Privacy policy

1. Who we are

N1099.com LLC (“n1099”, “we”, “us”) operates n1099.com, a free invoicing and receivables service for contract pilots and the owners, operators and flight departments that pay them. We are the controller of the personal data described here. This policy applies to the website, the web app, invoice links and email we send on your behalf. Questions go to privacy@n1099.com.

2. What we collect

Account data

Your email address, display name, home base and time zone. You sign in with an emailed link; there is no password to store.

Business data you enter

• Clients and contacts: company names, contact names, emails, phone numbers and billing addresses.
• Aircraft: registration (N-number), type and category.
• Trips: dates, route, role, duty days, notes.
• Rate cards: day rates, per diem, allowances and terms per client or aircraft.
• Invoices, invoice lines, payments and reminder history, including payments reported by the people you invoice.
• Receipts and documents you attach (photos or PDFs).
• Payment instructions you choose to print on invoices (for example a bank name, routing and account number). Only you decide what appears there, and it is shown to the people you send the invoice to.

Data about how the service is used

• Access logs: IP address, browser type, timestamps and the pages or actions requested. Used for security, rate limiting and debugging.
• Audit events: a record of meaningful changes (for example “invoice sent”, “payment recorded”, “link revoked”) with who did it and when, so you and your clients can trust the invoice history.
• Email delivery events from our email provider: delivered, bounced, complained or failed, as the recipient’s mail system reports them. We use these to show you whether an invoice reached its destination. We do not track whether an email is opened or a link inside it is clicked.
• Copies of the email the service sends for you (sign-in links, invoices, reminders), kept so you can see what went out and so we can investigate delivery problems.

What we do not collect

We do not run advertising or analytics trackers, do not fingerprint devices, and do not pull data from ADS-B, flight tracking or any other external source about your flying. We do not ask for or store government ID, pilot certificates or medical information.

3. How we use it, and on what basis

• To run the service you asked for: create invoices, deliver them, send the reminders you schedule, show you receivables and let the people you invoice respond. Basis: performance of our agreement with you.
• To secure the service: detect abuse, enforce limits, investigate incidents. Basis: our legitimate interest in a safe service.
• To support you: when you write to us, we look at your account to help. Basis: performance of our agreement.
• To improve the product, using aggregate, de-identified usage (for example how many invoices are sent per week), never your clients or rates. Basis: legitimate interest.
• To send you service email: sign-in links, invoice events, security and legal notices. We do not send marketing email unless you opt in, and every marketing email has an unsubscribe link. Basis: performance of our agreement; consent for marketing.
• To comply with law, including responding to lawful requests. Basis: legal obligation.

We do not use your data for automated decisions that have legal or similarly significant effects on you.

4. How invoice links work

When you send an invoice, n1099 creates a link that contains a long random token. Anyone with the link can view that one invoice, download its PDF, approve or dispute it and report it paid. The token is tied to a single invoice; it cannot be used to see anything else about you.

• Links expire 180 days after the invoice is sent unless you regenerate them. You can revoke or regenerate a link at any time; a revoked link shows “This link is no longer active” and nothing else.
• We record when a link is opened (time and IP address) and show it to you as “Viewed”, so you know the invoice arrived.
• Forwarding the link forwards access. If an owner forwards it to their bookkeeper, the bookkeeper can see that invoice. If that is a problem, revoke and resend.
• A person who acts on a link enters their name, and we show it to you with the action they took. If they tick “Remember my name on this device”, we keep the name in a cookie on their device for a year so they do not have to retype it; otherwise nothing is stored on their device.

5. Who can see what

n1099 keeps pilot and owner data in separate tenants, and sharing between them is explicit:

• You see everything in your own account.
• An owner you invoice sees the invoices you sent them, the trips you shared with them, and your name and billing details as shown on the invoice. They do not see your other clients, your rate cards, your other invoices or your income.
• An owner who invites you to their roster sees that you accepted and the assignments they offered you. Nothing else.
• Other pilots see nothing about you. There is no pilot directory.
• We access your data only to operate the service, to respond to your requests, or when required by law.

We do not build, publish or sell a directory of pilots, owners or relationships from invoice data. A feature that makes a profile visible to operators exists only if you opt in to it explicitly, and it is off by default.

