At a glance
This document forms part of the agreement between you and Zeptotravel LLC (“Zeptotravel”, “we”, “us”). It applies to every booking made through this website or through our telephone reservations desk.
Effective date: 28 August 2026 · Governing law: State of Delaware, USA · Questions: legal@zeptotravel.com
1. In one paragraph
Zeptotravel LLC does not sell your personal information for money. We do use a small number of advertising cookies that may pass identifiers to advertising partners, which California law classifies as sharing for cross-context behavioural advertising. This page tells you exactly what that involves and gives you three ways to stop it: switch off the Advertising category in our cookie preference centre, turn on Global Privacy Control in your browser, or email privacy@zeptotravel.com and we will apply the opt-out to your customer record as well. All three are free, none requires an account, and none affects your price or your service.
2. What “sale” and “sharing” mean under the CPRA
The California Consumer Privacy Act, as amended by the California Privacy Rights Act, defines these terms much more broadly than everyday language does.
“Sale” means disclosing personal information to a third party for monetary or other valuable consideration. The phrase “other valuable consideration” is what makes the definition wide: an exchange of data for analytics insight or advertising capability can qualify even where no invoice exists.
“Sharing” means disclosing personal information to a third party for cross-context behavioural advertising — advertising targeted to you based on your activity across websites that are not ours — whether or not anything of value changes hands. An advertising pixel that passes a cookie identifier to an ad platform, which the platform then uses to build an interest audience, is sharing.
Two things are deliberately excluded from both definitions, and it is worth knowing what they are so this page is not read as saying more than it does. Disclosures to a service provider or contractor that is contractually restricted to processing the data only on our instructions are not a sale or a share — that covers our hosting, telephony, email delivery and support tooling. And disclosures made at your direction to complete what you asked for are not a sale either: sending your name and passport details to an airline so it can issue your ticket is the service, not a sale, and no opt-out can switch it off without also switching off the booking.
3. What we do and do not do
| Activity | Do we do it? | Detail |
|---|---|---|
| Selling personal information for money | No | We have no data-sale revenue line and no data brokerage arrangements. |
| Selling or renting customer lists | No | Your contact details are never made available to another company for its own marketing. |
| Sharing for cross-context behavioural advertising | Yes, unless you opt out | Advertising cookies and pixels may pass online identifiers, hashed identifiers and browsing activity on our site to advertising platforms for audience building and campaign measurement. |
| Disclosing to service providers under contract | Yes — not a sale or share | Hosting, email and SMS delivery, telephony and call recording, support tooling, error monitoring, payment processing. Each is contractually restricted to our instructions. |
| Disclosing to suppliers to fulfil your booking | Yes — not a sale or share | Airlines and rental companies, and the ticketing systems in between. Required to deliver what you asked for. |
| Disclosing where the law requires it | Yes — not a sale or share | TSA Secure Flight and CBP/APIS transmissions for qualifying itineraries, and valid legal process. These cannot be opted out of. |
| Selling or sharing data of consumers under 16 | No | Never, with or without consent. |
| Selling or sharing sensitive personal information | No | Travel document numbers and assistance requests are used only to deliver the booking and are never used for advertising. |
4. How to opt out
Pick whichever suits you. You do not need to do all three, and you do not need an account for any of them.
Option 1 — The cookie preference centre (immediate)
- Open the “Cookie preferences” link in the footer of any page on this site.
- Set the Advertising and targeting category to off.
- Save. Advertising cookies already present in your browser for this site are cleared on your next page load, and no new ones are set.
This is a browser-level and device-level setting, so repeat it on each browser and device you use, and set it again if you clear your cookies.
Option 2 — Global Privacy Control (automatic)
Turn on GPC in a browser or extension that supports it. We detect and honour it with no further action from you. See section 5.
Option 3 — Email us (applies to your customer record)
Send an email to privacy@zeptotravel.com with the subject line “Do not sell or share”, and include:
- Your full name.
- The email address and telephone number you have used with us, so we can find your record.
- A booking reference if you have one — it makes the match immediate.
- The state you live in.
- A sentence stating that you are opting out of the sale and sharing of your personal information.
You can also call +1-888-555-0119 and ask the advisor to record a do-not-sell-or-share request on your file, or write to Zeptotravel LLC, 1201 Orange Street, Suite 600, Wilmington, DE 19801, USA marked for the attention of the Privacy Officer. We do not require you to create an account to make this request, and we do not require more information than is needed to identify you.
