Privacy Policy

1. Who we are

DroneFlow.Ai is a drone-data processing platform operated by AeroLakeland.com LLC (“AeroLakeland,” “DroneFlow,” “we,” “us,” or “our”). “DroneFlow.Ai” is the trading name and product brand under which AeroLakeland.com LLC provides the service; AeroLakeland.com LLC is the legal entity and data controller responsible for the platform. AeroLakeland.com LLC is organized under the laws of the State of Florida, USA, with its principal place of business in Lakeland, Polk County, Florida.

2. Scope of this policy

This policy applies to the DroneFlow.Ai marketing site (droneflow.ai), the web application (app.droneflow.ai), and the client portal and share links generated by the platform. It describes how we handle both the personal information of the people who hold accounts with us and the project data (imagery and derived deliverables) that customers upload and generate. Where a customer uploads a third party's personal information as part of their project data, the customer is the controller of that data and we act as a processor on the customer's behalf.

3. Information we collect

Account information. Information you provide when you register or are invited to an account — name, email address, password credentials, company name, role, and (via our authentication provider) Google sign-in identifiers if you choose Google login.

Billing information. Your subscription tier, plan history, and transaction records. Card and payment-instrument data is collected and tokenized directly by our payment processors (Stripe, PayPal, and Square) in the browser; full card numbers never reach or persist on our servers.

Project data you upload. The drone imagery, photos, and datasets you or your pilots upload for processing — including JPG/PNG imagery, ZIP archives, GeoTIFF, LAS/LAZ point clouds, OBJ/PLY meshes, and related GIS files — together with any metadata (capture location, timestamps, camera and flight parameters) embedded in those files.

Derived deliverables. The outputs our processing pipeline generates from your uploads — 2D maps and orthomosaics, 3D models, point clouds, contours/CAD, annotations, and design-surface data.

Usage and technical data. Login activity, feature usage, device/browser information, IP address, and server logs needed to operate, secure, and troubleshoot the service.

How you found us. When you create an account we record where the signup came from — the referring website or page, and any campaign parameters present on the registration link. We use this to understand which of our own pages and campaigns bring people to the product. It is first-party: we do not set advertising cookies and we do not share it with advertising networks.

Support communications. Messages, attachments, and feedback you send us, and records of our responses.

4. How we use information

We use the information above to: process your uploads into deliverables and operate your client portal; create and administer your account; bill your subscription or one-time purchases and prevent payment fraud; provide support and respond to your requests; send service and account emails (for example, trial and billing notices); monitor, secure, and improve the reliability of the platform; and comply with our legal obligations. We do not sell your personal information or your project data, and we do not use your imagery or deliverables for advertising.

5. Ownership of your data

You retain all ownership rights in the imagery and datasets you upload and in the deliverables we generate from them. We claim no ownership of your project data. We hold it only under a limited license to store, process, and display it for the purpose of providing the service to you and to the people you explicitly share it with. This is addressed in more detail in our Terms of Service.

6. AI and automated processing

Your uploads are processed by automated geospatial engines (photogrammetry and reconstruction pipelines) to produce your deliverables. The platform also offers an in-product AI assistant that uses a third-party AI provider (Anthropic) to answer questions and help you work with your projects. Project context sent to the AI provider is used only to generate responses for you; we do not permit your project data or personal information to be used to train third-party AI models. Automated processing does not make legally significant decisions about individuals.

7. Confidentiality of customer data

We treat your project data as confidential. Access by our personnel is limited to what is necessary to operate and support the service, and staff access is governed by internal access controls. We do not disclose your project data to other customers, and share links and portal access are created only through your own actions (see Section 11).

8. How we share information — subprocessors

We share information only with the service providers (subprocessors) needed to run the platform, and only to the extent required for them to perform their function. Our current subprocessors are:

We also disclose information (a) to anyone you invite to a project or generate a share link for, through your own action; and (b) to law enforcement or other authorities only where we are legally required to do so, or to protect our rights, users, or the public. If we are ever involved in a merger, acquisition, or asset sale, we will notify affected account owners and honor the commitments in this policy.

9. Data retention and deletion

We retain your project deliverables for as long as your account is active, subject to any retention or expiry window associated with your plan (see Pricing) or the expiry you set on a share link or project archive. Account and billing records are retained after cancellation for 7 years, the period required for tax, accounting, and legal purposes. You can request deletion of your account and associated project data at any time by contacting privacy@droneflow.ai; we will delete or de-identify it within a commercially reasonable period, except where we are required to retain it by law.

10. Where your data is processed

DroneFlow.Ai is operated from the United States by AeroLakeland.com LLC, and the application and database that run the service are hosted in the United States.

Your uploaded files and finished deliverables are held in Cloudflare R2 object storage, which is region-less: Cloudflare determines where objects are physically stored, and we do not pin them to a particular country or region. We therefore cannot and do not promise that your project files remain within any specific jurisdiction, and we do not offer regional data residency. If data residency is a requirement of a compliance program you are subject to, please raise it with us before uploading data you are obliged to keep in a given region.

11. Public and shared links

When you invite a collaborator or generate a share link, you are choosing to make the associated project data accessible to the recipients of that link or invitation. Share links can be configured to expire after a set date or number of views. You are responsible for who you share links with; anyone with an active link may be able to view or download the shared deliverables until the link expires or is revoked.

If someone shared a link with you. When a share link is opened we record that it was opened, which link it was, and the IP address of the request, in a security log kept by the account that created the link. We do this so the account owner can see who has accessed the project they shared and so that misuse of a link can be investigated. We do not use it for advertising or profiling, and we do not set tracking cookies on share pages. If you received a link and want to know what was recorded about your visit, contact us at privacy@droneflow.ai.

12. Security

We protect your data with encryption in transit and encryption of stored files at rest, role-based access controls that limit what each account member can do, and time-limited signed URLs for file access. For more detail on our security posture — including which measures are live today and which are on our roadmap — see our Security page. No system is perfectly secure, and we cannot guarantee absolute security.

13. Breach notification

If we become aware of a security breach that affects your personal information or project data, we will notify affected account owners without undue delay and, where required, within the timeframes set by applicable law, and will describe what happened and the steps we are taking in response.

14. Your privacy rights

Depending on where you live, you may have the right to access, correct, delete, or port your personal data, to object to or restrict certain processing, and to withdraw consent. Residents of California (under the CCPA/CPRA) and individuals in the EEA/UK (under the GDPR) have additional rights, including, for California residents, the right not to be discriminated against for exercising those rights. We do not sell personal information. To exercise any of these rights, contact privacy@droneflow.ai; we may need to verify your identity before acting on a request.

15. International users

If you access DroneFlow.Ai from outside the United States, you understand that your information will be transferred to and processed in the United States, and that your uploaded files may be stored outside your country in region-less object storage as described in Section 10, where data-protection laws may differ from those in your own. Where required, we rely on appropriate safeguards for such transfers.

16. Children's privacy

DroneFlow.Ai is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact us and we will delete it.

17. Changes to this policy

We may update this policy from time to time. We will post material changes here with a revised “Last updated” date and, where required, notify account owners by email.

18. Contact us

Questions or requests about this policy or your data: privacy@droneflow.ai. AeroLakeland.com LLC, Lakeland, Florida, USA.