Email Communications
We send email to the address you registered with. Some of these emails are required by law or are necessary to operate your account; others are optional and you can turn them off whenever you want. This section explains what we send, why, and how to control it.
Categories of email we send
Every email we send belongs to a category. The current set, which may grow or shrink as the product changes, is always listed with descriptions on our email categories page. At the time of writing they are:
- Account security — password resets, login alerts, two-factor codes, and other messages that protect your account.
- Service announcements — changes to these Terms, changes to this Privacy Policy, material changes to features you use, required security and breach notices, and other “change-in-terms” notices.
- Account confirmation — reminders to confirm your email address if you registered with a password but have not yet verified it. Sent only to accounts created by email-and-password registration.
- Billing & subscription — renewal reminders, trial and price-change notices, payment problems, and cancellation confirmations.
- Account deletion — confirmation that you asked us to delete your account, and reminders before the date it happens, so you can still cancel.
- Flight alerts — notifications about Space-A flights matching criteria you have configured (you choose which flights, if any, trigger an alert).
- Login & security alerts — a sign-in from a device we have not seen before, repeated failed sign-in attempts, or other unusual activity on your account. You can turn these off. Breach notices are a different thing: they sit under service announcements above, and they cannot be turned off.
- Updates — product news, new features, and operational updates about FlySpaceA.
- Newsletter — periodic summaries of Space-A travel information, tips, and community content.
- Re-engagement — occasional messages to accounts that have gone inactive.
Mandatory vs. optional
Account security, service announcements, account confirmation, billing & subscription, and account deletion are mandatory for every active account. You cannot turn them off while your account exists. These categories are either “transactional or relationship messages” under the CAN-SPAM Act (15 U.S.C. § 7702(17); 16 CFR § 316.3), messages required by applicable law (including state data-breach notification laws such as California Civil Code § 1798.82, New York General Business Law § 899-aa under the SHIELD Act, and Texas Business & Commerce Code § 521.053), or notices of a change in the terms of your account relationship with us. None of these are “commercial electronic mail messages” subject to CAN-SPAM’s opt-out rules, and none of them require your consent.
The rest are optional: flight alerts, login & security alerts, updates, newsletter, and re-engagement. You are opted in by default when you create an account (an opt-out model permitted under 15 U.S.C. § 7704(a)(3)–(4)) and you can opt out of any or all of them at any time — either from the one-click unsubscribe link in every optional email, or from Settings → Email Preferences in your account.
How to manage your preferences
Visit Settings → Email Preferences while signed in. If you want to see what we send before creating an account, visit our public email categories page. You can toggle each optional category independently. Changes take effect promptly — within a few minutes of saving. Every optional email we send also contains a one-click unsubscribe link that requires no login and no additional steps.
Honoring opt-outs
We honor opt-out requests promptly and in any event within ten (10) business days, as required by 15 U.S.C. § 7704(a)(4)(A). Our unsubscribe mechanism remains functional for at least thirty (30) days after any email is sent, as required by 15 U.S.C. § 7704(a)(3)(A)(ii).
Record-keeping
We log every preference change and every unsubscribe event — the category, the user, the timestamp, the IP address, and the reason (manual toggle, one-click link, bounce, complaint, admin action). We retain these records for three (3) years from the event. We may retain a specific record longer only where we are required to do so by an active legal hold, a regulatory inquiry, or a pending or threatened dispute; absent one of those triggers, records older than three years are purged in quarterly cleanup runs. This retention period lets us prove compliance with CAN-SPAM and honor opt-outs reliably while meeting California Privacy Rights Act requirements (Cal. Civ. Code § 1798.100(a)(3)) for disclosed, proportionate retention.
Retention of contact information after account deletion
If you delete your account, your preferences are deleted with it. We retain a minimal record of your email address and the fact of deletion for two (2) years in a separate deleted-user contacts store. We use this record for one purpose only: to send you a legally required breach notification if an incident discovered after your deletion affects data you previously held with us. We do not send marketing to deleted accounts, and the record is permanently purged after two years.
