Privacy Policy

Effective Date: May 8, 2025

This Privacy Policy describes how WorksOfAir ("we," "us," or "our") collects, uses, and discloses your personal information when you visit our website, use our services, or purchase our products (minimalist aviation art prints, airport map posters, and related aviation-themed decor) from our Shopify store (the "Services"). It also explains your privacy rights and how the law protects you.

We are committed to protecting your privacy and ensuring that your personal information is handled in a safe and responsible manner. Please read this Privacy Policy carefully. By using our Services, you agree to the collection and use of information in accordance with this policy.

----

SECTION 1 - WHAT INFORMATION DO WE COLLECT?

When you engage with our Services, we collect personal information to provide and improve your experience. The types of personal information we may collect include:

Information you provide directly to us:

Contact Information: Your name, shipping address, billing address, email address, and phone number when you make a purchase or create an account.

Payment Information: Credit card details or other payment method information. Note that direct payment gateway information is typically handled by Shopify and its payment processors and encrypted through the Payment Card Industry Data Security Standard (PCI-DSS). We do not store your full credit card information on our servers.

Order Information: Details of the products you purchase (e.g., specific art prints, customization details if applicable).

Communications: When you contact us for customer support, subscribe to our newsletter, or communicate with us in any other way, we collect the information you provide in those communications.

Account Information: If you create an account, your username, password, and other preferences.

Information we collect automatically when you use our Services:

Device and Usage Information: When you browse our store, we automatically receive your computer’s internet protocol (IP) address, browser type, operating system, referral URLs, pages viewed, links clicked, and the dates and times of your interactions with our Services.

Cookies and Similar Tracking Technologies: We use cookies and similar tracking technologies to collect information about your Browse activities, preferences, and to enhance the functionality of our store. For more details, please see SECTION 7 - COOKIES.

Location Information: We may infer your general geographic location (e.g., city, state, country) from your IP address.

Information from Third Parties:

We may receive information about you from third-party service providers, such as payment processors, shipping partners, and analytics providers, to the extent necessary to provide our Services.

SECTION 2 - HOW DO WE USE YOUR INFORMATION?

We use your personal information for various purposes, including:

Providing and Managing Our Services:

To process and fulfill your orders, including shipping and handling.

To process payments and prevent fraudulent transactions.

To create and manage your account.

To communicate with you about your orders, account, and any inquiries.

Improving Our Services:

To understand how you use our Services and to improve our website design, product offerings, and customer experience.

To analyze trends and user engagement.

For research and development purposes.

Marketing and Advertising (with your consent where required):

With your permission, to send you emails or SMS/MMS messages about our store, new products, special offers, and other updates you might find interesting. You can opt-out of marketing communications at any time (see SECTION 3 - CONSENT).

To personalize your shopping experience and to show you relevant advertisements (which may involve third-party advertising partners and cookies, as detailed in SECTION 5 and SECTION 7).

Legal and Security Purposes:

To comply with applicable legal obligations, such as tax laws and regulatory requirements.

To protect the security and integrity of our Services, prevent fraud, and enforce our Terms of Service.

To respond to legal requests, court orders, or government inquiries.

Lawful Basis for Processing (for individuals in the European Economic Area - EEA, UK, and Switzerland):

If you are an individual in the EEA, UK, or Switzerland, we collect and process your personal information only where we have a lawful basis for doing so under applicable data protection laws. Our lawful bases include:

Contract: To perform our contractual obligations to you (e.g., to process your order).

Consent: Where you have given us explicit consent to use your personal information for a specific purpose (e.g., for email marketing).

Legitimate Interests: Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests (e.g., for fraud prevention, improving our Services, or for security purposes).

Legal Obligation: To comply with a legal obligation (e.g., for tax purposes).

SECTION 3 - CONSENT

How do you get my consent?

Transactional Consent: When you provide us with personal information to complete a transaction, verify your credit card, place an order, arrange for a delivery, or return a purchase, we imply that you consent to our collecting it and using it for that specific reason only.

Marketing Consent: If we ask for your personal information for a secondary reason, like marketing (e.g., email newsletters, SMS/MMS messages), we will either ask you directly for your expressed consent (e.g., via a checkbox) or provide you with an opportunity to say no or opt-out.

How do I withdraw my consent?

If after you opt-in, you change your mind, you may withdraw your consent for us to contact you, or for the continued collection, use, or disclosure of your information, at any time, by:

Clicking the "unsubscribe" link in any marketing email we send you.

