AINautics University Learning Platform  |  www.ainauticsuniversity.com  |  including Student Data Privacy Commitments for Schools and Districts

Plain-language summary

Part A — Privacy Policy for All Users

A1. Who we are and what this Policy covers

AINautics, LLC (“AINautics,” “we,” “us”) operates AINautics University, an online training platform for FAA Part 107 remote-pilot certification, unmanned aircraft systems, and related drone, AI and robotics workforce courses at www.ainauticsuniversity.com (the “Platform”). This Policy explains what information we collect, how we use and protect it, and the choices people have. It covers two kinds of users:

• Individual Users — adults who create an account and purchase a course for themselves.
• School Users — students, teachers and administrators who use the Platform through a school, district or workforce program that has engaged AINautics (a “School”). School Users are covered by Part A and by the additional commitments in Part B.

A2. Definitions

A3. Information we collect

What we do not collect from students. School student accounts are created with the minimum information needed to run the course. We do not ask students for, and the Platform has no field for:

• date of birth, home address, telephone number, or photographs, video or audio recordings of the student;
• student ID numbers, Social Security numbers, government ID numbers, or FAA Tracking Numbers (FTN) and IACRA credentials (students register for the FAA knowledge test directly with the FAA and the testing center, not through the Platform);
• parent or guardian names or contact details;
• grades, attendance, discipline, health, disability, special-education, free-and-reduced-lunch or other records from the School’s student information system;
• precise geolocation, biometric identifiers, or information from the student’s other apps or accounts.

We recommend that Schools have students register with a school-issued email address or a username rather than a personal email address.

A4. How we use information

• To create and secure accounts, deliver course content, record progress, score quizzes and practice tests, and issue certificates of completion.
• To report a School User’s enrollment, progress, scores and completions to that student’s teacher of record and the School.
• To respond to support requests and accessibility accommodation requests.
• To keep the Platform secure: detecting and preventing unauthorized access, abuse and fraud, and investigating security incidents.
• To meet legal obligations and enforce our Terms and Conditions.
• For Individual Users only: to process payments and, with consent, to send course announcements that the user can opt out of at any time.

Student Data is used solely to provide the educational service the School has requested. We do not use Student Data for product development, research, benchmarking or to train artificial-intelligence models, except for De-identified Data and only where the School has authorized that use in writing.

A5. What we never do

• We do not sell, rent or trade Personal Information, and we never sell Student Data.
• We do not show advertising on the Platform, and we do not use Student Data for targeted advertising, retargeting or behavioral profiling.
• We do not mine or scan Student Data or student work for advertising or marketing purposes.
• We do not market or send commercial solicitations to students or their parents, and we do not use information obtained from a public body for commercial solicitation (S.C. Code Ann. § 30-2-50).
• We do not build a profile of a student for any purpose other than the educational service requested by the School.
• We do not store or process Student Data outside the United States, and AINautics staff access it only from within the United States.
• We do not attempt to re-identify De-identified Data, and we do not permit anyone else to do so.
• We do not keep Student Data after the School asks us to return or delete it (Section B6).

A6. Cookies and similar technologies

The Platform uses first-party cookies that are strictly necessary to operate: a session cookie that keeps a user signed in, security cookies that protect against forged requests, and a “remember me” cookie if the user selects it. We do not use advertising networks, social-media pixels or cross-site trackers. If website analytics are used on our public marketing pages, they are configured to report aggregate traffic statistics only and are not used to target advertising to any user or to track students across other sites. Users can clear or block cookies in their browser; blocking the session cookie will prevent signing in.

A7. How we share information

We share Personal Information only with the parties below, only for the purposes described, and under written agreements that require confidentiality and security protections at least as strong as this Policy.

We may also disclose Personal Information:

• to comply with a subpoena, court order or other legal process—after notifying the affected School so it can seek protective measures, unless the law prohibits notice;
• to protect the health or safety of a student or others in an emergency, as permitted by FERPA (34 CFR § 99.36) and the School’s District Agreement;
• in connection with a merger, acquisition or sale of AINautics’ business—in which case we will notify affected Schools in advance, obtain any consent a District Agreement requires, bind the successor to this Policy and that agreement, and allow a School to terminate and have its Student Data deleted before the transfer;
• with a School’s written direction.

We add or replace a Subprocessor that will access Student Data only after giving affected Schools notice, and only with a School’s advance written approval where its District Agreement requires it. A current Subprocessor list is available to any School on request.

A8. How we protect information

We use administrative, technical and physical safeguards appropriate to the sensitivity of the information, including:

A9. Children

AINautics University serves middle-school, high-school, post-secondary and adult learners (the FAA requires a candidate to be at least 16 to take the Part 107 knowledge test). Individual Users must be at least 18 or have a parent or guardian create and supervise the account. Children under 13 may use the Platform only through a School program. In that setting the School acts as the parent’s agent and provides consent for the collection of the child’s information for educational purposes, as permitted by the Children’s Online Privacy Protection Act (COPPA, 15 U.S.C. §§ 6501–6506; 16 CFR Part 312). We collect from children only what the educational service requires, never use it for commercial purposes, and will provide the School (and, through the School, parents) a description of the information collected, an opportunity to review it, and the ability to have it deleted.

A10. Your choices and rights

• Individual Users can review and update their account information from their dashboard, unsubscribe from marketing email with one click, and ask us to delete their account by emailing droneteam@ainautics.com. We do not sell Personal Information and do not engage in “targeted advertising” as those terms are defined in U.S. state privacy laws.
• Students and parents in School programs exercise their rights to inspect, review, correct and delete Student Data through their School, which controls that data. See Section B5.
• Do Not Track. Because we do not track users across third-party sites, we treat all users as if a Do Not Track signal were present.

