How SANS.AI Is Deployed and Why It Matters

SANS.AI can be deployed in three ways, and the deployment model determines how much of your data we hold. This is the first thing to establish, because the rest of this policy applies differently in each case.

Our Role: Controller and Processor

For most of what SANS.AI does, your organization decides what data enters the platform and why. In that situation your organization is the controller and we act as a processor on its documented instructions. We act as a controller for a narrow set of activities that we decide ourselves.

If your data reached us because an airport, airline or employer supplied it, that organization is the controller. We will pass any request you make to them without undue delay and help them answer it, and we will tell you that we have done so.

Information We Collect

Information You Provide

We collect information you provide directly to us when you create an account, complete a form or survey, contact our support team, configure the platform, or input data into it. This may include:

• Contact information (name, business email address, telephone number)
• Professional information (job title, employer, department, operational role)
• Account credentials, including the salted hash of your password and multi-factor authentication enrollment data
• API credentials, including OAuth 2.0 client identifiers and secrets and API keys issued to you
• Notification preferences, including priority thresholds, working hours, focus areas and preferred delivery channels
• Dashboard personalization, saved views and layout settings
• Support tickets, correspondence and any attachments you send us
• Billing and subscription contacts

Information We Collect Automatically

When you use the Services we automatically record information about that use:

• Log data (internet protocol address, request timestamps, endpoints and pages accessed, session duration, response codes)
• Device information (hardware model, operating system, browser type and version, screen resolution, language)
• Usage analytics covering features opened, actions taken and navigation sequence
• Diagnostic data, including error traces, crash reports and connectivity logs
• API request metadata, including request identifiers and rate limit counters
• Location within the airport for users of the mobile app, where you have enabled location services, so that alerts can be made location aware
• Notification handling records, including whether an alert was delivered, acknowledged and how quickly, which the platform uses for escalation and reporting

Cookies and Similar Technologies

We use cookies and comparable technologies on our public web properties. Strictly necessary technologies are used without consent because the site cannot function without them. Other categories are set only where you have given consent, or where local law permits another basis.

• Strictly necessary: authentication, session integrity, load balancing and security tokens
• Preference: remembering language, region and display settings
• Analytics: understanding aggregate usage so that we can prioritize improvements
• Performance: measuring page load times, error rates and responsiveness

You can withdraw or change consent at any time through your browser settings or our cookie preference control. We honor recognized opt-out preference signals where the law requires it.

Operational Data We Receive From Your Systems

SANS.AI connects to multiple sources to build a unified operational picture. Depending on which modules you enable, we may receive:

• Automatic dependent surveillance broadcast (ADS-B) feeds carrying aircraft positions and telemetry
• Airport Operational Database records containing scheduled flight information
• Air traffic control data, including runway assignments and approach data
• Airline system data, including gate assignments, aircraft details and boarding status
• Weather observations and forecasts
• Gate, stand, belt and check-in counter allocation history and rule configurations
• Ground service equipment, baggage, fueling, catering and maintenance resource records
• Data exchanged with Airport Collaborative Decision Making platforms, flight and gate information display systems, ground handler systems and asset management systems
• And related airport, flight and resources data

This data is mostly about aircraft, infrastructure and schedules rather than about people. Some fields can relate to an identifiable person, for example the name of a rostered crew member or ground agent, and where that happens we treat those fields as personal data.

LiDAR Passenger Flow Data

Where an airport operates LiDAR sensing in its terminals and connects it to SANS.AI, those sensors measure passenger movement and the airport's edge processing units carry out preliminary analysis locally before any data reaches the platform. What the platform receives is the processed output of equipment the airport controls. From this we derive:

• Real-time passenger density across terminal zones
• Common movement paths and flow dynamics
• Dwell time in different zones
• Queue lengths and wait times
• Congestion and bottleneck locations
• Anomalous crowd behavior indicators used for safety alerting

Insights derived from LiDAR are also used for terminal layout, service point placement, security and check-in capacity planning, and analysis of foot traffic in commercial areas. If your organization uses flow data for retail or commercial purposes, that is a decision your organization makes as controller, and you should reflect it in the privacy notice you give to passengers. As the operator of the sensing equipment, your organization is also responsible for any notice, signage or impact assessment that local law requires in respect of the sensors themselves.

Personnel and Workforce Data

The Resource Optimization module produces staffing recommendations. To do that it processes data about the people working in your operation, which may include:

• Staffing demand forecasts derived from operational patterns
• Deployment and reallocation records showing where personnel are assigned
• Skill and qualification categories, used to match staff to operational areas
• Workload distribution across teams
• Data used to check adherence to working time regulations and safety requirements

SANS.AI produces recommendations and is designed to pass detailed scheduling and time tracking to a specialist workforce management system. Where we exchange data with such a system, we do so on your instructions and under your contract with that provider.

