Privacy Policy

1. Who we are (Data Controller)

• Entity: Aeromuse, Inc.
• Registered office: Aoyama Marutake Bldg. 6F, 3-1-36 Minami-Aoyama, Minato-ku, Tokyo 107-0062, Japan
• Contact email: privacy@aero-muse.com
• Data Protection Officer (DPO): A DPO is not mandatorily required at this stage; questions can be sent to privacy@aero-muse.com.

2. Scope

This Policy applies to personal information we collect through the Waitlist registration flow and related communications. It does not cover third-party websites linked from our Service, or the future HUD SONiC product, which will be governed by a separate privacy notice at launch.

3. Personal information we collect

We collect only what we need to operate the Waitlist and to plan the launch of HUD SONiC.

We do not intentionally collect special categories of personal data (GDPR Art. 9), government-issued license numbers, payment information, or precise geolocation through the Waitlist. Please do not submit such information.

4. How we use your information (Purposes)

We use your personal information to:

1. Add you to the Waitlist and confirm your registration.
2. Notify you when HUD SONiC becomes available in your region or for your role.
3. Send you product updates, beta invitations, and other directly related communications about HUD SONiC.
4. Understand the demographics and geographic distribution of interested pilots so we can prioritize product features, launch regions, and language support.
5. Measure the effectiveness of our marketing channels (via UTM parameters) and improve our outreach.
6. Prevent fraud, abuse, duplicate submissions, and security incidents.
7. Comply with legal obligations and respond to lawful requests.

5. Legal bases for processing (GDPR / UK GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following legal bases:

• Consent (Art. 6(1)(a) GDPR) — for adding you to the Waitlist, sending you launch and marketing communications, and processing UTM/attribution data. You may withdraw consent at any time (see Section 9).
• Legitimate interests (Art. 6(1)(f) GDPR) — for security, fraud prevention, aggregate analytics, and improving our Service. Our legitimate interests are balanced against your rights and freedoms.
• Legal obligation (Art. 6(1)(c) GDPR) — where we must process data to comply with applicable law.

6. Cookies and similar technologies

The Waitlist page uses a minimal set of cookies and similar technologies:

• Strictly necessary — to operate the form (e.g., CSRF protection, session).
• Analytics (Google Analytics 4) — we use Google Analytics 4 ("GA4"), operated by Google LLC, to measure traffic, engagement, and the performance of our marketing campaigns. GA4 sets cookies and processes pseudonymous identifiers, device/browser information, and interaction events. Where required by law (including the EU ePrivacy Directive and the UK PECR), we request your prior consent through a cookie banner before loading GA4, and you may withdraw consent at any time. IP addresses are anonymized where supported. For more information, see Google's Privacy Policy.

You can control cookies through your browser settings and through our cookie banner. Disabling strictly necessary cookies may break the form.

7. How we share your information

We do not sell your personal information. We share it only with the following categories of recipients, under appropriate contractual safeguards:

• Service providers (processors) acting on our instructions, including:
  • Google LLC — Google Cloud Platform, used to host the Waitlist application and to store Waitlist entries and related logs.
  • Google LLC — Google Analytics 4 for traffic and marketing analytics (loaded only after consent in jurisdictions where consent is required; IP anonymization enabled).

  These processors are contractually bound to process personal data only on our instructions and to maintain appropriate technical and organizational security measures.

• Professional advisors — lawyers, accountants, and auditors, where necessary.
• Authorities — when required by law, court order, or to protect the rights, property, or safety of Aeromuse, our users, or others.
• Corporate transactions — in connection with a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality protections.

We do not share your information with airlines, recruiters, insurers, or other third parties for their own marketing purposes from the Waitlist.

8. International data transfers

Aeromuse is established in Japan. Personal data collected through the Waitlist may be transferred to, stored in, or accessed from Japan, the United States, and other countries where our service providers operate.

• Transfers from the EEA / UK / Switzerland: Japan has been recognized by the European Commission as providing an adequate level of data protection (adequacy decision of 23 January 2019, as amended). For transfers to other third countries (e.g., the United States) we rely on the European Commission's Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, and, where appropriate, supplementary technical and organizational measures.
• Transfers from Japan (APPI): We obtain your consent and/or rely on contractual safeguards equivalent to APPI standards when transferring personal data to third parties outside Japan.

You may request a copy of the relevant safeguards by emailing privacy@aero-muse.com.

9. Your rights

Depending on where you live, you may have the following rights with respect to your personal information:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure / deletion — ask us to delete your data ("right to be forgotten").
• Restriction — ask us to limit how we process your data.
• Objection — object to processing based on legitimate interests or direct marketing.
• Portability — receive your data in a structured, commonly used, machine-readable format.
• Withdraw consent — at any time, without affecting the lawfulness of processing carried out before withdrawal.
• Right not to be discriminated against (CCPA/CPRA) — for exercising your privacy rights.
• Right to opt out of "sale" or "sharing" (CCPA/CPRA) — we do not sell or share personal information as defined by these laws, but you may still submit a request.
• Lodge a complaint with your local data protection authority. EEA residents can find the relevant authority at https://edpb.europa.eu/about-edpb/board/members_en; UK residents can contact the Information Commissioner's Office (ICO); Japanese residents can contact the Personal Information Protection Commission (PPC).

To exercise any of these rights, email privacy@aero-muse.com with your request. You can also unsubscribe from marketing emails at any time using the unsubscribe link in the email. We may need to verify your identity before fulfilling certain requests, and we will respond within the timeframes required by applicable law (e.g., one month under GDPR, extendable by two further months for complex requests).

10. How long we keep your information

We retain Waitlist data for as long as is necessary to fulfill the purposes described in this Policy:

• Active Waitlist entries: until HUD SONiC launches in your region plus 24 months, or until you unsubscribe / request deletion, whichever comes first.
• Aggregated, de-identified statistics: indefinitely, as they no longer identify you.

If you withdraw consent or request deletion, we will delete or anonymize your data without undue delay, except where we are legally required to retain it.

11. Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. These measures include encryption in transit (HTTPS/TLS), access controls restricted to authorized @aero-muse.com accounts, least-privilege principles, audit logging, and periodic review of our security posture.

No method of transmission over the Internet or method of electronic storage is 100% secure; we cannot guarantee absolute security.

12. Children

The Service is intended for professional and student pilots and is not directed at children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal data, please contact privacy@aero-muse.com so we can delete it.

13. Automated decision-making

We do not use the Waitlist data to make decisions about you that produce legal effects or similarly significant effects through solely automated means (GDPR Art. 22).

14. Third-party links

The Service may contain links to third-party websites (e.g., social media). We are not responsible for the privacy practices of those sites. Please review their privacy policies separately.

15. Changes to this Policy

We may update this Policy from time to time. The "Last updated" date at the top reflects the latest version. If we make material changes, we will notify you by email or by prominent notice on the Service before the changes take effect. Continued use of the Service after the changes become effective constitutes acceptance of the updated Policy.

16. How to contact us

If you have questions, concerns, or requests regarding this Policy or your personal information, please contact us:

• Email: privacy@aero-muse.com
• Postal address: Aeromuse, Inc., Aoyama Marutake Bldg. 6F, 3-1-36 Minami-Aoyama, Minato-ku, Tokyo 107-0062, Japan

We aim to respond to all legitimate requests within 30 days.