Privacy Policy

This policy explains what personal information flycraft.com collects, what CRAFT does with it, who receives it, and the choices you have. It applies to this website, to enquiries sent through it, and to enquiries you send us through our ads on other platforms. Once you become a client, your charter or programme agreement also governs the information we hold as your operator.

CRAFT is a dba of Craft Charter, LLC, 14200 NW 42nd Ave, Opa-locka, Florida 33054 ("CRAFT", "we", "us").

Your choices, in short: you can opt out of the sale or sharing of your personal information and of targeted advertising at any time on Your Privacy Choices. If your browser sends a Global Privacy Control (GPC) signal, we treat it as that opt-out automatically.

What we collect

What you give us

• Quote requests: departure and destination airports, dates and times, flexibility, number of passengers, trip type, and anything you write in the notes. We save the trip details as soon as you press "See my price", before you give us any contact details, so we can show you the estimate and let you come back to it.
• Contact details: email address and/or mobile number, and your name if you give it.
• Jet card and programme enquiries: card size, callout tier, calculator selections, and your contact details.
• Optional questions: how often you fly and what you are interested in, if you answer them after sending a request.
• "Save this quote for later": the email address or mobile number you provide when saving a quote. We show a return link on the website and may send it through our configured delivery providers.
• Lead forms on Meta (Facebook and Instagram) or LinkedIn: if you submit a form inside one of our ads, the platform passes us what you entered, usually your name, email, phone, company and your answers.
• AI assistants: some requests reach us through an AI assistant acting for a person who asked it to price or request a trip. We treat those exactly like a form on this site.

Please don't include health or other sensitive details in notes. If you do (for example a dietary need for catering), we use it only to prepare your flight and never send it to advertising or analytics providers.

What we collect automatically

• Pages and interactions: pages viewed, the quote steps you reach, buttons and links you click, how far you scroll on articles, calculator and tool use, and whether you started or finished a form. We record these as events with a random event ID.
• How you arrived: the referring site, campaign tags in the link (UTM parameters), and ad click identifiers (Google gclid/gbraid/wbraid, Meta fbclid, LinkedIn li_fat_id, Microsoft msclkid).
• Device and connection: browser, device type, operating system, and IP address. We store the IP address only in a salted, one-way hashed form. Advertising and analytics providers receive the IP address directly from your browser and use it, for example, to estimate your general location.
• Cookies and similar technologies: described in the next section.
• Site speed: page-load and interaction measurements for our home, charter and Jet Card pages, grouped by page and broad viewport width. These first-party reports contain no contact details, query strings, saved-quote tokens or visitor identifiers, and are not sent to advertising platforms. Choosing to turn off analytics on Your Privacy Choices stops new speed reports.

Cookies, pixels and similar technologies

We use our own first-party cookies and browser storage, and tags from the providers below. Some of our tags are loaded through Google Tag Manager, which delivers the tags but does not itself build a profile of you.

You can switch advertising and analytics off for your browser on Your Privacy Choices. You can also clear cookies in your browser, and manage ad settings directly with Google, Meta and LinkedIn.

How we use personal information

• To answer your request: prepare an estimate and a firm quote, contact you by email, phone or text about it, and arrange the trip or programme you asked about.
• To prioritise and follow up: we score enquiries (for example by trip type, flying frequency and whether we can reach you quickly) so the right person responds first.
• Analytics: to understand which pages, forms and tools work, and to improve them.
• Advertising and retargeting: to measure which ads lead to enquiries and bookings, to show our ads to people who visited the site or started a quote (retargeting), to exclude existing clients and recent enquirers from ads, and to help ad platforms find people similar to our clients.
• Security and misuse prevention: spam filters, rate limits and fraud checks on forms.
• Legal and regulatory obligations, and to protect the rights, safety and property of CRAFT, our crews and our passengers.

Advertising partners, server-side conversions and customer lists

When you visit the site without opting out, the Google, Meta and LinkedIn tags receive information from your browser directly (the page you are on, the actions above, cookie identifiers, IP address and browser details).

When you send an enquiry without having opted out, we also send the enquiry event server to server to Meta (Conversions API) and LinkedIn (Conversions API), and to Google Ads (enhanced conversions and offline conversion import), so they can match it to the ad you saw. These events contain:

• your email address, phone number and (for Meta) name, hashed with SHA-256 before they leave our systems;
• the ad click and cookie identifiers listed above, your IP address and browser details (Meta);
• an event ID, the time, the page, and an estimated value we assign to the enquiry.

