Information collected
Checkout is hosted by Stripe. 228 Aviation receives order identifiers, payment status, amount, purchased products, and the customer email needed for fulfillment; it does not store full payment card numbers. Lead forms store the email, requested resource, separate marketing-consent choice, and submission time. Contact forms store the submitted name, email, subject, message, and time.
Cookie-free product analytics
The site records product and page events, page path, optional product slug, referrer, UTM campaign fields, browser and device information, bot/scanner signals, approximate geography when a local GeoIP database is configured, and pseudonymous visitor and session hashes. Raw IP addresses are stored only in an encrypted security log, are visible only to authenticated administrators, and are deleted or nulled after 90 days. Hashed IP, visitor, session, event, and aggregate rollup records may be retained longer for trend history, abuse prevention, and funnel measurement.
How information is used
Information supports checkout, fulfillment, download recovery, customer support, opted-in update emails, fraud and abuse prevention, aggregate funnel measurement, and required business records. Marketing consent is not required for a free tool or purchase delivery.
CFI Workspace records
The CFI Workspace stores the sign-in email, optional display name and timezone, subscription status, recency-planning inputs, student labels, workflow checklist state, target dates, and notes. Use initials or an internal identifier instead of unnecessary student personal information. The workspace does not require a full pilot or instructor certificate number.
Service providers
Stripe processes checkout and workspace subscriptions. The configured SMTP provider sends transactional and opted-in email. Server infrastructure stores orders and entitlements. Each provider handles data under its own terms and security practices.
Retention and choices
Order, entitlement, subscription, and workspace records are retained to provide continuing access and maintain business records. Security and aggregate analytics are retained only as useful. You may request access, correction, marketing opt-out, or deletion where applicable through the contact page. Some transaction records may need to be retained for legal or accounting obligations.
Sensitive information
Do not send medical records, certificate numbers, logbook scans, payment card data, or other unnecessary sensitive information through site forms.