Legal

Privacy Policy

Version 1.0 Published 11 October 2026

⚠️ STATUS: GOOD-FAITH INTERIM VERSION 1.0 — NOT YET REVIEWED BY LEGAL COUNSEL

This Privacy Policy is published in good faith by Umifly to replace the "not yet published" placeholder that previously appeared in our Terms & Conditions (Article 27), and to give our customers a real, honest account of how we handle personal data while the Service is live.

It is not a final, lawyer-reviewed legal document. It is a genuine, best-effort attempt by Umifly to describe our actual data practices accurately and to meet our transparency obligations under the GDPR and under the Meta/WhatsApp Business Messaging Policy (which requires us to maintain a published privacy policy to use WhatsApp for the Service) while a full legal review is pending. Specific points — including exact retention periods, the precise consent mechanism for special category data described in Article 3, and whether a formal Data Protection Impact Assessment or Data Protection Officer appointment is required — are flagged below as items under active legal review and will be updated as that review concludes. Where a number or period is still being finalised, this Policy says so explicitly rather than guessing.

This Policy does not constitute legal advice to you, and nothing in it should be read as a representation that Umifly's data processing has been certified, audited, or approved by a lawyer, a regulator, or any third party. If you have concerns about how your personal data is handled, please contact us using the details in Article 16, or contact the Autoriteit Persoonsgegevens (Article 11).

0. How this Policy relates to our Terms & Conditions

This Privacy Policy should be read together with Umifly's Terms & Conditions ("Terms"). Terms that are defined in Article 2 of the Terms — including Service, User, Consumer, Business User, Package, Access Period, Guidance, AI, Third-Party Platform, Content, System Records, and Checkout Confirmations — have the same meaning in this Policy, unless this Policy defines them differently. In this Policy, "you" and "your" mean the User, and "we", "us", and "our" mean Umifly.

Where the Terms and this Policy conflict on a matter of personal data processing, this Policy prevails, consistent with Article 27 of the Terms.

This Policy applies to personal data processed in connection with umifly.com, our checkout process, our WhatsApp-based guidance Service, and any related digital systems, databases, and support channels operated by Umifly.

1. Who we are — controller identity

The data controller responsible for the personal data described in this Policy is:

Legal business name: Umifly
Trading name: Umifly
Chamber of Commerce (KvK) number: 92281168
VAT number: NL004947530B56
Registered address: Rigastraat 89, 3542 ED Utrecht, Netherlands
Email: support@umifly.com
Website: https://umifly.com

For the personal data collected through our checkout, our website, and our WhatsApp-based guidance Service, Umifly is the data controller under the GDPR (Algemene Verordening Gegevensbescherming / AVG). This means Umifly — not Meta/WhatsApp, not our payment processor, and not any third-party AI provider — decides what personal data is collected and why.

Meta (WhatsApp Business Platform) and Stripe act as independent processors and, for certain limited purposes under their own terms, as independent controllers of parts of the data that passes through their systems — this is explained further in Articles 6 and 7. Any third-party large language model provider we use acts as our processor for the purpose of generating AI-assisted responses, as explained in Article 5.

Because Umifly is established in the Netherlands, the GDPR applies to our processing of your personal data regardless of where in the world you are located when you use the Service (GDPR Article 3(1)).

2. What personal data we collect

We collect the following categories of personal data:

(a) Checkout and account data. When you purchase or activate a Package, we collect your name, email address, WhatsApp phone number (including country code), country, language preference, the Package you selected, and the Checkout Confirmations you provide (acceptance of the Terms, acknowledgement of this Policy, digital-delivery consent where applicable, and optional marketing consent), together with the related timestamps and version records described in the Terms' "Checkout Records and Consent Evidence" section. We also collect the number of travelers you indicate at checkout. If you choose to fill in the optional "Notes or questions" field at checkout, we also collect what you write there. Because this is a free-text field, it may incidentally contain the same kinds of sensitive information described in Article 3 (for example health-adjacent information, location information, or information about companions you are travelling with).

(b) Payment data. Payment is processed by Stripe. We receive confirmation that payment was made, the amount, the Package purchased, the payment status, and a payment/transaction reference. Umifly does not collect, see, or store your full card number, card security code, or other full payment card details. See Article 7.