If your enquiry later becomes a qualified lead or you become a client, we may send a follow-up event of the same kind (for example "qualified lead" or "booking") with a value, so the platforms show our ads to people more likely to fly with us.

We may also upload hashed lists of client and enquirer email addresses or phone numbers to Google, Meta and LinkedIn, to exclude those people from our ads or to build similar audiences. We never upload passenger lists received from brokers or other operators, and we don't upload anyone who opted out.

The platforms use this information under their own terms and privacy policies, and may combine it with other information they hold about you. Hashing protects the identifiers in transit; the platforms can still match them to accounts they hold.

Sale and sharing of personal information

We do not sell personal information for money. However, under the California Consumer Privacy Act (as amended by the CPRA), letting advertising partners collect information through our tags and receive our server-side conversion events for cross-context behavioural advertising is "sharing", and may be considered a "sale". Other US state privacy laws treat the same activity as "targeted advertising". In the last 12 months we have sold or shared the following categories with Google, Meta and LinkedIn for those purposes:

We do not knowingly sell or share the personal information of anyone under 16.

To opt out, use Your Privacy Choices (the "Do Not Sell or Share My Personal Information" link in the footer), send a Global Privacy Control signal, or email us. Opting out in one browser applies to that browser; tell us your email or phone number if you want us to apply it to server-side events and customer lists too.

How we honour Global Privacy Control

If your browser sends a GPC signal, we treat it as a request to opt out of sale, sharing and targeted advertising for that browser: the Google Ads, Meta and LinkedIn tags do not load, Google Analytics runs without advertising features, enquiries you send are not sent to advertising platforms server-side, and they are not used for later conversion uploads. You don't need to do anything else.

Who else receives personal information

• Our team: the CRAFT people responsible for your request, including charter sales and the programme you asked about.
• Service providers that process information for us under contract: website hosting (Vercel), our database host, internal lead notifications (Slack), email delivery (Resend), text-message delivery (Twilio), and Google Calendar when you book a call.
• Advertising and analytics partners: Google, Meta, LinkedIn and Fathom, as described above.
• Operating carriers: if another certificated carrier operates your flight, the passenger and trip details it needs.
• Legal and safety: where the law requires it, in response to a valid legal request, or to protect the rights, safety or property of CRAFT, our crews or our passengers, and to a successor if our business is sold or reorganised.

Text messages

If you give us a mobile number, we use it to text you about your request (for example your quote link) and to call you about it. We don't send marketing texts unless you agree to them separately. Message and data rates may apply. Reply STOP to stop texts, or tell us.

How long we keep it

• Enquiries that don't become bookings: up to 24 months after our last contact with you, then deleted or anonymised.
• Clients: for the length of your agreement and up to 7 years afterwards, for accounting, tax, aviation-regulatory and legal purposes.
• Site event records and hashed IPs: as long as the enquiry they belong to; otherwise up to 24 months.
• Cookies and browser storage: for the periods in the table above.
• Advertising and analytics partners keep the data they receive under their own retention policies.

You can ask us to delete your information sooner (see below), unless we must keep it by law.

Your rights

Depending on where you live, you may have the right to:

• know what personal information we hold about you and how we use and disclose it, and get a copy of it;
• have it corrected or deleted;
• opt out of its sale or sharing, of targeted advertising, and of profiling that produces significant effects (we don't do this kind of profiling);
• not be treated differently for exercising these rights.

To exercise them, email charter@flycraft.com or call +1 (310) 848-3636. We will verify your request by matching the email or phone number you gave us, and respond within 45 days (we'll tell you if we need longer, as the law allows). You can use an authorised agent, who must show us your signed permission. If we decline your request, you can appeal by replying to our decision; if we deny the appeal, you can contact your state attorney general. Residents of California can also ask for the information described in California Civil Code §1798.83.

Children

This website is for adults arranging travel and is not directed at children under 16. We don't knowingly collect personal information from children. A quote request may include how many passengers are travelling; that is a count, not a child's personal information.

Security

The site is served over HTTPS, identifiers sent to ad platforms are hashed, IP addresses are stored hashed, and access to enquiries is limited to the people who need it. No method of transmission or storage is completely secure. If a breach affects your information, we will notify you as the law requires.

Where it is processed

CRAFT is based in Florida, and our service providers process information in the United States. If you contact us from outside the United States, your information is transferred to and processed there.

Changes to this policy

When this policy changes we post the new version here with a new date at the top. If a change is material, we will say so on this page before it takes effect.

Contact

Craft Charter, LLC (CRAFT), 14200 NW 42nd Ave, Opa-locka, Florida 33054 · charter@flycraft.com · +1 (310) 848-3636 · Your Privacy Choices