Skip to content
Start free trial

Privacy Policy

Last updated 11 October 2026

This policy explains how FIH LLC ("we", "us") handles personal data in connection with aircraf.com and the Aircraf email sending console (the "service"). It covers three groups of people: account holders, people who receive email sent through the service, and people whose business contact details appear in the service's contact database. Questions or requests: advisor@fih.com.

1. Our role

For account holders' own details, and for the business contact database, we are the controller. For the contact lists and messages an account holder uploads or sends, the account holder is the controller and we process that data on their instructions as a service provider (processor). If you received an email sent through Aircraf by a business, that business decided to contact you, and you should direct questions about why to them; you can also contact us and we will pass your request on or help where we can.

2. What we collect

Account holders.

  • Registration details: full name, company (optional), email address and a password, which we store only as a one-way hash.
  • Account settings and workspace data: plan and account status, sending domains and their verification records, inboxes, sender names and addresses, reply-to addresses, your business postal address (added to the footer of your messages), and the mailbox passwords and delivery-provider API keys you enter for each inbox, which we store encrypted.
  • Billing: your plan, subscription status and the Stripe customer and subscription identifiers. Card and bank details are entered on Stripe's checkout page and held by Stripe, not by us.
  • Sign-up security: the IP address you signed up from and the result of a Cloudflare Turnstile check, used to stop automated and abusive sign-ups.
  • What you create: campaigns, sequences, automations, templates, prompts you give the AI drafting assistant, and contact lists you import.

Recipients of email sent through the service.

  • The contact details an account holder imports, such as name, email address, company, job title and any other columns in their file, plus a verification result if they choose to check the address.
  • Replies: when an account holder connects a mailbox by IMAP, the service reads new messages arriving in that mailbox to find replies, bounces and auto-replies to the account holder's campaigns, and stores the matching replies (sender, subject and text) so the account holder can read them in the service. Messages that do not match a campaign are not stored. The service does not mark messages as read.
  • Delivery events: when a message was sent, delivered, bounced, opened or clicked, and whether the recipient unsubscribed or complained. Opens are recorded with a small tracking image and clicks with a redirect link, where the sender has tracking turned on. We record the time of the event against the message; we do not store your IP address or device details in the service's database.

People in the business contact database (available to some workspaces only).

  • Professional details such as name, job title, seniority, department, employer, business email address and its status, business phone number, city, state, country, company website, company size, industry and a professional profile link. These come from business sources and publicly available information. We do not hold sensitive personal data in it.

Everyone who visits the site.

  • Technical data that our hosting provider logs automatically, such as IP address, browser type, the page requested and the time, used for security and to keep the site running.
  • On the public pages only (the home page, Pricing, Security, Terms and this policy), usage data collected by Google Analytics 4 if it is allowed to run for you: the pages viewed, how you arrived, approximate location, device and browser type, and a random identifier stored in a cookie. See section 3.

3. Cookies and analytics

Strictly necessary.The service sets one cookie of its own, a session cookie that keeps you signed in for up to 30 days. It is marked secure and HTTP-only, and it is removed when you sign out. Your cookie choice (below) is kept in your browser's local storage under aircraf.consent.analytics.

Google Analytics 4. Since 11 October 2026 the public pages of aircraf.com (the home page, Pricing, Security, Terms and this policy) use Google Analytics, provided by Google, to count visits and see which pages are read and where visitors come from, so we can improve the site. It never runs inside the Aircraf console, on the sign-up, log-in or email confirmation pages, or on unsubscribe pages, and it does not receive any data from your workspace, your contact lists or the emails you send. Until that date this policy said we ran no analytics, and that was true.

  • Cookies it sets: _ga and _ga_PY080LQHT9, which hold a random identifier and session state, and last up to 2 years (Google's default).
  • IP addresses: Google Analytics 4 does not log or store IP addresses. Google uses the IP address of the request only to derive approximate location (country, region, city) and then discards it.
  • Retention: Google deletes event-level data after 2 months and user-level data (linked to the identifier) after 14 months without activity. Aggregate reports are kept.
  • Off by default where required: in the EU/EEA, the UK and Switzerland the Google tag is not loaded at all until you choose Agree. Elsewhere it runs unless you choose Decline. Google signals and ad personalisation are turned off, and we do not use analytics data for advertising.
  • Global Privacy Control: if your browser sends a GPC signal, we treat it as Decline unless you have chosen Agree on this site.
  • Opting out: use "Cookie settings" at the foot of any public page and choose Decline. That stops the tag and deletes the _ga cookies. You can also install Google's Analytics opt-out browser add-on, or block cookies in your browser; the site works the same either way.

We do not use advertising or social media cookies or trackers. The open-tracking image and click links described above are part of the emails account holders send, not cookies on this site.