You may request earlier deletion of this retention record by emailing privacy@flyspacea.com. Requesting deletion of the retention record means we will no longer be able to send you a breach notification if one becomes required in the future — you are waiving that notification in exchange for earlier erasure. We will honor such requests within 30 days and confirm the deletion back to you.
US-directed service
FlySpaceA is a service directed exclusively at United States residents. Our content concerns the U.S. Department of Defense Space-Available travel program, which is available only to categories of U.S. military personnel, DoD civilians, and their dependents. The site is English-only, prices are denominated in U.S. dollars, we have no EU establishment, no EU business presence, and we do not market to individuals in the European Union, the European Economic Area, the United Kingdom, or Switzerland. We do not intend to offer our services to, or monitor the behavior of, individuals located in those jurisdictions, within the meaning of Article 3(2) of Regulation (EU) 2016/679 (GDPR) and the European Data Protection Board’s Guidelines 3/2018 on territorial scope.
Third-party email processor
We send email through Resend (resend.com), which delivers messages on our behalf via Amazon Simple Email Service (AWS SES). Resend receives the information required to deliver a message (the recipient’s email address, the message content, and standard delivery headers) and, where engagement tracking is enabled, aggregate open and click signals. Resend acts as our sub-processor and is contractually bound to use this information only to send email on our behalf.
Third parties who receive your email address
As of the effective date of this Privacy Policy, the only third parties that receive your email address are our email delivery provider (Resend) and its sub-processor (AWS SES). We do not sell or rent email addresses. We do not share them with advertising networks, data brokers, or third-party analytics platforms. If this changes in the future, we will update this Privacy Policy and notify affected users of the change.
Privacy contact
Questions about this section, preference changes you cannot make yourself, or requests to access or delete your data can be sent to privacy@flyspacea.com. We acknowledge privacy inquiries within seven (7) business days and substantively respond within thirty (30) days. For requests subject to a statutory deadline — such as California CCPA/CPRA verifiable consumer requests under Cal. Civ. Code § 1798.130 or GDPR data subject requests — we will respond within the statutory timeframe (for CCPA/CPRA, acknowledgment within 10 business days and response within 45 days of receipt).
Data Sharing
Limited sharing with:
- Cloud infrastructure providers (hosting & authentication)
- Analytics providers (aggregated metrics)
Payments, Stripe. If you subscribe to a paid plan, we use Stripe (stripe.com) to take and manage the payment. Stripe receives your name, email address, and the payment details you enter on its own hosted checkout page, and it processes them as an independent controller under its own privacy policy as well as on our instructions. We share your email address and account identifier with Stripe so a payment can be matched to your account. Stripe is based in the United States.
Email delivery — Resend. We use Resend (resend.com) as our email delivery provider. Resend, in turn, sends email through Amazon Simple Email Service (AWS SES). We share your email address and the content of the message we are sending you with Resend for the sole purpose of delivering that message. Resend is contractually prohibited from using your data for any other purpose and is bound by our data processing agreement. Resend and AWS are both based in the United States.
Push notifications, Google. Firebase Cloud Messaging (Google LLC, United States) receives the device token and the content of the notification for the sole purpose of delivering it. No account data beyond that is shared. See Google’s Firebase privacy and security policy.
We do not sell personal information.
Cookies
We use a small number of cookies. Every one of them falls into one of two categories, and neither requires your consent under the ePrivacy Directive’s exemption for cookies that are strictly necessary to deliver a service you’ve asked for.
Essential cookies keep the Service running and secure — they identify your signed-in session, protect against cross-site request forgery (CSRF), and, when you sign in with Google, Facebook, or Apple, keep you signed in between visits automatically.
Preference cookies remember a choice you make yourself with a control on the page. The light/dark theme toggle and, for staff, the admin sidebar toggle are both stored for up to a year, so you don’t have to set them again. Neither is used for tracking or profiling.
Because every cookie we set is either essential or a preference you asked us to remember, we do not show a cookie-consent banner.
Cloudflare Turnstile runs on our login, registration, and contact forms to filter automated abuse; it may set cookies or similar browser storage when you submit one of those forms. Google Fonts serves the typefaces used on every page; it does not set a cookie, but it does receive your IP address and browser user-agent with each font request.