Information We Ask You Not to Send Us

The platform does not require the following categories, and we ask customers not to transmit them unless a separate written agreement expressly provides for it:

• Passenger name records, booking references or other data identifying an individual traveler
• Payment card numbers or cardholder authentication data
• Passport, national identity or other government issued document numbers
• Biometric identifiers, including facial images processed for identification
• Health data, including requests for assistance from passengers with reduced mobility
• Any other special category data as defined by the General Data Protection Regulation

If we become aware that such data has reached us, we will notify you without undue delay, restrict access to the affected records and delete them, unless you direct otherwise in writing and a lawful basis exists for keeping them.

How We Use Information

We use the information we collect to:

• Provide, maintain, secure and improve the Services
• Track flights and present operational status across map, timeline, list and gate views
• Generate predictions and forecasts, and measure their accuracy against actual outcomes
• Detect operational anomalies and support safety monitoring, including runway incursion and aircraft separation alerting
• Analyze passenger flow and produce terminal and resource optimization recommendations
• Compose and deliver notifications, including generating notification text automatically
• Prioritize, route and escalate notifications based on role, activity, location and configured preferences
• Administer accounts, process transactions and manage subscriptions
• Respond to support requests and diagnose faults
• Monitor and analyze usage patterns and trends
• Protect against, identify and prevent fraud, abuse and other illegal activity
• Comply with our legal obligations

Automatically Generated Notification Content

The platform uses natural language generation to compose notification text, including a summary of the situation, its operational impact, recommended actions and supporting data. This text is produced automatically and is adapted in length to the delivery channel. It is operational guidance for trained staff and should be verified before it is acted upon.

Decisions About Individuals

We do not use the Services to make decisions about individuals based solely on automated processing that produce legal effects or similarly significant effects on them. The models operate on aircraft, resources, schedules and infrastructure. Where staffing recommendations affect an individual, a human makes the decision.

How Our AI Models Learn

SANS.AI improves over time. Because this involves your operational data, we set out how it works.

• Accuracy feedback: actual outcomes are compared against earlier predictions so that the models can be corrected. This happens within your own deployment.
• Model refinement: we periodically update the prediction engines and release improved versions.
• Benchmarking: we monitor prediction accuracy and publish the resulting statistics to your dashboard.
• Learning across airports: patterns observed at one airport can improve forecasts at airports with similar characteristics.

Model versions are recorded together with the data and configuration that produced them. Deployed models are monitored for accuracy degradation, and material changes are reviewed by a person before release. On request we will describe the features a model uses and how they are weighted, at a level of detail suited to your assurance obligations and without disclosing source code or model weights.

How We Share Your Information

We share information only in the circumstances described below.

• Service providers and sub-processors: vendors who perform services on our behalf, including cloud infrastructure, monitoring, support ticketing, analytics, identity management, backup, and delivery of email, SMS and push notifications. They act on our documented instructions under written contract. A current list is available on request.
• Systems you connect us to: where you configure an integration or a webhook, the platform sends data to the destination you nominate, such as an airline system, a ground handler system, an A-CDM platform, a display system or a workforce management system. You control those destinations and are responsible for the arrangements governing them.
• Professional advisors: accountants, attorneys, auditors and insurers bound by confidentiality obligations.
• Legal authorities: in response to a subpoena, court order, regulatory demand or other legal process, or where necessary to protect rights, property or safety. Where we are legally able to, we will tell you before disclosing your data.
• Business transfers: in connection with a merger, acquisition, financing, reorganization, insolvency or sale of assets, subject to the recipient continuing to protect the information.
• With your consent: with any other recipient where you have asked us to share.

We do not sell or rent personal information, and we do not share it for cross context behavioral advertising. We do not use customer operational data to target advertising.

Notifications and Communications

The platform can reach you through several channels, and each involves different data:

You can set priority thresholds, working hours, focus areas and preferred channels in the notification settings panel. Critical safety and operational alerts override those preferences and cannot be disabled, because they are necessary for safe operations. Your administrator configures the override rules.

Marketing messages are separate from operational notifications. We send them only with consent or where local law otherwise permits, and you can opt out at any time without affecting the operational alerts you receive.

Data Security

We implement technical and organizational measures appropriate to the risk. These include:

• Encryption of data in transit using Transport Layer Security 1.2 or higher
• Encryption of data at rest using the Advanced Encryption Standard with 256 bit keys
• OAuth 2.0 and API key authentication for programmatic access, with scoped permissions
• Role based access control applied on least privilege, with multi-factor authentication for administrative access
• Logical segregation of customer environments, so that access to one does not confer access to another
• Comprehensive audit logging, monitoring and alerting
• Rate limiting on API endpoints to protect availability
• Secure development practices including code review, dependency scanning and static analysis
• Vulnerability scanning, and independent penetration testing carried out periodically
• Encrypted backups with tested restoration procedures
• Security and privacy training for personnel, and written confidentiality undertakings

Processing for cloud deployments takes place in data centers operated by major cloud providers, which maintain their own physical access controls and independent certifications. For on-premises deployments, physical security of the servers is your responsibility.

