Privacy Policy

Evolve Orbit FZC ("we," "us," or "our") is a UAE Free Zone company that develops and operates EZ OPUS (Operational Planning & Utilisation System), a web-based platform for airline workforce planning, pilot pipeline management, roster optimization, and shortage prediction.

Our services are accessible at ezopus.com. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform.

We collect information that you provide directly to us, information we obtain automatically when you use our services, and information from third-party sources.

2.1 Account Information

When you register for an EZ OPUS account, we collect:

• Name and email address
• Organization name and details
• Job title and role
• Password (stored encrypted via Supabase Auth)
• Billing information (processed securely via Stripe)

2.2 Organization & Workforce Data

To provide workforce planning and roster optimization services, we collect and process:

• Pilot and crew member records (names, employee IDs, seniority, qualifications, training status)
• Training pipeline data
• Fleet planning information
• Roster and scheduling data
• Shortage forecasts and alerts
• Custom organizational settings and configurations

All workforce data is isolated by workspace and protected by row-level security policies.

2.3 Usage Data

We automatically collect information about your use of the platform:

• Log data (IP address, browser type, operating system)
• Pages visited and features used
• Time spent on pages and interaction patterns
• Referring URLs and search terms

2.4 Cookies & Analytics

We use cookies and similar tracking technologies, including:

• Essential cookies: Required for authentication and security
• Analytics cookies: Google Analytics GA4 to understand usage patterns and improve our services
• Preference cookies: To remember your settings and preferences

We use the information we collect to:

• Provide our services: Deliver workforce planning, roster optimization, Monte Carlo forecasting, and other platform features
• Process payments: Handle subscription billing and seat-based licensing via Stripe
• Authenticate users: Manage account access and security via Supabase Auth
• Communicate with you: Send service updates, technical notices, security alerts, and support messages
• Improve our platform: Analyze usage patterns to enhance features and user experience
• Ensure security: Detect and prevent fraud, abuse, and unauthorized access
• Comply with legal obligations: Meet regulatory requirements and respond to lawful requests

We process your personal data under the following legal bases:

• Contractual necessity: To perform our obligations under the terms of service and deliver the platform to you
• Legitimate interests: To improve our services, ensure security, and communicate important updates
• Consent: Where you have explicitly consented to specific data processing activities (e.g., marketing communications)
• Legal compliance: To comply with applicable laws and regulations

We share your information only in the following circumstances:

5.1 Service Providers

We use trusted third-party service providers to operate our platform:

• Supabase: Database hosting and authentication (PostgreSQL with row-level security)
• Vercel: Platform hosting and infrastructure
• Stripe: Payment processing for seat-based licensing
• Google Analytics: Usage analytics (GA4)

5.2 Data Integrations

If you enable integrations, we may access and process data from:

• Google Sheets: Bidirectional sync of pilot roster data (only when you authorize the connection)
• Other external data sources: As configured by your organization's administrators

5.3 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., court orders, subpoenas).

5.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. We will notify you of any such change.

We do NOT sell or rent your personal data to third parties.

We retain your information for as long as necessary to provide our services and fulfill the purposes outlined in this Privacy Policy:

• Account data: Retained while your account is active and for a reasonable period thereafter
• Workforce data: Retained according to your organization's settings and legal requirements
• Usage logs: Typically retained for 12-24 months for security and analytics purposes
• Billing records: Retained as required by tax and financial regulations (typically 7 years)

You may request deletion of your data at any time by contacting us at support@evolveorbit.com.

We implement industry-standard security measures to protect your information:

• Encryption: Data in transit (TLS/SSL) and at rest (AES-256)
• Row-level security (RLS): Database policies enforce workspace-level data isolation
• Multi-tenancy isolation: Each organization's data is completely isolated from others
• Authentication: Secure authentication via Supabase Auth with password hashing
• Access controls: Role-based permissions and least-privilege access
• Regular backups: Automated database backups and disaster recovery procedures
• Security monitoring: Continuous monitoring for suspicious activity and security threats

While we strive to protect your information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate or incomplete data
• Erasure: Request deletion of your personal data (subject to legal obligations)
• Portability: Receive your data in a structured, machine-readable format
• Restriction: Request restriction of processing in certain circumstances
• Objection: Object to processing based on legitimate interests
• Withdraw consent: Withdraw consent for processing based on consent (without affecting prior processing)

To exercise these rights, please contact us at support@evolveorbit.com. We will respond to your request within 30 days.

EZ OPUS is operated from the United Arab Emirates. Our service providers (Supabase, Vercel, Stripe, Google) may process data in various locations worldwide, including the United States and European Union.

When we transfer personal data outside the UAE, we ensure appropriate safeguards are in place, such as:

• Standard contractual clauses approved by relevant data protection authorities
• Adequacy decisions by competent authorities
• Compliance with applicable data protection frameworks (e.g., GDPR, UAE PDPL)

EZ OPUS is not directed at individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal data from a child under 16 without parental consent, we will take steps to delete that information.

If you believe we have collected information from a child under 16, please contact us immediately at support@evolveorbit.com.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by:

• Posting the updated policy on our website with a new "Last updated" date
• Sending an email notification to your registered email address
• Displaying a prominent notice on the platform

Your continued use of EZ OPUS after the effective date of the updated Privacy Policy constitutes acceptance of the changes.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: