CCPA Notice

1. Notice at collection

We collect personal information to run the website, respond to inquiries, and — where we are allowed to sell travel — to take a booking request, store a card token with our processor, ticket the itinerary on our GDS, charge when the airline ticket is issued, and email the airline booking reference. Analytics and advertising cookies load only if you accept optional cookies.

2. Categories collected in the past 12 months

* “Share” has the CPRA meaning: disclosure of personal information to a third party for cross-context behavioral advertising. We do not sell personal information for money.

We do not collect biometric identifiers, precise geolocation, union membership, or contents of non-booking private communications.

3. Business purposes

• Take a booking request, vault the card, ticket on our GDS, charge when issued, and email the airline PNR
• Customer support, changes, cancellations, and upgrades you ask us to submit
• Security, fraud prevention, and legal compliance (including Seller of Travel)
• Website hosting, debugging, and service improvement
• Google Analytics and Google Ads measurement and advertising — only after you accept optional cookies

4. Sources

• You, when you search, submit a form, call, or email us
• Your device, through necessary cookies and, if accepted, analytics and ads cookies
• Airlines and our GDS, after we ticket, to confirm the booking reference
• Google, if you arrived from an ad or accepted advertising cookies

5. Disclosure to service providers and other businesses

We disclose personal information to the following categories of recipients for the business purposes above. Airlines are separate controllers of the ticket once issued.

• Airlines and Amadeus GDS — to ticket the itinerary
• NMI / Network Merchants — to store the card token and charge when ticketed
• Duffel — display fares only; we do not create a Duffel order from this website
• Resend — transactional email
• Vercel, Neon, and Cloudflare — hosting, database, DNS, and security
• Google LLC — analytics and ads, only if you accept optional cookies
• Authorities when the law requires it

6. Sale and sharing — Do Not Sell or Share

We do not sell personal information for monetary consideration. If you accept optional cookies, we share identifiers, internet activity, and coarse location with Google for advertising and measurement. That is “sharing” under the CPRA.

To opt out of sale or sharing:

• Choose Decline optional cookies on our cookie banner (stored as baf_cookie_consent_v2)
• Use a browser or extension that sends the Global Privacy Control (GPC) signal — we treat GPC as an opt-out of sale and sharing
• Email privacy@bookaerofare.com with the subject “Do not sell or share”

We do not have actual knowledge that we sell or share the personal information of consumers under 16.

7. Sensitive personal information

Passport and government ID details are used only to issue an airline ticket when the itinerary requires them. We do not use sensitive personal information to infer characteristics, and we do not sell or share it for advertising. You may ask us to limit that use to what is necessary to provide the service you requested.

8. Retention

Booking and payment records are kept up to 7 years after the trip for tax and accounting. Card tokens are kept until the ticket is issued and charged, or until the request is cancelled and the token is deleted. Call recordings, if made, are kept up to 90 days. Optional cookies last until you withdraw consent or they expire. See the Privacy Policy for the full schedule.

9. Your California rights

10. How to submit a request

Email privacy@bookaerofare.com with the subject “CCPA request,” or call +1 (800) 903-1468. Tell us which right you want to use and enough detail to find your records (name, email, booking reference if you have one). We will verify your identity (for example by matching email and booking details). We respond within 45 calendar days, and may take a further 45 days with notice if the request is complex.

An authorized agent may submit a request with your signed permission or a valid power of attorney. We may still need to verify your identity directly. We will not fulfill a request if we cannot verify it.

11. Shine the Light

California Civil Code section 1798.83 allows California residents to ask whether we disclosed personal information to third parties for those third parties’ direct marketing in the preceding calendar year. We do not disclose personal information to third parties for their own direct marketing. You may still send that request to privacy@bookaerofare.com.

12. Contact

Related: Privacy Policy · Cookie Policy · GDPR Policy · State licensing · Advertiser Disclosure.