Privacy Policy PFM Website & PFM Mobile App

Effective Date: July 29, 2026  |  Last Updated: July 29, 2026

This Privacy Policy explains how Portside, Inc. and its subsidiaries Professional Flight Management, Inc. and PFM Hosting, Inc. (collectively, “PFM,” “we,” “us,” or “our”) collect, use, disclose, and protect information when you use:

• Our website at pfmsys.com and related PFM-operated web properties (the “Website”); and
• Our mobile application PFM Mobile (also labeled “PFM App” on your device home screen), distributed on Google Play under the package name com.portside.pfm_mobile and on the Apple App Store (the “App”).

Together, the Website and the App are referred to below as the “Services.” By using the Services, you agree to the collection and use of information as described in this Privacy Policy.

1. Who We Are & Scope

Professional Flight Management, Inc. (“PFM”) is a business unit of Portside, Inc., providing scheduling, record-keeping, reporting, and flight operations management software (“PFM Platform”) to corporate, private, and government flight departments (our “Clients”). The PFM Mobile app is a companion application that lets authorized employees of our Clients securely access the PFM Platform — trip schedules, flight logs, documents, and the Ops Console — from a phone or tablet.

There is no public self-service sign-up inside the App. Every App account is provisioned in advance by your employer’s PFM administrator or by PFM customer support, and access is limited to individuals with an active, work-related need to use PFM on behalf of a Client. The App is a business-to-business (“B2B”) tool intended for use by adult aviation-industry professionals in the course of their employment; it is not directed at, marketed to, or intended for use by, the general public or children.

When you or your organization enter passenger, crew, or other flight-operations data into the PFM Platform, PFM acts as a data processor/service provider hosting that data on the Client’s behalf — that data belongs to, and is controlled by, your employer or the Client organization. This Privacy Policy addresses PFM's own collection, use, and handling of data as described below; if you have questions about data your employer has entered about you in PFM, please contact your employer's PFM administrator, as described in Section 9.

2. Information We Collect

2.1 Account & Profile Information (App)

To sign in to the App you provide either (a) a PFM username and password, or (b) your organization’s single sign-on (SSO) identifier, which is authenticated through your organization’s identity provider via a secure browser session. Your password is transmitted securely to our servers for authentication and is never stored by the App itself. Once authenticated, PFM returns a user profile that the App uses to personalize your session, which may include:

• Full name, username, and email address
• Mobile and/or office phone number
• Employer/company name and organizational role or access level
• Internal PFM identifiers linking your profile to your employer's flight department records (e.g. Person, Passenger, Crew, or Client reference IDs)

2.2 Authentication & Security Data

• Session tokens & cookies. After you sign in, the App stores an encrypted session/re-authentication token on your device using the operating system's secure storage (iOS Keychain / Android Keystore) so you can stay signed in between visits. These tokens are never readable in plain text and are deleted when you sign out or when your session is revoked.
• Biometric sign-in (Face ID / Touch ID / fingerprint). If you choose to enable biometric sign-in, your device's operating system — not PFM — performs the biometric match entirely on your device. PFM never receives, transmits, or stores your fingerprint, face scan, or any other biometric data. A successful on-device biometric match simply unlocks a securely stored token that is used to resume your PFM session.
• Device integrity signals. Because the App is used to access sensitive flight-operations data, it performs an on-device check for indicators of a compromised device (for example, whether the device is rooted, jailbroken, running in an emulator, or has developer mode enabled). This check runs locally on the device to decide whether to allow the App to load; the result is not transmitted to PFM's servers.

2.3 Camera & Photos

Certain trip-related forms in the App (for example, logging a fuel or catering expense) let you attach a supporting photo or document, such as a receipt. If you use this feature, the App will ask your device's operating system for permission to use the camera or photo library. Any photo you choose to capture or select is uploaded and stored as part of the associated trip record in the PFM Platform, in the same way as any other trip data described in Section 1 — it is used solely to support that record and is not accessed, reviewed, or used by PFM for any other purpose.

2.4 Diagnostics & Troubleshooting Data

The App sends lightweight, first-party diagnostic events to PFM's own servers (never to a third party) to help us troubleshoot sign-in and connectivity issues — for example, when a login attempt, single sign-on check, or app-update check succeeds or fails. These events typically include the action performed, its result, your app version, and, where relevant to diagnosing the issue, your username. This is targeted troubleshooting telemetry, not general behavioral analytics, and is not shared with or sold to advertisers or data brokers.

2.5 Device & Usage Data

Like most software, our servers automatically log standard technical information needed to serve requests securely, such as IP address, device/browser type, operating system version, and app version. On the Website, our web server similarly recognizes your device's domain name and may log which pages you visit.

