1. Who operates this website
De Bond Aviation LLC operates debondaviation.com. This policy covers the public portfolio, contact form, optional live map, and administrator area. For privacy questions or requests, email petrriann@debondaviation.com.
2. When you get in touch
The contact form collects your first and last name, email address, optional phone number, reason for contacting us, and message. We use these details to respond, discuss instruction or other services you request, and keep relevant correspondence. Sending an inquiry does not subscribe you to a marketing list.
Messages pass through AWS hosting and the Resend email-delivery service to our Zoho mailbox. Your email is set as the reply address. The form does not create a visitor account or store contact-message contents in a Supabase database.
After the service confirms acceptance for delivery, the form clears its personal fields and in-memory submission details. If sending fails or the result is uncertain, details remain on the current page so you can retry safely. This does not delete an email already sent. Please do not submit identity documents, payment details, medical information, or other sensitive records through this form.
Appointment booking with Cal.com
The dedicated booking page loads the Cal.com calendar automatically when you visit it. In the Socials section and on the contact page, the calendar loads only after you select Book an appointment. Booking is separate from the map preference: you can book with the map turned off, and the calendar does not request browser location or enable the map.
Once opened, Cal.com receives connection information such as your IP address and browser details and may use cookies or browser storage for preferences and security. It processes the name, email, time zone, selected appointment, and any other booking answers you provide to arrange the appointment with us. Details may also pass to calendar, meeting, or notification services configured for that appointment. If the appointment requires payment, payment details are handled by the payment provider shown in the booking flow, not by this website’s contact form. We do not copy your contact-form entries into Cal.com.
Leaving the booking page or closing a calendar popup removes the embedded page; it does not cancel a completed booking or erase information already received by Cal.com. Booking records and related calendar or email copies are separate from our contact-form security records and do not use that form’s deletion timers. Contact us about access, correction, cancellation, or deletion. See Cal.com’s privacy policy for its processing and retention practices. You can also use the contact form without opening the calendar. Payments with Stripe: Payment requests and optional saved-card setup open a Stripe-hosted page. Stripe processes payment, billing and connection information and may use cookies or browser storage to provide checkout and security. Authorized website Owners can view client names, email addresses, payment amounts and status, and masked saved-card details such as the card brand, last four digits and expiry. Full card numbers and security codes are handled by Stripe and are not shown in our dashboard. For repeat training, saving a card is optional and requires the client to authorize future one-time charges. Saving a card does not create a subscription; future charges still require the client’s authorization. Contact petrriann@debondaviation.com to withdraw future-charge authorization or ask about payment records. Withdrawal does not reverse an already completed payment. Billing and payment records are retained as needed for billing, refunds, accounting and dispute handling. They are separate from contact-form security records, visitor analytics and website history, and are not deleted by those automatic retention timers. See Stripe’s privacy policy for its processing and retention practices.
3. The optional live map and your location
Choosing Accept in Cookies & privacy enables the map and requests browser location. Choosing Decline keeps the map off, with no map-provider or aircraft-feed requests. You can enable it later with View live flights, which explains the same optional processing. Loading connects your browser to external providers for map software, styles, tiles, and fonts. These providers receive ordinary connection information such as your IP address and the map region requested.
Your browser controls location permission. If granted, a one-time location reading centers nearby flights; if declined or unavailable, the world view opens. There is no continuous background location watch and no notification permission request. On later visits with a saved acceptance, the map starts as it approaches the screen, reusing location only if the browser reports permission already granted. Otherwise it opens the world view without another prompt; Use my location lets you request location yourself.
Coordinates are used in the page’s temporary state, not saved in the site’s browser preference or attached to contact messages. However, map requests indicate the area you view, and rounded traffic-search regions pass through AWS to aircraft-data providers. A map centered near you can therefore reveal your approximate area; we do not promise that all location-related information stays on your device. Our traffic service does not forward your IP address to aircraft-data providers.
You can turn the map off in . This stops future map activity and releases the page’s map state; it cannot undo requests already processed by providers. Revoke location permission separately in your browser’s site settings if desired. Live map sessions pause after five minutes and can be resumed.
5. Administrator accounts
The restricted administration area uses Supabase for account authentication and content administration. It processes administrator email addresses, authentication information, access requests, assigned roles, and administration records. Essential browser local storage keeps an administrator’s authenticated session. Optional map choices do not disable sign-in security. These accounts are separate from the public contact form.
6. Providers, security, and processing locations
- AWS: website and API hosting, content delivery, encrypted server configuration, contact-form security metadata, and private request logs and visitor reports.
- Resend and Zoho: delivery of contact and account emails, and mailbox handling of correspondence.