(c) WhatsApp conversation content. This includes the messages you send to and receive from our AI-assisted guidance Service, including questions, preferences, travel context, location-related queries (for example about restaurants, pharmacies, transport, or prayer times), any documents or images you choose to send, and the AI-generated responses sent to you. See Articles 3, 5, and 6 for more detail on how this content is processed.

(d) Technical and system data. This mirrors the "System Records" described in Article 29 of the Terms, and includes: message metadata and timestamps, delivery and read-receipt events from WhatsApp, activation and onboarding events, Access Period start/end dates, rate-limiting and abuse-prevention signals, support and recovery requests, AI processing events (for example which AI workflow handled a message), and — where lawfully collected, such as when you use our website — IP address, device/browser information, and user-agent data.

(e) Marketing and consent records. If you give optional marketing consent at checkout, we record that consent, its timestamp, and your subsequent unsubscribe/opt-out status. We also keep records of which version of the Terms and this Policy you accepted or acknowledged, and when.

We do not knowingly collect special categories of personal data beyond what is described in Article 3, and we do not collect personal data from children in the manner described in Article 12.

3. Special category data: religious practice, and incidental health or location data

This is the most important disclosure in this Policy, and it is specific to Umifly's business — it is not boilerplate.

Why this applies to you. The Service exists to support pilgrims performing Umrah. By purchasing a Package and using the Service, you necessarily disclose to us that you are undertaking, or preparing to undertake, Umrah — a religious practice. Under GDPR Article 9, data that reveals a person's religious beliefs or practice is a "special category" of personal data, which requires a specific lawful basis in addition to the ordinary lawful bases described in Article 4 below.

What else may incidentally be disclosed. Because our guidance covers practical, on-the-ground questions, your conversation content may also incidentally include:

health-adjacent information (for example, questions about pharmacies, physical readiness, mobility, or medication while performing Umrah rites);
precise, real-time location information (for example, when asking for directions, nearby prayer times, or local services); and
information about companions you are travelling with (for example names, relationships, or needs of family members or travel companions mentioned in your messages).

Legal basis used. Umifly processes this special category data on the basis of your explicit consent, in accordance with GDPR Article 9(2)(a). We ask for this consent as part of the Checkout Confirmations and WhatsApp onboarding flow described in the Terms (including the Privacy Acknowledgement and, where applicable, the first WhatsApp start message), on the understanding that completing checkout and beginning a WhatsApp conversation with our AI-assisted guidance Service necessarily and knowingly discloses your engagement in Umrah to us for the purpose of receiving that guidance. You may withdraw this consent at any time by stopping use of the Service and contacting us at support@umifly.com; withdrawing consent will end your ability to receive guidance through the Service and does not affect the lawfulness of processing carried out before withdrawal.

What we are still reviewing. As part of our ongoing legal review (see the status banner above), we are assessing, with counsel, whether:

our consent mechanism for this specific category of data should be made into its own clearly labelled, separate checkbox at checkout (distinct from general Terms acceptance and the general Privacy Acknowledgement), rather than relying on the current checkout flow and the nature of the Service itself; and
a formal Data Protection Impact Assessment (DPIA) under GDPR Article 35 is required, given the combination of special category data, location data, and consumer-scale processing involved. At the time of publishing this Policy, a formal DPIA has not yet been completed. We will update this Policy once that assessment is finished.

We do not use your religious-practice, health-adjacent, location, or companion data for any purpose other than delivering and operating the Service, and we do not sell this data or use it for advertising profiling. See Article 4 for the full purpose list and Article 8 for who we share data with.

4. Why we process your data — purposes and legal bases

We process personal data for the following purposes, each mapped to its GDPR legal basis:

