🔒 Privacy Policy

📋 Overview

Xpedioair USA ("Xpedioair," "we," "us," or "our") is committed to protecting your personal information. This Privacy Policy explains what information we collect, how we use it, and the choices available to you when you use our website and flight modification services. By using our services, you agree to the practices described in this policy.

📥 Information We Collect

We collect information you provide directly when submitting a flight change request, including:

• Identity data: Full name, passenger name as it appears on your ticket
• Contact data: Email address, U.S. phone number
• Booking data: Airline name, confirmation / PNR number, flight dates, travel routes
• Payment data: Card number (last 4 digits only stored), cardholder name, billing ZIP. Full card details are processed via PCI-DSS compliant systems and never stored on our servers.
• Device & usage data: IP address, browser type, pages visited, referring URL — collected automatically via server logs and cookies.

We do not collect sensitive data such as Social Security numbers, passport numbers, or date of birth unless specifically required to process your request.

⚙️ How We Use Your Information

We use the information we collect to:

• Process and manage your flight change, name correction, seat upgrade, or cancellation request
• Contact the airline on your behalf and relay updates and confirmations to you
• Send transactional emails and SMS messages related to your request
• Verify your identity and prevent fraudulent transactions
• Improve our website, services, and customer support
• Comply with legal obligations and enforce our Terms & Conditions
• Send promotional emails about deals and offers, if you opt in

We do not use your booking or payment information for advertising profiling or behavioral targeting without your explicit consent.

🤝 Information Sharing & Disclosure

We share your information only in the following circumstances:

• Airlines & booking systems: We share your booking reference, passenger name, and change details with the relevant airline to process your request. We provide only what is necessary.
• Payment processors: We use PCI-DSS Level 1 compliant payment processors. Your card data is transmitted directly to the processor and never stored by Xpedioair.
• Service providers: We may share data with trusted vendors who help us operate our website (hosting, email delivery, analytics) under strict confidentiality agreements.
• Legal compliance: We may disclose information if required by law, court order, or government authority.
• Business transfers: In the event of a merger or acquisition, your data may be transferred to the successor entity under equivalent protections.

🗄️ Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected and to comply with applicable U.S. federal and state legal obligations. The following schedules apply:

• Transaction & request records: Retained for 7 years from the date of the transaction, consistent with IRS recordkeeping requirements (26 U.S.C. § 6501) and the Federal Trade Commission's requirements for travel service providers. This includes your name, contact details, booking reference, airline, and change request details.
• Payment records: Only the last 4 digits of your card and transaction identifiers are retained for 7 years. Full card numbers, CVVs, and full PANs are never stored on our systems; they are processed exclusively by our PCI DSS Level 1–compliant payment processor.
• Email marketing data: Retained until you opt out or request deletion. We honor unsubscribe requests within 10 business days in compliance with the CAN-SPAM Act (15 U.S.C. § 7704).
• Server logs & analytics data: Raw server logs are retained for up to 12 months; analytics data is aggregated and anonymized within 26 months of collection, in line with common industry practice and Google Analytics data retention standards.
• California residents (CCPA/CPRA): Sensitive personal information is used only for the purposes disclosed at collection. You may request deletion at any time; we will respond within 45 days as required by Cal. Civ. Code § 1798.105.
• Washington residents (My Health MY Data Act): Consumer health data (if any) is retained only for the duration of the service relationship and deleted within 30 days of a verified deletion request.

You may request deletion of your personal data at any time by contacting us at privacy@xpedioair.com. Requests are subject to our legal retention obligations outlined above.

🛡️ Data Security

We implement industry-standard security measures to protect your information:

• 256-bit SSL/TLS encryption for all data in transit
• PCI DSS-compliant payment processing — card data never touches our servers
• Access controls limiting data access to authorized personnel only
• Regular security assessments and penetration testing
• Incident response procedures in case of a data breach

While we take reasonable steps to protect your information, no method of transmission over the internet is 100% secure. In the unlikely event of a data breach affecting your personal information, we will notify you as required by applicable law.

✅ Your Rights & Choices

Depending on your state of residence, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request that we delete your personal information (subject to legal retention requirements)
• Portability: Receive your data in a structured, machine-readable format
• Opt-out of marketing: Unsubscribe from promotional emails at any time using the link in our emails
• Do Not Sell: We do not sell personal information. No opt-out is required.

To exercise your rights, contact us at privacy@Xpedioair.com or call +1-888-408-9070. We will respond within 45 days.

👶 Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe a minor has provided us with personal information, please contact us immediately at privacy@Xpedioair.com and we will delete such information promptly.

🔄 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. We will notify you of material changes by email or by posting a prominent notice on our website at least 14 days before the changes take effect. Your continued use of our services after the effective date constitutes acceptance of the updated policy.

🔗 Related Policies

You may also want to review these related documents: