Privacy Policy

Information We Collect

We collect information that you provide directly and information that is collected automatically when you use our services:

• Account Information: Name and email address provided during sign-up through Google or Facebook authentication, plus the provider’s unique user ID. We also store your chosen Call Sign (display name).
• Order History: Details of your orders, including items purchased, order totals, tips, timestamps, and order notes.
• Payment Information: Payment is processed securely through Stripe. We store a Stripe Customer ID to enable saved payment methods but do not store your credit card number, CVV, or full card details on our servers.
• Loyalty Data: Jetsetter Miles balance, transaction history, weekly activity counts, and program participation data.
• Push Notification Data: If you opt in to push notifications, we store your device’s push subscription endpoint and encryption keys to deliver order status updates.
• Device & Usage Data: We may collect browser type, operating system, device type, IP address, pages visited, and interaction data to improve our services and diagnose technical issues.

How We Use Your Information

• To process and fulfill your orders
• To manage your Jetsetter Miles and loyalty program
• To send order confirmations and real-time status updates
• To send push notifications about your order (with your opt-in consent)
• To enable saved payment methods for faster checkout
• To improve our menu, services, and user experience
• To prevent fraud, abuse, and unauthorized access
• To comply with legal obligations and enforce our Terms of Service

Text Messages (SMS)

If you provide us with your mobile number — for example, by texting or calling the café’s business line, or sharing it with us for an order or inquiry — you consent to receive text messages from L’Avion Café related to your order, pickup, or question. Message frequency varies. Message and data rates may apply. Reply STOP at any time to opt out, or HELP for help. Consent to receive text messages is not a condition of any purchase.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, except with our SMS service provider solely to the extent necessary to deliver the messages you have requested.

Third-Party Services

We use the following third-party services to operate our platform:

• Stripe: For secure payment processing and saved payment methods. Stripe’s privacy policy governs their handling of your payment data.
• Google: For authentication and sign-in via Google OAuth. We receive your name, email address, and Google user ID.
• Facebook: We use Facebook Login as an authentication option. When you sign in with Facebook, we receive your name, email address (if you grant the email permission), and Facebook user ID. We use this information solely to create and identify your L’Avion Café account — we do not post to your Facebook profile, access your friends list, or read any other Facebook data. You can revoke our app’s access at any time from your Facebook account at Settings → Apps and Websites. Facebook’s handling of your data is governed by Facebook’s Privacy Policy.
• Web Push Services: For delivering push notifications through your browser’s built-in push infrastructure.

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

Cookies & Local Storage

We use browser cookies to manage your authentication session and local storage to save your cart and app preferences. These are essential for the app to function and cannot be disabled while using the service. We do not use third-party tracking cookies or advertising cookies.

Data Security

We implement commercially reasonable technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These include encrypted connections (HTTPS), signed authentication cookies, and secure payment processing through Stripe. However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

Data Retention

We retain your account and order data for as long as your account is active or as needed to provide our services and comply with legal obligations. Jetsetter Miles expire after 100 days of inactivity. If you request account deletion, your data is retained for 30 days (to allow account recovery) and then permanently removed. Certain data may be retained longer as required by tax, legal, or regulatory obligations.

Account & Data Deletion

You can request deletion of your account and associated data in two ways:

• In the app: Sign in, open your Profile, and tap “Delete Account.”
• By email: Send a deletion request from your registered email address to [email protected]. We verify the request by matching the sender against the email on file for your account.

Once a deletion request is received, your account is disconnected from any linked sign-in provider (Google or Facebook) and your data is retained for 30 days before permanent removal. During that 30-day window, signing in again with the same account will restore your data. After 30 days, your account, Jetsetter Miles balance, order history, and preferences are permanently removed. Certain records may be retained longer where required by tax, legal, or regulatory obligation (for example, transaction records for accounting compliance).

If you signed in with Facebook, you can also revoke our app’s access from your Facebook account at Settings → Apps and Websites. Revoking access prevents future sign-in but does not by itself delete your existing L’Avion Café account — use one of the two paths above to request deletion.

Data Breach Notification

In the event of a data breach that compromises your personal information, we will notify affected users in accordance with applicable law, including the New York SHIELD Act. Notification will be provided via email and/or through the app as promptly as reasonably possible.

Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Request access to the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and data
• Opt out of push notifications at any time through your device settings
• Request portability of your data in a machine-readable format

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

California Residents

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA). You have the right to know what personal information we collect, request its deletion, and opt out of any sale of personal information. We do not sell personal information. To make a verifiable consumer request, contact us at [email protected].

Children’s Privacy

Our services are not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will promptly delete that information. If you believe a child under 13 has provided us with personal information, please contact us at [email protected].

Do Not Track

Our app does not track users across third-party websites and therefore does not respond to Do Not Track (DNT) signals. We do not use third-party advertising or behavioral tracking.

Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the app or by email. The “Last updated” date at the top of this page indicates when the policy was last revised. Your continued use of our services after changes are posted constitutes acceptance of the updated policy.

Contact

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us at [email protected] or in person at 338 E 92nd St, New York, NY.