Purpose	Data involved	Legal basis
Creating and activating your Package, delivering AI-assisted WhatsApp guidance, processing your messages, and operating your Access Period	Checkout/account data, conversation content, technical/system data	Contract performance (GDPR Art. 6(1)(b))
Religious-practice disclosure inherent to using the Service, and any incidental health-adjacent, location, or companion data in your messages	Special category and related data described in Article 3	Explicit consent (GDPR Art. 9(2)(a))
Processing payment, issuing receipts, handling refunds/chargebacks	Payment data	Contract performance (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c), bookkeeping law)
Fraud and abuse prevention, fair-use enforcement, system security, preventing misuse of the Service (per Terms Art. 21–23, 51)	Technical/system data, abuse signals	Legitimate interest (Art. 6(1)(f)) — our interest in protecting the Service, other Users, and our systems
Service improvement, troubleshooting, quality assurance	Technical/system data, aggregated/de-identified conversation data where feasible	Legitimate interest (Art. 6(1)(f))
Sending optional marketing updates, offers, or product news	Email, marketing consent record	Consent (Art. 6(1)(a)) — never required to purchase or access the Service
Sending service-related, transactional, security, payment, access, or recovery communications	Checkout/account data	Contract performance (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) where applicable
Accounting, tax reporting, responding to lawful requests from authorities	Payment data, checkout data	Legal obligation (Art. 6(1)(c))

Where we rely on legitimate interest, we have considered that interest against your rights and freedoms and concluded our processing is proportionate; you have the right to object to processing based on legitimate interest at any time (see Article 11).

5. AI processing of your messages

Your WhatsApp messages are processed by an AI-assisted system to generate the guidance responses that are the core of the Service, consistent with the "AI" definition and Article 14 of the Terms.

Who processes your messages. We use one or more third-party large language model providers to generate AI responses. We are not disclosing the specific vendor name in this version of the Policy because it is not yet finally confirmed as part of our ongoing technical and legal review; we will name the specific provider(s) in a future update once that review is complete, consistent with our transparency obligations under GDPR Articles 13–14.

Where your message content goes. Depending on which AI provider(s) we use, your message content may be processed on servers located outside the European Economic Area (EEA), including potentially in the United States. Where that is the case, we rely on an applicable international transfer mechanism recognised under GDPR Chapter V — such as an EU/UK adequacy decision or Standard Contractual Clauses (SCCs) with the receiving provider — as described further in Article 9.

Model training. We do not use your conversation content to train our own proprietary AI models. Where we rely on third-party large language model providers, our intent and instruction to those providers is that your messages are not used to train their general-purpose models. We are in the process of confirming and documenting this contractually with our current provider(s) as part of our ongoing legal review, and we will update this section once that confirmation is finalised. Until then, you should treat this as our stated intent and instruction rather than a fully audited guarantee.

Limits of AI processing. As set out in Article 14 of the Terms, AI-generated responses may be inaccurate, incomplete, or inconsistent, are generated without human review of each individual message, and do not amount to professional, medical, legal, financial, or religious advice. This Privacy Policy does not expand or limit those service-quality disclaimers — it only addresses how your personal data is handled in the course of that processing.

Human access. Umifly staff may access conversation content where necessary for support, recovery, abuse investigation, security, legal compliance, or service improvement, subject to the same purposes and legal bases set out in Article 4.

6. WhatsApp / Meta as part of the data flow

The Service is delivered through the WhatsApp Business Platform, operated by Meta. This has specific consequences for your data that you should understand clearly:

Visibility — WhatsApp does not make your messages private from Umifly. Standard personal WhatsApp messaging between individuals is end-to-end encrypted. Messages sent through the WhatsApp Business Platform, as used by Umifly, are encrypted in transit, but the content is visible to Umifly — reading and processing your message is how our AI assistant generates a response, which is the product itself. Your messages are also processed by Meta as the platform operator, and may be visible to any Business Solution Provider or AI vendor in our technical pipeline, as described in Article 5. Do not assume that sending a message "on WhatsApp" keeps it private from Umifly — it does not.

Meta's role. Meta acts as an independent data processor for message transport and delivery, and in certain respects as an independent controller under its own WhatsApp Business Data Processing Terms and Privacy Policy, which govern what Meta itself does with data once it is within Meta's systems. We encourage you to review Meta's own WhatsApp Privacy Policy for that layer of processing, which is outside Umifly's control.

Purpose limitation on WhatsApp data. Under Meta's Business Messaging Policy, we may only use data obtained through a WhatsApp conversation for the purpose of that conversation (i.e., delivering the guidance you are requesting) — we do not build advertising profiles from your WhatsApp conversation data or sell it, consistent with Article 8.

Meta's own retention clock. Independently of the retention periods described in Article 10, Meta has its own data retention practice under which it deletes "Company Personal Data" (data Umifly holds within Meta's systems in connection with our WhatsApp Business account) within 90 days of Umifly ceasing to use the WhatsApp Business Platform for a given account or number. This is a fact about Meta's systems, not a promise by Umifly, and operates independently of how long Umifly itself retains a copy of your conversation content in our own systems.