Replying "STOP" to any SMS/MMS message from us.

Contacting us directly at windham@worksofair.com

Mailing us at: 311 E Wapato Ave, Chelan, WA 98816

Please note that withdrawing consent for certain uses of your information may impact our ability to provide you with some of our Services. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

SECTION 4 - DISCLOSURE OF YOUR INFORMATION

We do not sell your personal information. We may disclose your personal information in the following circumstances:

Service Providers: We share your information with third-party service providers who perform services on our behalf, such as payment processing (e.g., Shopify Payments, PayPal), order fulfillment and shipping, data analytics (e.g., Google Analytics), email and SMS/MMS marketing, website hosting, and fraud prevention. These providers are contractually obligated to protect your information and are only permitted to use it for the specific services they provide to us.

Shopify: Our store is hosted on Shopify Inc. They provide us with the online e-commerce platform that allows us to sell our products and services to you. Your data is stored through Shopify’s data storage, databases, and the general Shopify application. They store your data on a secure server behind a firewall. For more insight, you may also want to read Shopify’s Terms of Service (https://www.shopify.com/legal/terms) and Privacy Statement (https://www.shopify.com/legal/privacy).

Legal Requirements: We may disclose your personal information if we are required by law to do so (e.g., in response to a subpoena, court order, or other legal process) or if we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.

Business Transfers: If our store is acquired, merged with another company, or in the event of a bankruptcy, your information may be transferred to the new owners as part of the transaction, so that they may continue to sell products to you. We will notify you of any such change in ownership or control of your personal information.

With Your Consent: We may disclose your personal information to other third parties with your explicit consent.

Protection of Rights: If you violate our Terms of Service, we may disclose your information as necessary to enforce our rights.

SECTION 5 - THIRD-PARTY SERVICES AND LINKS

In general, the third-party providers used by us will only collect, use, and disclose your information to the extent necessary to allow them to perform the services they provide to us.

However, certain third-party service providers, such as payment gateways (e.g., PayPal, Stripe, Apple Pay) and other payment transaction processors, have their own privacy policies in respect to the information we are required to provide to them for your purchase-related transactions. For these providers, we recommend that you read their privacy policies so you can understand the manner in which your personal information will be handled by them.

In particular, remember that certain providers may be located in or have facilities that are located in a different jurisdiction than either you or us. So if you elect to proceed with a transaction that involves the services of a third-party service provider, then your information may become subject to the laws of the jurisdiction(s) in which that service provider or its facilities are located. For example, if you are located in Canada and your transaction is processed by a payment gateway located in the United States, then your personal information used in completing that transaction may be subject to disclosure under United States legislation, including the Patriot Act.

Links to Other Websites: When you click on links on our store, they may direct you away from our site. We are not responsible for the privacy practices of other sites and encourage you to read their privacy statements. This Privacy Policy does not apply to third-party websites or services.

Google Analytics: Our store uses Google Analytics to help us learn about who visits our site, what pages are being looked at, and how users interact with our Services. Google Analytics may use cookies to collect this information. You can learn more about Google's practices by going to https://policies.google.com/privacy, and opt-out of them by downloading the Google Analytics opt-out browser add-on, available at https://tools.google.com/dlpage/gaoptout.

SECTION 6 - SECURITY OF YOUR INFORMATION

To protect your personal information, we take reasonable precautions and follow industry best practices to make sure it is not inappropriately lost, misused, accessed, disclosed, altered, or destroyed.

If you provide us with your credit card information through a direct payment gateway, the information is encrypted using secure socket layer technology (SSL) and stored with AES-256 encryption. All direct payment gateways used by Shopify adhere to the standards set by PCI-DSS as managed by the PCI Security Standards Council, which is a joint effort of brands like Visa, MasterCard, American Express, and Discover. PCI-DSS requirements help ensure the secure handling of credit card information by our store and its service providers.

While we strive to use commercially acceptable means to protect your Personal Information, please remember that no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee its absolute security.

SECTION 7 - COOKIES AND TRACKING TECHNOLOGIES

We use cookies and similar tracking technologies (like web beacons and pixels) to operate and personalize our website, analyze trends, track users' movements around the website, and to gather demographic information about our user base as a whole.

What are Cookies? Cookies are small files that a site or its service provider transfers to your computer’s hard drive through your Web browser (if you allow) that enables the site’s or service provider’s systems to recognize your browser and capture and remember certain information.

How We Use Cookies:

Essential Cookies: These are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in, or filling in forms (e.g., _session_id, _secure_session_id, cart, storefront_digest).

Performance and Analytics Cookies: These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site (e.g., _shopify_visit, _shopify_uniq, Google Analytics cookies).

Functionality Cookies: These cookies enable the website to provide enhanced functionality and personalization. They may be set by us or by third-party providers whose services we have added to our pages.

Marketing and Advertising Cookies: These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites (e.g., PREF set by Google).

Your Choices Regarding Cookies:

You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. If you choose to decline cookies, you may not be able to fully experience the interactive features of our Services.

Shopify provides information on the cookies they use. Here is a general list of common Shopify cookies:

_session_id, unique token, sessional, Allows Shopify to store information about your session (referrer, landing page, etc).

_shopify_visit, no data held, Persistent for 30 minutes from the last visit, Used by our website provider’s internal stats tracker to record the number of visits.

_shopify_uniq, no data held, expires midnight (relative to the visitor) of the next day, Counts the number of visits to a store by a single customer.

cart, unique token, persistent for 2 weeks, Stores information about the contents of your cart.

_secure_session_id, unique token, sessional.

storefront_digest, unique token, indefinite. If the shop has a password, this is used to determine if the current visitor has access.

PREF, persistent for a very short period, Set by Google and tracks who visits the store and from where.

For more detailed information on the cookies we use and the purposes for which we use them, please refer to our Cookie Policy [Optional: Link to a separate, more detailed Cookie Policy if you have one, otherwise this section can serve as your cookie disclosure] or contact us. You may also be able to manage your cookie preferences through our website's cookie consent tool, if available.

Do Not Track: Some browsers incorporate a "Do Not Track" (DNT) feature that signals to websites you visit that you do not want to have your online activity tracked. Please note that we do not currently respond to DNT signals because there is no universally accepted standard for how to respond to DNT signals.

SECTION 8 - YOUR PRIVACY RIGHTS

Depending on your location and applicable laws (such as GDPR for EEA/UK residents or CCPA/CPRA for California residents), you may have certain rights regarding your personal information. These rights may include:

Right to Access: You have the right to request access to the personal information we hold about you and to receive a copy of that information.

Right to Rectification (Correction): You have the right to request that we correct any inaccurate or incomplete personal information we hold about you.

Right to Erasure (Deletion or "Right to be Forgotten"): You have the right to request that we delete your personal information under certain conditions (e.g., if the information is no longer necessary for the purposes for which it was collected).

Right to Restrict Processing: You have the right to request that we restrict the processing of your personal information under certain circumstances (e.g., if you contest the accuracy of the data).

Right to Data Portability: You have the right to receive the personal information you have provided to us in a structured, commonly used, and machine-readable format, and to transmit that data to another controller, where technically feasible.

Right to Object to Processing: You have the right to object to our processing of your personal information based on our legitimate interests or for direct marketing purposes.

Right to Withdraw Consent: Where we rely on your consent to process your personal information, you have the right to withdraw that consent at any time.

Right to Opt-Out of Sale or Sharing (for California Residents): Under the CCPA/CPRA, California residents have the right to opt-out of the "sale" or "sharing" of their personal information. While we do not "sell" personal information in the traditional sense, some data sharing for targeted advertising may be considered "sharing" under CCPA/CPRA. You can exercise this right by [Describe how users can opt-out, e.g., clicking a "Do Not Sell or Share My Personal Information" link on your website, or contacting you via the details below. Ensure this link is present if required.].

Right to Limit Use and Disclosure of Sensitive Personal Information (for California Residents): California residents have the right to limit the use and disclosure of their sensitive personal information to that which is necessary to perform the services or provide the goods reasonably expected by an average consumer. [Describe how users can exercise this right if you collect sensitive personal information. For art prints, this is less likely to be applicable unless customization involves sensitive data.]

Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.

How to Exercise Your Rights:

To exercise any of these rights, please contact us using the contact details provided in

SECTION 15 - CONTACT INFORMATION. We will respond to your request within the timeframes required by applicable law. We may need to verify your identity before processing your request, which may require you to provide additional information. If we are unable to fulfill your request, we will explain why.

You may also have the right to lodge a complaint with a supervisory authority or data protection regulator in your jurisdiction if you believe that our processing of your personal information violates applicable law.

SECTION 9 - DATA RETENTION

We will retain your personal information only for as long as is necessary for the purposes set out in this Privacy Policy, including to provide you with our Services, comply with our legal obligations (e.g., tax, accounting, or other legal requirements), resolve disputes, and enforce our legal agreements and policies.

The criteria used to determine our retention periods include:

The length of time we have an ongoing relationship with you and provide Services to you (e.g., as long as you have an account with us or keep using our Services).

Whether there is a legal obligation to which we are subject (e.g., certain laws require us to keep records of your transactions for a certain period of time before we can delete them).

Whether retention is advisable in light of our legal position (such as in regard to applicable statutes of limitations, litigation or regulatory investigations).

When we no longer need to use your personal information and there is no need for us to keep it to comply with our legal or regulatory obligations, resolve disputes or enforce our agreements, we’ll either remove it from our systems or depersonalize it so that we can't identify you.

SECTION 10 - AGE OF CONSENT

By using this site, you represent that you are at least the age of majority in your state, province, or country of residence, or that you are the age of majority in your state, province, or country of residence and you have given us your consent to allow any of your minor dependents to use this site.

Our Services are not intentionally directed at or intended for use by children under the age of 16 (or a higher age threshold where applicable under local law). We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal information from a child under 16 without verification of parental consent, we will take steps to remove that information from our servers. If you believe that we might have any information from or about a child under 16, please contact us at the details provided in SECTION 15.

For California residents, we do not knowingly "sell" or "share" the personal information of consumers under 16 years of age unless we receive affirmative authorization (the "right to opt-in") from either the consumer who is at least 13 but not yet 16 years of age, or the parent or guardian of a consumer less than 13 years of age.

SECTION 11 - INTERNATIONAL DATA TRANSFERS

Your personal information may be transferred to, stored, and processed in countries other than your own, including the United States, where our servers and our third-party service providers' servers may be located. These countries may have data protection laws that are different from the laws of your country.

If we transfer your personal information from the EEA, UK, or Switzerland to other countries not deemed adequate by the European Commission, we will ensure that appropriate safeguards are in place to protect your personal information, such as by using Standard Contractual Clauses (SCCs) approved by the European Commission, or other legally recognized transfer mechanisms.

By using our Services, you understand that your information may be transferred to our facilities and those third parties with whom we share it as described in this Privacy Policy.

SECTION 12 - CHANGES TO THIS PRIVACY POLICY

We reserve the right to modify this privacy policy at any time, so please review it frequently. Changes and clarifications will take effect immediately upon their posting on the website.

If we make material changes to this policy (e.g., how we use your information or your rights), we will notify you here that it has been updated, and may also notify you through other means, such as by email or a notice on our homepage, prior to the change becoming effective. We will also update the "Effective Date" at the top of this Privacy Policy. Your continued use of our Services after any changes or revisions to this Privacy Policy shall indicate your agreement with the terms of such revised Privacy Policy.

We encourage you to periodically review this page for the latest information on our privacy practices.

SECTION 13 - SMS/MMS MOBILE MESSAGING MARKETING PROGRAM

We respect your privacy. If you opt-in to our SMS/MMS mobile messaging marketing program, we will only use the information you provide through the Program to transmit your mobile messages and respond to you, if necessary. This includes, but is not limited to:

Sending you promotional messages, cart reminders, and updates about our products and services. Sharing information with platform providers, phone companies, and other vendors who assist us in the delivery of mobile messages.

Consent and Opt-Out: You can opt-in to receive SMS/MMS messages by [Describe how users opt-in, e.g., providing your phone number and checking a consent box at checkout or via a specific sign-up form]. Your consent to receive automated marketing text messages is not a condition of any purchase. Message and data rates may apply.

You can cancel the SMS/MMS service at any time. Just text "STOP" to the shortcode or phone number from which you received the message. After you send the SMS message "STOP" to us, we will send you an SMS message to confirm that you have been unsubscribed. After this, you will no longer receive SMS/MMS messages from us. If you want to join again, just sign up as you did the first time, and we will start sending SMS/MMS messages to you again.

If you are experiencing issues with the messaging program you can reply with the keyword HELP for more assistance, or you can get help directly at windham@worksofair.com

Data Use: We use cookies to help keep track of items you put into your shopping cart, including when you have abandoned your cart, and this information is used to determine when to send cart reminder messages via SMS.