2.6 Flight & Operational Data (Entered by Your Employer)

Your employer's flight department may enter operational data into the PFM Platform that is visible to you in the App or through the Ops Console — for example, trip itineraries, schedules, crew assignments, and compliance records. Where required for flight operations, this may include passenger or crew details such as name, date of birth, citizenship, and passport information, entered by your employer for regulatory and operational purposes. PFM does not data-mine, analyze, or use this information for its own purposes; it is stored solely to support your employer's flight operations.

We do not knowingly collect or process information about race or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, pay rates or pay scales, genetic data, health or mortality information, or sex life or sexual orientation.

2.7 Cookies (Website Only)

The Website uses cookies and similar browser-storage technologies; see Section 6 below for details. The App does not use browser cookies, but it does use the equivalent secure on-device storage described in Section 2.2 to keep you signed in.

3. PFM Mobile App Permissions

The table below summarizes the device permissions the App may request, and exactly why each one is needed. The App only requests a permission immediately before the related feature is used, and you can decline any permission — the corresponding feature (e.g., attaching a receipt photo) simply won't be available until you grant it.

Permission	Why the App requests it	Sent to PFM?
Internet / Network access	Required for the App to communicate with PFM's servers over an encrypted (HTTPS) connection — the App cannot function offline.	N/A — this is the transport channel itself
Camera / Photo Library	Lets you take or choose a photo of a receipt or supporting document to attach to a trip record (Section 2.3).	Yes, only the specific photo you choose to attach
Face ID / Biometric hardware	Lets you unlock your saved PFM session with your face or fingerprint instead of retyping your password (Section 2.2).	No — matching happens entirely on your device

The App does not request access to your location, contacts, microphone, calendar, SMS/call logs, or installed-app inventory, and does not include any advertising or third-party analytics SDKs.

4. How We Use Information

We use the information described above to:

• Authenticate you and maintain a secure session in the App;
• Provide, operate, and personalize the Services, including displaying your trip schedules, documents, and Ops Console tools;
• Attach photos or documents you choose to submit to the correct trip record;
• Diagnose and troubleshoot sign-in, connectivity, and app-update issues;
• Maintain the security and integrity of the Services, including detecting compromised devices and preventing unauthorized access;
• Communicate with you about your account, support requests, or important changes to the Services;
• Improve the content, usability, and reliability of the Website and App; and
• Comply with legal obligations and enforce our agreements and policies.

We do not use any of the data described in this policy to serve you third-party advertising, and we do not perform automated decision-making that produces legal or similarly significant effects about you.

5. How We Share Information

We do not sell your personal information, and we do not share it with third parties for their own advertising or marketing purposes. We share information only in the following limited circumstances:

• With your employer / Client organization. Because the App and PFM Platform are provisioned by your employer, your employer's designated administrators can access account and operational information associated with your use of PFM in connection with their flight department's operations.
• Service providers. We may use vetted vendors (e.g., secure cloud hosting) that process data solely on our behalf and under contractual confidentiality and security obligations, and never for their own independent purposes.
• Interfaces you or your Client choose to use. The Ops Console can optionally interface with third-party aviation services your organization subscribes to (such as Baldwin Safety, ForeFlight, uvGo, Pulsar, FlightBridge, or iFlightPlanner). Data is only exchanged with these providers if your organization has configured that integration, and each provider's own privacy policy governs its handling of that data.
• Legal & safety reasons. We may disclose information if required by law, subpoena, or governmental request, or when we believe disclosure is necessary to protect the rights, property, or safety of PFM, our Clients, or others, or to investigate fraud or a security incident.
• Business transfers. If PFM or Portside, Inc. is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, subject to appropriate confidentiality protections.

6. Cookies (Website)

When you visit our Website, we may use cookies to recognize your browser, keep you signed in to a client web portal, and remember your preferences. We also use Google Analytics, a third-party analytics cookie/service, to gather aggregate statistics on visits and page views so we can understand and improve how the Website is used. Using Google Analytics means certain cookie-derived visit data (such as pages viewed, approximate location, and device/browser type) is sent to and processed by Google as our analytics provider, under Google's own privacy policy; other than through Google Analytics, we do not share cookie-derived website logs with third-party companies for their own independent use. This information is not linked to your identity except where a cookie is used for account sign-in or security purposes.

A cookie banner on our Website lets you choose whether to accept these cookies before any analytics data is sent; declining ("Leave Site") means no Google Analytics pageview is recorded for that visit. You can also configure your browser to refuse cookies at any time, and you can install the Google Analytics Opt-out Browser Add-on to prevent your data from being used by Google Analytics across any site. Some Website features may not work correctly if you refuse cookies.