No security system is impenetrable, and we cannot guarantee the absolute security of your information. You are responsible for keeping account credentials and API secrets confidential, for provisioning and promptly removing your own users, and for the security of the devices from which you connect. Please tell us immediately at contact@kquika.com if you believe an account or key has been compromised.

If Something Goes Wrong

We maintain a documented incident response plan. If a personal data breach affects your data, we will notify you without undue delay and in any event within 48 hours of becoming aware of it. Where we are the controller and the breach is likely to result in a risk to individuals, we notify the competent supervisory authority within 72 hours. Where a breach is likely to result in a high risk to individuals, we notify those individuals directly. Please keep your nominated security contact up to date, since an out of date contact is the most common cause of delay.

Data Retention

We keep information only for as long as we need it, unless a longer period is required or permitted by law. In deciding how long to keep information we consider its amount, nature and sensitivity, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process it, and applicable legal requirements.

On termination we return your data in an agreed machine readable format or delete it, at your election. Copies held in backups are removed as those backups expire on the rolling cycle, and remain encrypted and untouched in the meantime. A certificate of deletion is available on request. When we no longer need information, we delete it securely or anonymize it so that it can no longer be associated with an individual.

Safety Data and Incident Reporting

The safety modules monitor for runway incursions, aircraft separation, and other operational risks, and they support safety analysis and reporting after an event. Records generated in this way can identify individual crew or ground personnel.

We process this data on your instructions and apply the same access controls and audit logging as for other operational data. Safety reporting regimes in many countries protect the confidentiality of individuals who report occurrences. Where such a regime applies to you, tell us during configuration so that access to the relevant records can be restricted appropriately.

Your Rights and Choices

Depending on where you live, you may have some or all of the following rights regarding your personal information:

• Access: obtain confirmation of whether we process data about you, a copy of it, and information about how it is used
• Correction: have inaccurate data corrected and incomplete data completed
• Deletion: have data deleted where it is no longer needed, consent is withdrawn, or processing is unlawful
• Restriction: have processing limited while a dispute about accuracy or lawfulness is resolved
• Portability: receive data you provided in a structured, commonly used, machine readable format
• Objection: object to processing based on legitimate interests, and object at any time to direct marketing
• Withdraw consent: at any time, where processing is based on consent
• Opt out: of any sale or sharing of personal information, and limit the use of sensitive personal information
• Non-discrimination: receive the same service whether or not you exercise a privacy right
• Complain: lodge a complaint with the supervisory authority in your country

To exercise these rights, contact us at contact@kquika.com. We will acknowledge your request, verify your identity by proportionate means, and respond within one month where the General Data Protection Regulation applies, extendable by two further months for complex requests. Where a United States state law applies, we respond within 45 days, extendable once by a further 45 days. There is no charge unless a request is manifestly unfounded or excessive, in which case we will tell you the reason before proceeding.

If we hold data about you because your employer or an airport supplied it, that organization decides how it is used. We will forward your request to them without undue delay and assist them in answering it. Please also contact them directly, since they are best placed to respond.

International Data Transfers

We are established in the United States and our primary processing infrastructure is located there. Regional hosting within the European Union or Japan is available on request and is agreed in your order form.

Where personal data is transferred out of a territory whose law restricts international transfer, we rely on one of the following:

• Adequacy: a decision by the relevant authority that the destination country provides an adequate level of protection
• Standard Contractual Clauses: the clauses adopted by the European Commission in Implementing Decision (EU) 2021/914
• United Kingdom Addendum: the International Data Transfer Addendum issued by the Information Commissioner's Office
• Derogations: used only in exceptional and non-repetitive cases, and recorded when relied upon

The European Union and Japan maintain reciprocal adequacy findings. Where we process data originating from a Japanese airport operator or airline, we do so in accordance with the Act on the Protection of Personal Information, including its requirements on notice, on provision of data to a third party, and on transfer to a party in a foreign country.

We carry out and document transfer impact assessments, and we apply supplementary measures including encryption, restricted and logged access to production data, and a policy of reviewing every government access request for validity and challenging any request that is overbroad or unlawful.

Children's Privacy

Our Services are built for aviation professionals and the organizations that employ them, and they are not directed to children. We do not knowingly collect personal information from children under the age of 16, or under the applicable age of digital consent where that age is different. If we learn that we have collected such information, we will promptly delete it. A parent or guardian who believes a child has provided us with personal information should contact us at contact@kquika.com.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by posting a notice on our website before the changes take effect, and we will update the date at the top of this page. A change that reduces the protection given to personal information will not be applied retroactively to data already collected. We encourage you to review this page periodically.

Contact Us

If you have any questions or concerns about this Privacy Policy or our privacy practices, please contact us at: