page before adding a sub-processor that receives Customer Data.
We may also disclose data if legally required, to protect rights and safety, or in connection with a merger or acquisition — in which case this policy continues to apply until replaced with notice.
5. Security
- HTTPS everywhere, with certificates renewed automatically.
- Passwords stored using the Argon2 hashing algorithm — never in plain text.
- Strict tenant isolation: every query is scoped to your organization, and a request for another tenant’s record returns “not found”, never a permissions hint.
- Role-based access within a workspace, plus account lockout after repeated failed sign-ins.
- SHA-256 fingerprints on every stored evidence object.
- Encrypted nightly backups of the database and media, rotated on a 14-day cycle.
- The full platform is re-verified on each release by an automated end-to-end audit that includes tenant-isolation checks.
No system is perfectly secure. If we discover a breach affecting your data, we will notify affected workspace administrators without undue delay.
6. Retention
- Customer Data is kept while your workspace exists — including through a read-only expired trial, so nothing is lost if you pause.
- On a deletion request, we remove the workspace and its Customer Data from live systems promptly, and from backups within the 14-day backup rotation.
- Chain-of-custody and billing records may be retained where required for legal, accounting, or evidentiary purposes.
7. Your rights
Depending on where you live — including under the GDPR in the EEA/UK and the CCPA/CPRA in California — you may have the right to access, correct, delete, restrict, or port your personal data, to object to processing, and not to be discriminated against for exercising these rights. Because we do not sell personal information or use it for cross-context behavioural advertising, there is nothing to opt out of in that respect.
Much of this is self-service: administrators can view, edit, export, and remove data inside the workspace. For anything else, write to the address below. We respond within 30 days and do not charge for reasonable requests. If you are an end user whose data was uploaded by a customer, contact that customer first — for their Customer Data we act as a processor on their instructions.
8. International transfers
The Service is hosted in the United States. If you use it from outside the US, your data is transferred to and processed in the US, where privacy laws differ from your own. By using the Service you understand this transfer occurs.
9. Children
The Service is a business tool and is not directed to anyone under 18. We do not knowingly collect personal information from children.
10. Changes
We will post updates here with a new effective date, and notify workspace administrators of material changes where email is configured.
11. Contact
Privacy questions and data requests:
Amhage Technology Group LLC · Rochester, New York, USA
michael.romansky@new.oxon.org