7. Data Security

We use industry-standard safeguards designed to protect the information described in this policy, including:

• Encryption of data in transit using HTTPS/TLS for all communication between the App, the Website, and our servers;
• Secure, OS-level encrypted storage (iOS Keychain / Android Keystore) for session tokens on your device — plaintext passwords are never stored on the device;
• On-device detection of rooted, jailbroken, or emulated devices to reduce the risk of the App running in a compromised environment; and
• Administrative and physical safeguards at our hosting facilities designed to prevent unauthorized access to, or loss, misuse, or alteration of, information we hold.

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting your personal information, we will notify affected Clients and individuals as required by applicable law.

8. Data Retention

We retain the information described in this policy only for as long as reasonably necessary for the purposes described above, including:

• Account and profile information — for as long as your PFM account remains active, plus a limited period afterward in case it needs to be reinstated by your employer;
• Trip, receipt, and other operational records — for the retention period required by your employer's operational and regulatory (e.g., aviation record-keeping) obligations;
• Diagnostic/troubleshooting logs — for a limited period sufficient to investigate and resolve technical issues, after which they are deleted or de-identified; and
• Any other information — as required to comply with our legal obligations, resolve disputes, and enforce our agreements.

9. Your Choices & Rights

• Marketing communications. If you receive promotional communications from PFM about products, services, or events and would like to opt out, email pfm@portside.co and tell us which channel(s) (email, postal mail, phone) to stop using.
• Access & correction. To review or correct account information we hold about you, contact us using the details in Section 15. If your data is held within your employer's PFM database (e.g., trip or crew records), we will coordinate with your employer to fulfill access requests, since that data is controlled by your employer.
• Biometric & camera features are optional. You can use the App with a standard username/password sign-in without ever enabling biometric sign-in or granting camera access; declining either does not prevent you from using the rest of the App.
• Cookies. See Section 6 for your browser-level cookie choices on the Website.

10. Account & Data Deletion

Because PFM Mobile accounts are provisioned by your employer's PFM administrator rather than self-registered in the App, the fastest way to have your account and associated PFM data deleted is usually through your employer's PFM administrator. You, or your administrator, can also request deletion directly from PFM at any time by:

• Emailing pfmsupport@portside.co with the subject line “Account Deletion Request,” including your name, username, and employer/Client name; or
• Calling PFM customer support at (610) 668-1655; or
• Writing to us at the postal address in Section 15.

Upon a verified deletion request, we will delete your PFM user account and the personal information associated with it, rather than merely disabling or freezing the account — except where we are required or permitted to retain certain information, such as:

• Operational flight, safety, or crew/passenger records your employer is required to retain under aviation regulatory requirements;
• Information needed to complete a transaction, resolve a dispute, or enforce our agreements; or
• Information we must retain to comply with a legal obligation.

Where any such data is retained, it will be retained only for as long as necessary for that purpose and handled in accordance with this Privacy Policy.

11. Children's Privacy

Our Services are a business tool intended for use by adult aviation professionals acting within the scope of their employment and are not directed at, marketed to, or intended for use by, children under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact our Privacy Officer using the information in Section 15 and we will take reasonable steps to delete it.

12. International Data Transfers

PFM complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework, as set forth by the U.S. Department of Commerce, regarding the collection, use, and retention of personal information transferred from the European Union, the United Kingdom (including Gibraltar), and Switzerland to the United States. PFM has self-certified to the U.S. Department of Commerce that it adheres to the DPF Principles; if there is any conflict between this Privacy Policy and the DPF Principles, the DPF Principles govern. Learn more about the DPF program and view PFM's certification at dataprivacyframework.gov. PFM is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission.

EU, UK, and Swiss individuals with an inquiry or complaint about our handling of personal information under the DPF should first contact us at ciso@portside.co or the postal address in Section 15. PFM has further committed to refer unresolved DPF complaints to the independent dispute resolution mechanism operated by BBB National Programs, free of charge — visit bbbprograms.org for details. Under certain conditions, you may also invoke binding arbitration for residual claims not resolved through other means; see Annex I of the DPF Principles.

13. Third-Party Interfaces & Links

The Ops Console within the App can optionally connect to third-party aviation partner services your organization subscribes to (for example, Baldwin Safety, UAS, ForeFlight, uvGo, Pulsar, Feasibility-IQ, FlightBridge, or iFlightPlanner). The Website may also link to third-party sites. This Privacy Policy does not cover, and PFM is not responsible for, the privacy practices of any third-party service or website; we encourage you to review their privacy policies directly.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Services, or applicable law. Material changes will be posted on this page with an updated “Last Updated” date above. We encourage you to review this page periodically. Your continued use of the Services after a change becomes effective constitutes acceptance of the updated policy.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Professional Flight Management, Inc. (a Portside, Inc. company)
Attn: Privacy Officer
964 High House Road #34
Cary, NC 27513
Phone: (610) 668-1655
General & Privacy Inquiries: pfm@portside.co
Customer / Account Support: pfmsupport@portside.co
Data Privacy Framework Inquiries: ciso@portside.co