Opt-in and messaging windows. Consistent with Meta's policies, we only message you outside an existing conversation window where you have opted in to receive that message (for example, onboarding or reminder messages tied to your Package).

Health-related messaging note. Meta's Business Messaging Policy restricts using WhatsApp for telemedicine or to send/request health-related information in some jurisdictions. Our product is not a medical service (see Terms Article 17), but because pharmacy- and health-adjacent questions can arise naturally in travel guidance, we are reviewing this point with counsel to ensure our use of the platform remains compliant in all regions where we operate.

7. Payments (Stripe)

Payment for your Package is processed by Stripe, acting as an independent payment processor and, for its own compliance purposes, as an independent controller for certain payment data.

Umifly does not store your full card number, card expiry date, or CVC/security code. Card details are entered directly into Stripe's own secure checkout systems.
Umifly receives and stores only: confirmation that payment succeeded or failed, the amount charged, the currency, the Package purchased, a payment/transaction reference, and limited billing information needed for receipts, refunds, and dispute handling.
Stripe's processing of your payment data is governed by Stripe's own privacy policy, available at https://stripe.com/privacy, which we encourage you to review.
Stripe may be located, and may process data, outside the EEA; Stripe's own transfer safeguards apply to that processing, and our use of Stripe as a sub-processor is covered by the international transfer commitments described in Article 9.

8. Who we share data with

We do not sell your personal data, and we do not share it for third parties' independent marketing purposes. We share personal data only with the following categories of recipients, each acting under contractual obligations consistent with GDPR Article 28 (for processors) or under their own independent legal obligations (where noted):

Meta / WhatsApp Business Platform — for message delivery, as described in Article 6.
Stripe — for payment processing, as described in Article 7.
Third-party large language model providers — for generating AI-assisted responses, as described in Article 5.
Hosting and infrastructure providers — generic cloud hosting, database, and server infrastructure providers used to run our website, checkout, and backend systems, bound by data processing agreements.
Professional advisors — lawyers, accountants, and auditors, where necessary for legal, tax, or compliance purposes, and bound by confidentiality obligations.
Competent authorities — law enforcement, tax authorities, courts, or regulators, where we are legally required to disclose data, where necessary to establish or defend a legal claim, or in connection with suspected fraud, abuse, or the security investigations described in Terms Article 51.
A successor in a business transaction — if Umifly is involved in a merger, acquisition, restructuring, or sale of assets, personal data may be transferred to the successor entity, subject to the same (or materially equivalent) privacy commitments described in this Policy, consistent with Terms Article 41.

We require each processor we use to enter into a data processing agreement committing them to process personal data only on our instructions, to apply appropriate security measures, and to assist us in meeting our GDPR obligations.

9. International data transfers

Several of the recipients described in Article 8 — including our third-party large language model provider(s), Stripe, Meta, and some hosting/infrastructure providers — may process personal data outside the European Economic Area (EEA), including in the United States or other countries.

Where we transfer personal data outside the EEA, we rely on one of the following safeguards, depending on the recipient and location:

an adequacy decision by the European Commission, where the recipient's country has been formally recognised as providing an adequate level of data protection; or
Standard Contractual Clauses (SCCs) approved by the European Commission, incorporated into our agreement with the recipient, together with any additional technical or organisational safeguards necessary in the circumstances; or
another valid transfer mechanism recognised under GDPR Chapter V.

We have not yet published a recipient-by-recipient transfer map naming every sub-processor's exact country of processing and the specific mechanism used for each — this is part of the ongoing legal/vendor review referenced throughout this Policy (in particular Article 5, regarding our AI provider(s)). We will update this Article with that detail as the review of our vendor contracts concludes. You may request the current details of the safeguards we rely on for a specific transfer by contacting us at support@umifly.com.

10. Retention periods

We retain personal data only for as long as necessary for the purposes described in Article 4, and in any case no longer than the periods below. Several of these periods are marked as provisional because our retention schedule is still being finalised as part of the legal review referenced in the status banner above — we are stating this honestly rather than giving you a number we cannot yet stand behind.

