1. What information do we collect?

We collect personal information that you voluntarily provide when you register for an account, when you use KrenoCloud or XRDS-Air, or when you contact us for support. Depending on how you interact with us, this may include:

• Account information — your name, email address, organization/company, and password (see How we protect it for how passwords are stored).
• HUMS and flight data — health and usage monitoring data from your aircraft that you or your organization choose to upload (optional; not required to create an account).
• Application data, only with your permission — device geolocation and local device storage access, requested by the XRDS-Air mobile app. See Addendum A for specifics.

We do not collect or process sensitive personal information (e.g., racial or ethnic origin, religious beliefs, health data about you personally), and we do not collect information about you from third parties.

All personal information you provide to us must be accurate and complete, and you agree to notify us of changes.

2. How do we process your information?

• To create and authenticate your account, and keep it in working order.
• To respond to your support requests and troubleshoot issues you report.
• To send you administrative information — service notices, and changes to our terms or this policy.
• To maintain the security of the Services and prevent unauthorized access.
• To protect an individual's vital interests, such as preventing harm, where necessary.

3. What legal bases do we rely on?

If you are located in the EU or UK: the GDPR / UK GDPR requires us to identify our legal basis for processing. We rely on: consent (which you may withdraw at any time), performance of a contract (providing the Services you signed up for), legal obligations (such as cooperating with law enforcement or defending our legal rights), and vital interests (protecting someone's safety).

If you are located in Canada: we rely on your express or implied consent, which you may withdraw at any time, except in narrow cases permitted by law (e.g., fraud investigations, or where required by a court order).

4. When and with whom do we share your information?

• Your organization. KrenoCloud data is scoped to your organization's fleet. Administrators within your own organization can see the aircraft and flight data associated with it.
• Service providers. We use third-party infrastructure providers (for example, cloud hosting) to run the Services, under confidentiality obligations. These providers do not use your data for their own purposes.
• Legal requirements. We may disclose information if required by law, court order, or government request, or to protect the safety, rights, or property of RMCI, our users, or the public.
• Business transfers. If RMCI is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

5. Do we use cookies or other tracking technologies?

KrenoCloud sets a first-party session cookie, and, if you choose "remember me," a first-party login cookie, solely to keep you signed in. XRDS-Air authenticates using a bearer token rather than cookies. We do not use third-party analytics, advertising, or cross-site tracking technologies of any kind, and we do not permit any third party to place tracking technology on our Services.

6. How long do we keep your information?

We retain account and fleet data for as long as you or your organization maintain an account with us, or as needed to comply with legal or contractual obligations. Device geolocation collected by XRDS-Air is used only momentarily to render in-app maps — it is not stored on our servers and is discarded as soon as the app session ends.

When we no longer have a legitimate business need to process your information, we delete or anonymize it, or, where immediate deletion isn't possible (e.g., backup archives), we isolate it from further use until deletion is possible.

7. How do we keep your information safe?

We use technical and organizational safeguards designed to protect your information, including encrypted (HTTPS) transmission between your device and our servers, and one-way cryptographic hashing of passwords — RMCI staff cannot view or recover your password. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

8. Do we collect information from minors?

KrenoCloud and XRDS-Air are intended strictly for professional, commercial, and aviation operational use. We do not knowingly collect personal information from anyone under 18 (or the equivalent minimum age in your jurisdiction). If we learn we've collected such information, we will delete it and deactivate the associated account. Contact us at support@rmci-inc.com if you believe this has occurred.

9. What are your privacy rights?

If you're located in the EEA, UK, Switzerland, or Canada, you may have the right to access, correct, restrict, or request deletion of your personal information, receive a portable copy of it, and object to certain processing. Contact us using the details in Contact us to make a request, and we'll respond in accordance with applicable law.

You can review, change, or close your account at any time by contacting us. Closing your account deactivates it and removes your information from our active systems, though we may retain limited records to prevent fraud, resolve disputes, or meet legal obligations.

UK residents unhappy with how we've handled a complaint may also contact the Information Commissioner's Office (ico.org.uk/make-a-complaint, helpline 0303 123 1113).

10. Do-Not-Track signals

No uniform standard for Do-Not-Track browser signals currently exists, so we do not respond to them. If a standard becomes widely adopted, we'll update this policy accordingly.

11. Do US residents have specific privacy rights?

If you live in California, Colorado, Connecticut, and several other states with comparable privacy laws, you may request to know what personal information we hold about you, correct it, delete it, or receive a copy of it. We have not sold, shared, or disclosed personal information for a business or commercial purpose in the preceding twelve months, and we do not plan to.

To exercise these rights, email support@rmci-inc.com. We'll verify your identity before acting on the request. If we decline a request, you may appeal by replying to our decision, and, if still unsatisfied, contact your state attorney general.

12. Do we make updates to this notice?

We may update this notice periodically to stay compliant with applicable law or to reflect changes in our practices. We'll update the date at the top of this page, and, for material changes, notify you directly or post a prominent notice.

13. How can you contact us?

RMCI, Inc.

1525 Perimeter Pkwy NW, Suite 250

Huntsville, AL 35806, United States

Email: support@rmci-inc.com

Phone: (256) 489-9068

14. How can you review, update, or delete your data?

To request access to, correction of, or deletion of the personal information we hold about you, contact us using the details above. We'll respond consistent with the rights available in your jurisdiction.