Privacy Policy

Tail Flux is an aviation maintenance, repair and overhaul (MRO) platform operated by Lexodd Hypernova Pvt. Ltd. (“Lexodd”, “we”, “us”), a company incorporated in India with offices at Visakhapatnam & Hyderabad, India. The platform has previously been referred to as AeroMRO; both names refer to the same software operated by the same body corporate.

Tail Flux is enterprise software sold to airlines, MRO providers, lessors and aircraft operators. It is not a consumer service. The individuals whose personal data we handle are predominantly employees and contractors of our customers — engineers, technicians, planners, compliance officers and administrators — together with people who contact us through this website.

Our obligations differ depending on whose data is involved.

Where we act as a processor, the governing terms are those in the customer’s subscription agreement and data processing addendum, which take precedence over this policy in the event of conflict.

Under Rule 3 of the SPDI Rules, 2011, the only category of sensitive personal data or information routinely handled by the platform is passwords. Passwords are never stored in plain text; authentication is delegated to our identity provider, which stores only a salted cryptographic hash. Neither Lexodd staff nor customer administrators can retrieve a user’s password.

Digital signatures captured for maintenance sign-off are treated with the same care as sensitive personal data, because they authenticate an individual engineer against a regulated airworthiness record.

We do not collect financial information, health records, biometric identifiers, sexual orientation or any other category listed in Rule 3.

• To deliver the platform — authenticating users, applying role-based access, assigning and tracking maintenance work, and maintaining aircraft records.
• To meet aviation regulatory obligations — airworthiness records must attribute maintenance actions to identified, qualified individuals and must be retained and producible on demand by the governing authority.
• To maintain security and accountability — audit logging, access control, detecting misuse and investigating incidents.
• To operate and improve the service — diagnosing faults, monitoring availability and improving reliability.
• To respond to you — replying to demo requests and sales enquiries made through this website.

For website enquiries we rely on your consent, given when you submit the form. For platform processing we act on the documented instructions of our customer, who is responsible for establishing the lawful basis — typically the performance of an employment contract and compliance with a legal obligation.

The platform includes optional AI capabilities: a daily fleet briefing, risk scoring, repeat-defect detection, parts demand forecasting and an engineering copilot that answers questions in natural language.

• These features operate on aircraft and maintenance data. Where a record references the individual who raised or completed it, that reference may be included in the context sent to the model.
• AI features are administrator-controlled and can be disabled globally or per feature. When disabled, no data is transmitted to the model provider.
• No automated decision produces a legal or similarly significant effect on an individual. AI output is advisory: a suggested inspection, a drafted work order or a ranked risk list. A qualified person decides and signs.
• We do not permit our model provider to train foundation models on data submitted through the platform.

We do not sell personal data and we do not share it for advertising. We disclose it only to the sub-processors below, each engaged under contract and only to the extent needed to run the service.

The platform also calls the OpenSky Network (flight positions), Open-Meteo (airport weather) and public news feeds. These are outbound lookups by aircraft or airport identifier; no personal data is transmitted to them.

We may additionally disclose personal data where required by law, court order or a lawful request from a government or aviation regulatory authority, and to professional advisers under a duty of confidence.

Our infrastructure providers operate globally and data may be processed outside India. Transfers are made under the contractual protections offered by each provider and are restricted to countries not subject to a transfer restriction notified by the Central Government under Section 16 of the DPDP Act, 2023.

Customers with data-residency obligations — including defence, government and certain national carriers — can request a region-pinned or dedicated deployment. Contact us before onboarding if this applies to you.

We maintain reasonable security practices and procedures as required by Section 43A of the Information Technology Act, 2000 and Rule 8 of the SPDI Rules, 2011. Our controls are documented in an Information Security Policy available to customers and auditors on request. In summary:

• Encryption in transit (TLS) and at rest for all database and file storage.
• Role-based access control across eight defined roles and granular permissions, enforced on the server for every request rather than by hiding controls in the interface.
• Row-level security in the database, so a session cannot read outside its authorisation.
• An immutable audit log recording actor, action, record, timestamp and change metadata — including the originating platform for actions taken on mobile.
• Credentials stored in encrypted storage on mobile devices, with remote revocation of a lost or stolen device.
• Security headers, timing-safe verification of scheduled-task secrets and server-side input validation.
• Least-privilege administrative access, reviewed when roles change.

No system is absolutely secure. We do not represent that the platform is immune from every possible attack, and we describe our controls honestly rather than aspirationally.

On termination, customers may export their data. After the contractual export window closes, customer data is deleted from active systems and expires from backups on the backup cycle. We will not delete records where retention is required by law or by an aviation regulator.

Subject to the DPDP Act, 2023 and applicable rules, you may:

• Ask what personal data of yours we hold and how it is processed;
• Ask us to correct data that is inaccurate, incomplete or out of date;
• Ask us to erase personal data that is no longer needed — subject to aviation record-keeping obligations, which will usually prevent erasure of maintenance actions attributed to you;
• Withdraw consent where processing is based on consent;
• Nominate another individual to exercise your rights in the event of death or incapacity;
• Raise a grievance with us, and escalate to the Data Protection Board of India.

This marketing website sets no advertising cookies and no third-party tracking cookies, and does not profile visitors. The pages are statically generated and the demo request form submits through your own email client rather than posting to a server.

The Tail Flux application, once you sign in, uses strictly necessary cookies to maintain your authenticated session. These cannot be disabled without preventing sign-in.

In accordance with Rule 5(9) of the SPDI Rules, 2011 and Section 13 of the DPDP Act, 2023, complaints about the handling of personal data may be addressed to our Grievance Officer:

We acknowledge grievances within 48 hours and aim to resolve them within 30 days of receipt, as required by the SPDI Rules. If you are not satisfied with our response, you may escalate to the Data Protection Board of India.

We review this policy at least annually and whenever we materially change how we handle personal data. The effective date and version at the top of this page indicate the current revision. Material changes affecting customers will be notified through the platform or to the customer’s nominated contact before they take effect.

Questions about this policy or our processing may be sent to info@tailflux.co. See also our Terms & Conditions.