Payment and financial records (invoices, payment references, VAT-relevant records): retained for 7 years, as required by Dutch tax and bookkeeping law (Boek 2 Burgerlijk Wetboek / Algemene wet inzake rijksbelastingen). This period is a confirmed legal minimum, not a provisional estimate.
Checkout and account data (name, email, WhatsApp number, Package/Access Period records, Checkout Confirmations): retained for as long as you have an active Package or Access Period, and for a further provisional period of up to 24 months after your Access Period ends, to allow for support requests, recovery flows, dispute handling, and legal defence, unless a longer period is required to resolve an active dispute, complaint, chargeback, or legal claim, or a shorter period becomes our confirmed policy following legal review.
WhatsApp conversation content (your messages and the AI's responses): retained for as long as necessary for service delivery, security, troubleshooting, quality assurance, and legal compliance (mirroring Terms Article 28), and in any case for a provisional period of up to 12 months after the end of your Access Period, after which it is deleted or anonymised, unless a longer period is required by law or to resolve an active dispute or legal claim. This is independent of, and may be shorter than, Meta's own 90-day deletion clock described in Article 6, which applies separately to data held within Meta's own systems.
Technical and system/security logs: retained for a provisional period of up to 12 months, for security, abuse-prevention, and troubleshooting purposes, after which they are deleted or anonymised unless needed for an active security investigation.
Marketing consent records: retained for as long as you remain opted in to marketing communications, and for a further provisional period of up to 3 years after you unsubscribe, as evidence that we honoured your consent choices.

Where data is no longer needed for the purposes above, we delete it or irreversibly anonymise it. We will update this Article with final, confirmed retention periods once our internal data-retention schedule has been reviewed by counsel.

11. Your rights, and how to exercise them

Under the GDPR, you have the following rights in relation to your personal data:

Access — to obtain a copy of the personal data we hold about you.
Rectification — to have inaccurate or incomplete personal data corrected.
Erasure ("right to be forgotten") — to have your personal data deleted, subject to our legal obligations (for example, the 7-year financial record retention described in Article 10).
Restriction — to request that we limit how we process your personal data in certain circumstances.
Data portability — to receive the personal data you provided to us in a structured, commonly used, machine-readable format, where the processing is based on consent or contract and carried out by automated means.
Objection — to object to processing based on our legitimate interest (see Article 4), including profiling or abuse-prevention processing carried out on that basis.
Withdraw consent — to withdraw any consent you have given (including marketing consent and the special-category consent described in Article 3) at any time, without affecting the lawfulness of processing before withdrawal.
No solely automated decisions with legal or similarly significant effect — we do not use automated decision-making (including the AI processing described in Article 5) to make decisions about you that produce legal effects or similarly significantly affect you without human involvement. Access-validation and fair-use controls described in Terms Article 29 are operational/system checks, not decisions about your legal rights.
Lodge a complaint with a supervisory authority — you have the right to lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens (AP), or with the supervisory authority in your own EU/EEA country of residence if different from the Netherlands.

How to exercise these rights. Email us at support@umifly.com with your request, your full name, the email address and/or WhatsApp number associated with your account, and a clear description of what you are asking for. We may need to verify your identity before acting on a request, to protect your data from unauthorised access.

Our response time. We will respond to your request within one month of receipt, as required by GDPR Article 12. Where a request is complex or we have received a high volume of requests, we may extend this by a further two months, and we will tell you within the first month if we do so, and why.

Contacting the Autoriteit Persoonsgegevens:

Website: https://www.autoriteitpersoonsgegevens.nl
Postal address: Autoriteit Persoonsgegevens, PO Box 93374, 2509 AJ The Hague, Netherlands
Visiting address (by appointment): Hoge Nieuwstraat 8, 2514 EL The Hague, Netherlands
Telephone: +31 (0)88 1805 250

We would appreciate the opportunity to address your concern directly first by contacting us at support@umifly.com, but you are not required to do so before contacting the AP or your local supervisory authority — this is your right regardless of whether you contact us first.

12. Children

The Service is not directed at, marketed to, or intended for use by children. Consistent with the GDPR's child-consent age threshold as applied in the Netherlands (16 years, as the Netherlands has not lowered the default GDPR threshold), the Service is intended for use by individuals 16 years of age or older. This is also consistent with WhatsApp's own minimum age requirements for using its Business Platform.