- Cal.com: the optional appointment calendar, booking details, and appointment-related notifications and configured integrations.
- Supabase: administrator authentication, content-management records, and related backend services.
- unpkg and OpenFreeMap: optional map-library assets, map styles, tiles, and fonts, using underlying OpenStreetMap and OpenMapTiles data.
- ADSB.fi, ADSB.lol, and OpenSky Network: aircraft data used by the live traffic service. Contact-form details are not sent to these services.
These providers may process information in the United States and other countries where they operate. Their retention and security practices also apply to their processing. We use encrypted connections, restricted administrative access, and anti-abuse controls, but no website or email system can guarantee absolute security.
We may also disclose information when required by applicable law or reasonably necessary to protect the service, respond to abuse, or establish or defend legal claims. We do not sell contact-form information or use it for targeted advertising.
7. How long information is kept
Correspondence: inquiries and emails may be retained for more than 12 months when needed for customer relationships, business records, safety, or legal obligations. De Bond Aviation LLC periodically reviews retained correspondence and removes information that is no longer needed, subject to those obligations. This is a mailbox-management process, not an automatic deletion timer on the website.
Contact-form protection: AWS stores submission identifiers, keyed hashes (HMAC fingerprints), counters, and delivery state to limit abuse and prevent duplicate sends. These are pseudonymous security records, not categorically anonymous data. They do not contain the form’s message, name, email, or raw IP address.
- Challenge-use records: an expiry of approximately 31 minutes.
- Hashed-IP hourly counters: a two-hour expiry.
- Daily sending counters: a two-day expiry.
- Submission security metadata: a 30-day expiry.
- Contact Lambda runtime logs: configured for seven-day retention; application code does not log message bodies or raw contact details.
Database expiry cleanup is asynchronous, so records can remain after their expiry time. Provider delivery records, mailbox copies, backups, infrastructure logs, and administrator records are separate; the periods above do not promise automatic deletion from every provider. Contact us about a particular record or deletion request. Administrator history retention: Routine administrator activity and draft revisions: 90 days, with at least the latest 20 activity records and latest 20 revisions per content entry retained. Access, role, publishing, restoration and other security-related activity: 365 days. Successful website versions: 90 days, excluding the current live version, latest five published versions, active work and protected recovery versions. Failed versions and resolved owner-alert delivery metadata: at least 30 days after a recorded terminal transition or resolution, with no active build, lease or retry remaining. Completed maintenance-job runs and old owner-alert daily counters: seven days; compact maintenance summaries: 30 days. Today's sending limit and active or unrelated jobs are preserved. Current content, drafts, accounts, access decisions, media, unresolved-request deduplication and retained-version references are not automatically deleted. This does not automatically delete Zoho correspondence, Resend provider records, S3 images or backups. Visitor analytics retention: Detailed visitor and request records are retained for 30 days and then scheduled for deletion from the private S3 analytics folders, including old object versions. Deletion and log delivery are asynchronous, so a short processing grace period can occur. IP-free summaries of page views, distinct IP-based visitor counts, popular pages, referring hostnames, and countries can be retained longer for yearly and all-time reports. An IP address is counted once within a reporting period while its complete visit records are retained. After those records expire, longer-term distinct visitor totals use compact statistical aggregates and are estimates. Repeated page views do not count as additional visitors within the same period. These counts represent network addresses, not identified people; shared networks, VPNs, and changing addresses affect accuracy. The long-term aggregates do not retain lists of IP addresses or address hashes. Only website Owners can open individual visit records; IP addresses are masked by default and require an explicit reveal to view in full. This analytics cleanup does not delete website content, photographs, administrator accounts, or correspondence.
8. Your choices and privacy requests
You may browse without enabling the map, decline location permission, omit the optional phone field, or contact us directly by email. Use Privacy settings to change a saved map choice; use your browser settings to manage site storage and location permission.
Depending on the laws that apply to you, you may have rights to access, correct, delete, or receive your personal information, restrict or object to certain processing, or complain to a relevant privacy authority. Email petrriann@debondaviation.com with your request. We may reasonably verify your identity and ask which information you mean before responding. Rights can be subject to legal exceptions and recordkeeping requirements; we will explain any applicable limitation.
9. Young visitors
Flight instruction may involve young people, but this website does not provide a children's account service. Parents or guardians may contact us about instruction or information relating to a child. Please do not send sensitive information about children through the contact form. If you believe a child has supplied personal information without appropriate involvement or permission, contact us so we can review the situation and take appropriate action.
10. Updates to this policy
We may update this policy when features or practices change. The date above identifies the current version. If a change requires a new choice or notice under applicable rules, we will provide it rather than treating an old map preference as permission for an unrelated use.