Privacy policy

Effective 19 October 2026

This policy explains what BBL Ventures LLC, trading as 145manuals.com, does with data in 145manuals SMS at sms.145manuals.com.

Two relationships run through everything below. If you are an aviation operator, you are our customer and the data in your organization is yours; we hold and process it for you. If you are a pilot, mechanic or other employee using the system because your employer subscribes, your employer decides what goes in and who sees it — with one exception, confidential reports, which is set out in its own section because it is the part that matters most.

What we hold

Account data. Your name, email address, the organization you belong to, your role in it, and a hashed password if you use one. If you sign in with Google we receive your name, email address and profile picture from Google and nothing else.

SMS records. Whatever your organization puts in: safety reports, hazards, risk assessments, corrective actions, audits, assurance and management reviews, flight risk assessments, training records and course results, safety communications and acknowledgements, documents you upload, and the organization’s own settings and certificates.

Activity logs. Who did what and when — sign-ins, record creation and changes, acceptances and sign-offs. These exist because part 5 requires records to be attributable, and because an undated unattributed safety record is not evidence of anything.

Technical data. Ordinary server logs: IP address, browser, pages requested, errors. We use them to operate and secure the service.

We do not run advertising trackers, we do not use third-party analytics that profile individuals, and we do not place cookies for anything other than keeping you signed in and keeping forms secure.

Confidential safety reports

A report submitted confidentially has its reporter’s identity withheld from your organization’s users in the system. That is the entire point of the feature, and it is a promise we keep on both sides: we will not disclose a confidential reporter’s identity to your management, to your safety manager, or to anyone else, except where we are compelled by law or valid legal process — and then only so far as compelled, and we will tell you unless we are prohibited from doing so.

Be realistic about what confidentiality can do in a small organization. In a company of three people, a report about a specific flight on a specific morning may identify its author by its content no matter what the software withholds. The system protects the name; it cannot protect against inference, and we would rather say so than let anyone rely on a guarantee that physics does not support.

Who we share it with

We do not sell personal data and we do not share it for anyone else’s marketing. We use a small number of service providers to run the system, each with access only to what it needs:

Vercel — application hosting, in the United States.
Supabase — the managed database and the private file store for uploaded documents.
Resend — outbound email: invitations, password resets, and notifications. Subject lines and message bodies pass through it.
Stripe — payment processing for subscriptions. Your billing name, business name, email, phone and address, and the answers you give at checkout, are held by Stripe. Card and bank details go directly to Stripe; we never see or store them.
Google — only if you choose to sign in with a Google account.

Beyond those, we disclose data only to you, to your organization in accordance with the roles you have assigned, or where we are required by law. We do not give any regulator access to your organization’s records; you submit what you submit.

Where it lives, and for how long

Data is stored and processed in the United States. It is encrypted in transit and at rest by the providers above, and each organization’s records are separated at the query layer so that one subscriber’s users cannot reach another’s.

We keep your organization’s records for as long as the organization exists in the system, including while a subscription is lapsed and read-only, because part 5 imposes its own retention periods and losing a record to a billing event would be the wrong failure. If you ask us in writing to delete your organization, we will do so within 30 days after giving you the chance to export. Backups age out within 35 days of that.

Server and activity logs are kept for up to 12 months.

Your choices

You can see and correct your own account details in the system. You can export your organization’s records at any time, including while read-only.

If you are an employee of a subscribing operator and you want your personal data corrected or removed, start with your employer, because the records are theirs and some of them they are required to keep. If that is not appropriate — for instance because the request concerns a confidential report — write to us directly at certs@145manuals.com and we will deal with you rather than routing it through them.

Breach, children, and changes

If we become aware of a breach affecting your data we will tell you without undue delay, with what we know and what we have done.

The system is for aviation professionals at work and is not intended for anyone under 16. We do not knowingly collect data from children.

If we change this policy materially we will email account holders at least 30 days beforehand. The effective date at the top always reflects the current version.