Our timeline
Browser-level opt-outs take effect immediately. Record-level requests are actioned as soon as practicable and in all cases within 15 business days, and we notify the advertising partners to whom we shared data in the preceding 90 days so they stop as well. We confirm in writing when it is done.
5. Global Privacy Control
Global Privacy Control is a signal your browser sends to every site you visit, saying that you do not want your personal information sold or shared. It is supported natively by some browsers and through extensions in others. We detect the signal on every page load and treat it as a valid opt-out request for that browser, applied automatically and without asking you to confirm.
Two limits, stated honestly. The signal is attached to a browser, not to a person: it does not follow you to your phone, and it disappears if you switch browsers or use private browsing that discards the setting. And because it arrives without identifying you, we cannot connect it to a customer record on our side. If you want the opt-out attached to your record as well — so it survives a new device — use Option 3 above.
6. Authorised agents
Someone else may submit an opt-out for you. An authorised agent should email privacy@zeptotravel.com with written permission signed by you, and we will normally contact you directly to confirm you gave that permission before we act on a record-level request. An agent holding a valid power of attorney under California Probate Code sections 4000 to 4465 does not need to provide separate written permission. We do not require identity verification for a straightforward opt-out beyond what is needed to locate the record, but we may deny a request if we cannot verify that the agent is genuinely authorised, and we will tell you why.
7. What happens after you opt out
- We stop passing identifiers to advertising partners for cross-context behavioural advertising from that browser, and we instruct partners we shared with in the preceding 90 days to stop using the data.
- You will still see advertising. The same quantity, in fact — it simply will not be targeted using data from this site.
- Your bookings, quotes and prices are entirely unaffected, and we will not treat you differently in any way. That is a legal prohibition on discrimination as well as our own policy.
- We continue to use strictly necessary cookies, and functional and analytics cookies where you have allowed them. Opting out of sale and sharing is not the same as opting out of analytics; if you want analytics off too, switch that category off in the preference centre.
- We continue to disclose personal information to suppliers to deliver your bookings and to authorities where the law requires it. Those are not sales or shares and are not affected by an opt-out.
- Under California regulations, we will not ask you to opt back in for at least 12 months.
- A browser-level opt-out is lost when you clear cookies or change browser. A record-level opt-out persists until you tell us to reverse it.
8. Sensitive information and under-16s
We never sell or share the personal information of consumers we know to be under 16, with or without consent. Sensitive personal information — for us, travel document numbers and the health-related details in an assistance request — is used only to arrange and deliver the service you asked for, and is never used for advertising, never enriched, and never disclosed to an advertising partner. Because we do not use it beyond the purposes the CPRA permits without a limitation right, there is no further “limit the use of my sensitive personal information” setting to apply; if you would like written confirmation of that for your own records, ask and we will send it.
9. Residents of other states
If you live in Virginia, Colorado, Connecticut, Utah or another state with a comprehensive privacy law in force, you have an equivalent right to opt out of targeted advertising and, where applicable, of sale. Use exactly the same routes on this page — the preference centre, GPC, or an email to our privacy desk — and mention your state so we apply the right rules and timelines to your request. We honour a universal opt-out signal such as GPC in every state that recognises one, whether or not that state requires us to.
10. Your other privacy rights
Opting out of sale and sharing is one right among several. You can also ask what we hold about you, ask for it to be corrected, ask for it to be deleted, and ask for a portable copy. Those rights, the exceptions that apply to them, how we verify a request and how long we take are all set out in the Privacy Policy. The mechanics of the cookies involved, and the full category-by-category table, are in the Cookie Policy.
11. Contact and appeals
Privacy desk: privacy@zeptotravel.com. Telephone: +1-888-555-0119, desk hours to be confirmed before launch. Post: Zeptotravel LLC, 1201 Orange Street, Suite 600, Wilmington, DE 19801, USA, attention Privacy Officer.
If we refuse a request, we will tell you why and how to appeal. To appeal, reply to our response with “Appeal” in the subject line within 60 days; a reviewer not involved in the original decision responds within 45 days. If you remain dissatisfied you may complain to the California Privacy Protection Agency, to the California Attorney General, or to the attorney general of your own state.