6. Who we share with

We share data with service providers only as needed to run n1099, under contracts that limit their use of it to providing their service to us. Today they are:

• Resend delivers email (sign-in links, invoices, reminders). They receive recipient addresses, subject and body, and report delivery events back to us.
• Control Plane hosts the application and database in the United States.
• Cloudflare provides DNS and the object storage that holds receipts, generated PDFs and encrypted database backups, in North America, accessed only through authenticated routes.

We do not sell personal data and do not share it with advertisers or data brokers. We disclose data when a court order or other lawful process requires it, and we tell you unless we are legally barred from doing so. If the business is sold or merged, data transfers with it under this policy, and we notify account holders.

7. Where data lives and international transfers

The service runs in the United States. If you use it from outside the United States, including the EU or the UK, your data is transferred to and processed in the United States. For transfers from the EU and UK we rely on standard contractual clauses with our providers and on the fact that the service is provided at your request.

8. Retention and deletion

• Your data is kept while your account is active.
• Delete your account from settings. Your data is removed from live systems within 30 days and from backups within 90 days.
• Invoices you have already sent remain available to the owner for their own records (their copy, in their tenant), the same way a PDF you emailed would. Your identity on them is limited to what the invoice shows.
• Audit and access logs are kept for 12 months for security purposes, then deleted.
• The content of email sent for you is kept for 12 months, then removed; the fact that an email was sent, to whom and whether it was delivered is kept with the invoice history.
• We may keep de-identified aggregates that cannot be linked to you.

9. Cookies and local storage

We set only cookies the service needs to work, plus one that a person turns on themselves, and nothing for advertising or analytics. For that reason we do not show a cookie banner; the law in the EU, the UK and California requires consent only for cookies that are not strictly necessary, and the one optional cookie is set only when you ask for it.

Referral links (/r/CODE) set no cookie: the code travels inside your sign-in request and is credited when you use the link. The app also uses your browser’s cache for the installable-app shell (so the public site loads offline) and session storage for a one-time reload after an error. Nothing stored this way identifies you to us. You can clear cookies and site data in your browser at any time; doing so signs you out.

10. Your rights and controls

• Export: CSV of trips, invoices and payments, and PDF of every invoice, from settings, at any time, free.
• Correct: edit anything in your account. Sent invoices are versioned, so corrections create a new revision and keep the old one.
• Revoke: any invoice link, at any time.
• Delete: your account and all its data, from settings.
• Ask: email privacy@n1099.com for anything you cannot do yourself. We answer within 10 business days and within any shorter period the law requires.

California residents

Under the California Consumer Privacy Act, as amended, you have the right to know what personal information we collect, use and disclose; to access it; to correct it; to delete it; to limit the use of sensitive personal information (we collect none); to opt out of the sale or sharing of personal information (we do neither); and not to be discriminated against for exercising these rights. The categories we collect are identifiers (name, email, phone), commercial information (clients, invoices, payments), internet activity (access logs) and professional information you enter (trips, rates, aircraft). We collect them directly from you and from the people who respond to your invoices, for the purposes in section 3, and we disclose them only to the service providers in section 6. We have not sold or shared personal information in the preceding 12 months. To exercise a right, use the controls in settings or email privacy@n1099.com; we verify requests by confirming control of the account email, and an authorized agent may act for you with written permission.

EU and UK residents

You have the rights of access, rectification, erasure, restriction, portability and objection under the GDPR and UK GDPR, which you exercise through the same controls and address. Where processing relies on consent you can withdraw it at any time. You can also lodge a complaint with your local supervisory authority.

11. Security

Data is encrypted in transit and at rest, access is scoped per account, and invoice links are unguessable random tokens. Our security page describes the practices in detail and how to report a vulnerability. No system is perfectly secure; if a breach affects your data we notify you as the law requires.

12. Children

n1099 is for working pilots and the businesses that hire them and is not directed at anyone under 18. We do not knowingly collect data from children.

13. Changes

When this policy changes in a way that matters, we email account holders before the change takes effect and keep the previous version available on request. The version and date are at the top of this page.

14. Contact

Privacy questions: privacy@n1099.com. Security reports: security@n1099.com. See also our terms and security practices.