Email Communications
We send email to the address you registered with. Some of these emails are required by law or are necessary to operate your account; others are optional and you can turn them off whenever you want. This section explains what we send, why, and how to control it.
Categories of email we send
Every email we send falls into one of six categories:
- Account security — password resets, login alerts, two-factor codes, and other messages that protect your account.
- Service announcements — changes to these Terms, changes to this Privacy Policy, material changes to features you use, required security and breach notices, and other “change-in-terms” notices.
- Flight alerts — notifications about Space-A flights matching criteria you have configured (you choose which flights, if any, trigger an alert).
- Updates — product news, new features, and operational updates about FlySpaceA.
- Newsletter — periodic summaries of Space-A travel information, tips, and community content.
- Re-engagement — occasional messages to accounts that have gone inactive.
Mandatory vs. optional
Categories 1 and 2 are mandatory for every active account. You cannot turn them off while your account exists. These categories are either “transactional or relationship messages” under the CAN-SPAM Act (15 U.S.C. § 7702(17); 16 CFR § 316.3), messages required by applicable law (including state data-breach notification laws such as California Civil Code § 1798.82, New York General Business Law § 899-aa under the SHIELD Act, and Texas Business & Commerce Code § 521.053), or notices of a change in the terms of your account relationship with us. None of these are “commercial electronic mail messages” subject to CAN-SPAM’s opt-out rules, and none of them require your consent.
Categories 3 through 6 are optional. You are opted in by default when you create an account (an opt-out model permitted under 15 U.S.C. § 7704(a)(3)–(4)) and you can opt out of any or all of them at any time — either from the one-click unsubscribe link in every optional email, or from Settings → Email Preferences in your account.
How to manage your preferences
Visit Settings → Email Preferences while signed in. If you want to see what we send before creating an account, visit our public email categories page. You can toggle each optional category independently. Changes take effect promptly — within a few minutes of saving. Every optional email we send also contains a one-click unsubscribe link that requires no login and no additional steps.
Honoring opt-outs
We honor opt-out requests promptly and in any event within ten (10) business days, as required by 15 U.S.C. § 7704(a)(4)(A). Our unsubscribe mechanism remains functional for at least thirty (30) days after any email is sent, as required by 15 U.S.C. § 7704(a)(3)(A)(ii).
Record-keeping
We log every preference change and every unsubscribe event — the category, the user, the timestamp, the IP address, and the reason (manual toggle, one-click link, bounce, complaint, admin action). We retain these records for three (3) years from the event. We may retain a specific record longer only where we are required to do so by an active legal hold, a regulatory inquiry, or a pending or threatened dispute; absent one of those triggers, records older than three years are purged in quarterly cleanup runs. This retention period lets us prove compliance with CAN-SPAM and honor opt-outs reliably while meeting California Privacy Rights Act requirements (Cal. Civ. Code § 1798.100(a)(3)) for disclosed, proportionate retention.
Retention of contact information after account deletion
If you delete your account, your preferences are deleted with it. We retain a minimal record of your email address and the fact of deletion for two (2) years in a separate deleted-user contacts store. We use this record for one purpose only: to send you a legally required breach notification if an incident discovered after your deletion affects data you previously held with us. We do not send marketing to deleted accounts, and the record is permanently purged after two years.
You may request earlier deletion of this retention record by emailing privacy@flyspacea.com. Requesting deletion of the retention record means we will no longer be able to send you a breach notification if one becomes required in the future — you are waiving that notification in exchange for earlier erasure. We will honor such requests within 30 days and confirm the deletion back to you.
US-directed service
FlySpaceA is a service directed exclusively at United States residents. Our content concerns the U.S. Department of Defense Space-Available travel program, which is available only to categories of U.S. military personnel, DoD civilians, and their dependents. The site is English-only, prices (when we introduce paid tiers) are denominated in U.S. dollars, we have no EU establishment, no EU business presence, and we do not market to individuals in the European Union, the European Economic Area, the United Kingdom, or Switzerland. We do not intend to offer our services to, or monitor the behavior of, individuals located in those jurisdictions, within the meaning of Article 3(2) of Regulation (EU) 2016/679 (GDPR) and the European Data Protection Board’s Guidelines 3/2018 on territorial scope.
Third-party email processor
We send email through Resend (resend.com), which delivers messages on our behalf via Amazon Simple Email Service (AWS SES). Resend receives the information required to deliver a message (the recipient’s email address, the message content, and standard delivery headers) and, where engagement tracking is enabled, aggregate open and click signals. Resend acts as our sub-processor and is contractually bound to use this information only to send email on our behalf.
Third parties who receive your email address
As of the effective date of this Privacy Policy, the only third parties that receive your email address are our email delivery provider (Resend) and its sub-processor (AWS SES). We do not sell or rent email addresses. We do not share them with advertising networks, data brokers, or third-party analytics platforms. If this changes in the future, we will update this Privacy Policy and notify affected users of the change.
Privacy contact
Questions about this section, preference changes you cannot make yourself, or requests to access or delete your data can be sent to privacy@flyspacea.com. We acknowledge privacy inquiries within seven (7) business days and substantively respond within thirty (30) days. For requests subject to a statutory deadline — such as California CCPA/CPRA verifiable consumer requests under Cal. Civ. Code § 1798.130 or GDPR data subject requests — we will respond within the statutory timeframe (for CCPA/CPRA, acknowledgment within 10 business days and response within 45 days of receipt).