We do not knowingly collect personal data from anyone under 16 without appropriate parental or guardian consent. If we become aware that we have collected personal data from a person under 16 without such consent, we will take reasonable steps to delete that data as soon as reasonably possible.

If you believe a child under 16 has provided us with personal data, please contact us at support@umifly.com so we can investigate and, where appropriate, delete the data.

13. Security measures

We apply reasonable technical and organisational measures designed to protect your personal data against unauthorised access, loss, misuse, or alteration, including:

encryption of data in transit between your device, our systems, and the third-party platforms described in this Policy (for example, standard transport-layer encryption for website and checkout traffic, and the WhatsApp Business Platform's own transit encryption described in Article 6);
access controls limiting which Umifly personnel and systems can access checkout data, payment references, and conversation content, based on what is necessary for their role;
the abuse-prevention, rate-limiting, and security-violation controls described in Terms Articles 21, 22, and 51, which also help protect the integrity and confidentiality of the data within our systems;
use of reputable, contractually bound processors (Stripe, Meta, hosting providers, and our AI provider(s)) who are required to maintain their own appropriate security measures.

No system is completely secure, and we cannot guarantee absolute security of data transmitted over the internet or over any Third-Party Platform. If we become aware of a personal data breach that poses a risk to your rights and freedoms, we will notify the Autoriteit Persoonsgegevens and, where required by law, notify you directly, in accordance with GDPR Articles 33 and 34.

14. Cookies

At the time of publishing this Policy (Version 1.0), umifly.com uses only cookies and similar technologies that are strictly necessary for the website and checkout to function — for example, session identifiers needed to keep you logged into a checkout flow, and security/anti-fraud cookies required by Stripe to process your payment safely. We do not currently use advertising cookies, and we do not currently use non-essential analytics or tracking cookies.

Strictly necessary cookies do not require your consent under the Dutch Telecommunicatiewet (the law implementing the EU ePrivacy rules) because they are required for the service you have requested to function.

If this changes — for example, if we add analytics, advertising, or other non-essential cookies in the future — we will: (a) implement a cookie consent banner that asks for your opt-in consent before any non-essential cookie is set, and (b) update this Article, or publish a separate, linked Cookie Policy, describing each cookie, its purpose, and its duration, consistent with the approach taken by comparable AI-assisted consumer services.

15. Changes to this Policy

We may update this Policy from time to time, including as our legal review (referenced throughout this document) progresses and specific provisional points described above are finalised.

When we make changes, we will update the "Version" and "Published" date at the top of this Policy. For material changes — meaning changes that significantly affect what data we collect, how we use it, or your rights — we will take reasonable steps to notify active Users (for example, by email or a WhatsApp message) before, or as soon as reasonably possible after, the change takes effect, consistent with the approach taken for changes to the Terms (Terms Article 38).

Your continued use of the Service after a change to this Policy takes effect constitutes your acknowledgement of the updated Policy, to the extent permitted by applicable law. Where a change requires your renewed consent as a matter of law (for example, a material change to how we process the special category data described in Article 3), we will ask for that consent again rather than relying on continued use alone.

We encourage you to review this Policy periodically. The current version is always available at https://umifly.com/privacy-policy/.

16. Contact and Data Protection Officer

For any question about this Policy, our data practices, or to exercise the rights described in Article 11, contact us at:

Email: support@umifly.com
Website: https://umifly.com
Business name: Umifly
Registered address: Rigastraat 89, 3542 ED Utrecht, Netherlands

Data Protection Officer. Umifly has not formally appointed a Data Protection Officer (DPO) at this time. As part of our ongoing legal review (see the status banner above), we are assessing with counsel whether the volume and sensitivity of our processing — in particular the special category data described in Article 3 — means a formal DPO appointment is advisable, even if not strictly mandatory under GDPR Article 37 at our current scale. Until a DPO is appointed (if one is), support@umifly.com is the single point of contact for all privacy-related questions and requests, and will be handled by Umifly's founder/management team.

Only communications sent through official Umifly channels will be treated as formal communications, consistent with Terms Article 50.

This Privacy Policy, Version 1.0, is published in good faith alongside Umifly's Terms & Conditions to close the gap identified in Terms Article 27. It will be reviewed and updated following legal counsel review. It does not constitute legal advice and is not represented as a final, lawyer-approved document.