4. How we use it, and our legal bases

  • To provide the service (create and secure accounts, send messages, process bounces and unsubscribes, show reports): performance of our contract with the account holder, and our legitimate interest in operating the service.
  • To honour opt-outs: when someone unsubscribes, bounces or complains, we record it and add the address to suppression lists so it is not mailed again. This is a legal obligation for senders and in everyone's legitimate interest.
  • To provide the business contact database: our legitimate interest, and our account holders', in business-to-business communication, balanced by the professional nature of the data, the right to object at any time, and the account holder's own duty to have a lawful basis before sending.
  • To prevent abuse (reviewing accounts, investigating spam complaints, enforcing our Terms): legitimate interests and legal obligations.
  • To comply with law and respond to lawful requests.

We do not use personal data for automated decisions that have legal or similarly significant effects on anyone.

5. Who we share it with

We share personal data only with service providers that process it for us, under contract, and only as needed:

  • website and application hosting, and database hosting;
  • payment processing (Stripe), which receives billing details when an account holder subscribes;
  • bot protection (Cloudflare Turnstile) on the sign-up form;
  • website analytics (Google Analytics, by Google), on the public pages only and subject to your cookie choice, as described in section 3;
  • the mailbox and delivery providers each account holder connects (for example Google, Microsoft or their own SendGrid account), which send their messages under that account holder's own agreement with that provider;
  • email delivery for our own service messages (such as email confirmation), which sends the messages and reports delivery, bounce, open, click, unsubscribe and complaint events back to us;
  • email address verification, which receives an address only when an account holder asks to check it;
  • an AI model provider, which receives the prompt and campaign context an account holder enters when they ask the assistant to draft copy.

Account holders can see and export the data in their own workspace, including the recipient data and events for their campaigns, and the business contact records they search or add to their lists. We may also disclose data if the law requires it, to protect rights, safety or the integrity of the service, or to a buyer or successor if our business is reorganised or sold, subject to this policy.

We do not sell or share personal information for money or for cross-context behavioural advertising, as those terms are used in the California Consumer Privacy Act as amended by the CPRA, and we have not done so in the past 12 months.

6. Retention

  • Account data: while the account is open, and for a reasonable period after it closes to resolve disputes and meet legal obligations.
  • Contact lists, messages and delivery events: until the account holder deletes them or their account is closed, after which they are deleted in the ordinary course.
  • Suppression records (unsubscribes, hard bounces, complaints): kept for as long as we operate the service, because deleting them would allow the address to be mailed again.
  • Hosting logs: for the short period set by our hosting provider.
  • Google Analytics data: event-level data 2 months, user-level data 14 months, as set out in section 3.

7. Security

We use encrypted connections, hashed passwords, signed session tokens, access controls, AES-256-GCM encryption of stored mailbox credentials and API keys, email confirmation and bot protection at sign-up, and per-workspace separation of data to protect it. No system is perfectly secure, and we cannot guarantee that data will never be accessed without authorisation. If you think your account has been compromised, contact us at once.

8. International transfers

We are based in the United States and our service providers process data in the United States and other countries. Where we transfer personal data from the EU, the UK or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or the UK addendum, or on the provider's certification under the EU-US Data Privacy Framework where available.

9. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, to restrict or object to its use (including objecting to our use of your professional details in the business contact database), to withdraw consent, and to complain to your data protection authority. California residents have the rights to know, delete and correct, to opt out of sale or sharing (we do neither), and not to be treated differently for using these rights.

  • To stop receiving a sender's email, use the unsubscribe link in the message. It is honoured automatically.
  • To have your details removed from the business contact database, or for any other request, email advisor@fih.com from the address concerned, or tell us which address it is. We may need to verify your identity, and we will respond within the time the law requires (usually 30 or 45 days).
  • If your data is in an account holder's list, we will refer your request to them as controller, and help them respond.

You may use an authorised agent, who must show us your signed permission.

10. Children

The service is for businesses and is not directed to anyone under 18. We do not knowingly collect personal data from children under 16. If you believe we have, contact us and we will delete it.

11. Do Not Track

Browsers' Do Not Track signals have no agreed standard, so we do not respond to them. We do honour Global Privacy Control: it switches off Google Analytics as described in section 3. We run no advertising trackers and do no cross-site tracking.

12. Changes and contact

We may update this policy by posting a new version with a new date. If a change is material we will tell account holders by email or in the service. Contact: FIH LLC, advisor@fih.com.

Change log

  • 11 October 2026: added Google Analytics 4 on the public pages (sections 2, 3, 5, 6 and 11). Before this date the site ran no analytics and this policy said so.
  • 4 October 2026: previous version.