A11. Changes to this Policy

We will post any revised Policy on the Platform with a new effective date. For changes that materially affect Student Data, we give Schools at least 30 days’ advance notice, and no change will reduce the protections for Student Data during the term of a District Agreement without the School’s written consent.

Part B — Student Data Privacy Commitments for Schools and Districts

Part B applies whenever the Platform is used through a School program. These commitments are written to align with the Family Educational Rights and Privacy Act (FERPA, 20 U.S.C. § 1232g; 34 CFR Part 99), the Protection of Pupil Rights Amendment (PPRA, 20 U.S.C. § 1232h; 34 CFR Part 98), COPPA, the South Carolina Family Privacy Protection Act (S.C. Code Ann. § 30-2-10 et seq.) and South Carolina’s data-breach notification law (S.C. Code Ann. § 39-1-90), as well as the data-confidentiality agreements used by our school district partners.

B1. Ownership and control

• Student Data is and remains the property of the School (and, as applicable, the student or parent). AINautics acquires no ownership interest in it and receives only a limited, non-exclusive license to process it for the purpose of providing the Platform and related instructional services to the School.
• Student-generated content (projects, written work, flight-plan exercises) remains the property of the student and the School.
• The School may direct AINautics at any time to correct, export, return or delete any Student Data.

B2. Our role under FERPA

When a School shares Education Records with us, AINautics acts as a school official with a legitimate educational interest under 34 CFR § 99.31(a)(1)(i)(B). We perform an institutional service that the School would otherwise perform with its own employees, we are under the School’s direct control with respect to the use and maintenance of Education Records, we use them only for the purposes the School authorizes, and we do not re-disclose them except as permitted by 34 CFR § 99.33 and this Policy.

B3. Authorized use

• We use Student Data only to provide, maintain, secure and support the educational services described in the District Agreement or order form, and for no other purpose.
• We do not use Student Data for our own marketing, advertising or solicitation, or for any third party’s.
• We use De-identified Data for product improvement or research only when the School has authorized it in writing; we will not attempt to re-identify it or transfer it to anyone else without the School’s written consent, and we will not publish research or findings based on a School’s data without its advance written consent.
• PPRA: we do not administer surveys, analyses or evaluations that ask students about the protected topics listed in 20 U.S.C. § 1232h(b).

B4. Where Student Data lives, and who can reach it

• Student Data is stored and processed only on servers physically located in the United States and controlled by entities subject to U.S. law. On request we will give the School a list of the locations where its Student Data is stored.
• Access is limited to the smallest number of AINautics staff needed to deliver the service. Each person with access is identified to the School on request, and we keep an access log of the date, time and identity of anyone outside our direct employ who is given access to Student Data.
• We do not share Student Data with any subcontractor without the School’s advance written permission. The Subprocessors that host and deliver the Platform are disclosed in Section A7 and in our technical specifications so the School can review and approve them before any Student Data is shared, and each approved subcontractor is bound in writing to these same commitments.
• FERPA-protected data is never emailed in plain text. Class rosters and progress reports are exchanged through the Platform’s teacher dashboard or password-protected or encrypted files.
• Student accounts are not listed in any public directory, and student profile pages are not publicly viewable.
• A primary data custodian (Taz Little, Co-Founder & COO) is responsible for compliance with this Part B, maintains the log of Student Data received and its return or destruction, and is the School’s point of contact.

B5. Parent and eligible-student rights

Parents and eligible students exercise their FERPA rights to inspect, review and request correction of Education Records through the School. When a School forwards such a request, we provide the requested records, correction or deletion within 10 business days. If a parent contacts us directly about a School account, we will acknowledge the request and refer it to the School for direction, and we will not disclose Student Data to anyone other than the School without the School’s written authorization or as required by law.

B6. Retention, return and deletion

No AINautics employee, agent or subcontractor is permitted to retain or continue using Student Data after the School’s program ends.

B7. Security incidents and breach notification

If we discover a suspected or actual security breach involving the unauthorized release of, or access to, Student Data, we will:

1. Take immediate, commercially reasonable steps to contain the incident and limit its effects, and begin an investigation.
2. Notify the affected School immediately upon discovery—in the most expedient time possible and without unreasonable delay, and in no case later than 72 hours after discovery—consistent with the legitimate needs of law enforcement and the measures needed to determine the scope of the breach and restore the integrity of the system.
3. Include in that notice, and update as the investigation proceeds: (i) the date or date range of the breach; (ii) a description of how it occurred; (iii) the types of information involved; (iv) who made the unauthorized use or received the disclosure, if known; (v) what we have done or will do to mitigate it, including any law-enforcement involvement; and (vi) the corrective actions we have taken or will take to prevent a recurrence.
4. Cooperate with the School’s investigation and provide any additional information it reasonably requests.
5. Provide written notice to affected students, parents or employees, and to any state or federal agency, where required by S.C. Code Ann. § 39-1-90 or other applicable law or where the School requires it—with the content and timing of any such notice subject to the School’s review and prior approval.
6. Bear the responsibilities for a breach caused by AINautics as set out in the applicable District Agreement.

B8. Audits and cooperation

On reasonable notice we will make Student Data we hold, our access logs and our security practices available to the School for review, and we will cooperate with the School or its designee in monitoring, auditing or investigating our use and safeguarding of Student Data. The School and its auditors agree to keep confidential any AINautics trade secrets they encounter during such a review.

B9. Order of precedence

If this Policy conflicts with a signed District Agreement, the District Agreement controls. If this Policy conflicts with our Terms and Conditions with respect to Student Data, this Policy controls.

Contact Us

Approved and issued by: Taz Little, Co-Founder & Chief Operating Officer, AINautics, LLC. Effective April 27, 2026; last reviewed October 12, 2026. A signed PDF copy of this document is available on request.