WE DO NOT SELL, RENT, LOAN, TRADE, LEASE, OR OTHERWISE TRANSFER FOR PROFIT ANY PHONE NUMBERS OR CUSTOMER INFORMATION COLLECTED THROUGH THE PROGRAM TO ANY THIRD PARTY, except as disclosed in this Privacy Policy or as required by law.

The above excludes text messaging originator opt-in data and consent; this information will not be shared with any third parties except for the purpose of administering the SMS/MMS mobile messaging marketing program as described above.

Accuracy of Information: When you complete forms online or otherwise provide Us information in connection with the Program, you agree to provide accurate, complete, and true information. You agree not to use a false or misleading name or a name that you are not authorized to use. If, in Our sole discretion, We believe that any such information is untrue, inaccurate, or incomplete, or you have opted into the Program for an ulterior purpose, We may refuse you access to the Program and pursue any appropriate legal remedies.

SECTION 14 - SPECIFIC PROVISIONS FOR CALIFORNIA RESIDENTS (CCPA/CPRA)

This section supplements the information contained in our Privacy Policy and applies solely to visitors, users, and others who reside in the State of California ("consumers" or "you"). We adopt this notice to comply with the California Consumer Privacy Act of 2018 (CCPA) as amended by the California Privacy Rights Act of 2020 (CPRA) and other California privacy laws.

Information We Collect:

We collect information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or device ("personal information"). We have collected the following categories of personal information from consumers within the last twelve (12) months:

Identifiers: (e.g., name, postal address, IP address, email address, account name)

Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)): (e.g., name, address, telephone number, credit card number)

Commercial information: (e.g., products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies)

Internet or other similar network activity: (e.g., Browse history, search history, information on a consumer's interaction with a website, application, or advertisement)

Geolocation data: (e.g., approximate location derived from IP address)

Inferences drawn from other personal information: (e.g., profile reflecting a person's preferences or characteristics)

We obtain the categories of personal information listed above from the sources detailed in SECTION 1 of this Privacy Policy.

Use of Personal Information:

We use the categories of personal information listed above for the purposes detailed in SECTION 2 of this Privacy Policy.

Sharing Personal Information:

We may disclose your personal information to third parties for business purposes as described in SECTION 4. In the preceding twelve (12) months, we have disclosed the following categories of personal information for a business purpose:

Identifiers

California Customer Records personal information categories

Commercial information

Internet or other similar network activity

Geolocation data

We disclose your personal information for a business purpose to the categories of third parties listed in SECTION 4.

"Sales" and "Sharing" of Personal Information:

Under the CCPA/CPRA, "sale" is broadly defined and may include the sharing of personal information for monetary or other valuable consideration. "Sharing" is defined as disclosing personal information for cross-context behavioral advertising.

We do not "sell" your personal information in the traditional sense of exchanging it for monetary payment. However, like many online businesses, we may use third-party advertising and analytics services (such as those provided by Google, Facebook, etc.) that may collect information from your browser or device through cookies or similar technologies. This activity may be considered "sharing" personal information under the CCPA/CPRA.

In the preceding twelve (12) months, we may have "shared" the following categories of personal information for cross-context behavioral advertising:

Identifiers (e.g., IP address, cookie IDs)

Internet or other similar network activity (e.g., Browse history, interaction with ads)

Inferences drawn from your activity

Right to Limit Use of Sensitive Personal Information:

We do not currently collect "sensitive personal information" as defined by the CPRA that would require offering a specific "Limit the Use of My Sensitive Personal Information" link. If our practices change, we will update this policy.

Data Retention:

Our data retention practices are described in SECTION 9.

Financial Incentives:

We do not currently offer any financial incentives for the collection or use of personal information. If we decide to offer any such program, we will provide you with more information about the material terms of the program and obtain your prior opt-in consent.

California Civil Code Section § 1798.83 permits users of our website that are California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. To make such a request, please contact us using the details in SECTION 15.

SECTION 15 - CONTACT INFORMATION

If you have any questions about this Privacy Policy, our privacy practices, or if you would like to exercise any of your privacy rights, please do not hesitate to contact us:

By email: windham@worksofair.com

If you are contacting us to exercise your rights, please include your name, email address, and a description of your request. We may need to request further information from you to verify your identity before we can respond to your request.