Protecting your privacy

This Privacy Policy explains how American Airlines, Inc. and certain affiliates ("we," "us," "our," "American") collect, use, share, and protect information in connection with American services that refer or link to this Privacy Policy ("our Services"). The affiliates to which this Privacy Policy applies includes without limitation, Envoy Air Inc. This Privacy Policy applies regardless of the type of device you use to access our Services.

American reserves the right to change this Privacy Policy at any time by posting the updated Policy here along with the date on which the Policy was changed. If we make material changes to this Privacy Policy that affect the way we collect, use and/or share your personal information, we will notify you by including a "NEWLY UPDATED" label with the "PRIVACY POLICY" link on our Services for 30 days after material changes are made.

Information we collect and how we collect it

We collect and maintain personal information about you from many sources to understand and meet your needs, facilitate your travel, manage our business, and for other purposes disclosed to you. For example, we collect personal information about you from:

• You, when you voluntarily provide us with information
• Your transactions with American
• Other third party sources, such as providing your transportation and services such as travel agents, other airlines (e.g., code share and alliance partners) and travel and hospitality service providers

If the information is to be collected directly from you, you may in some cases have the option to decline providing that information. However, your choice to not provide information may impact your use of certain features or services.

The personal information we collect about you through these various sources may include, but is not limited to:

• Name, addresses and telephone numbers
• Date of birth and gender
• Email addresses, fax numbers and pager numbers
• AAdvantage account number and flight information
• Credit/debit card number(s), including associated billing address(es) and expiration date(s)
• Information required to facilitate travel or other services, including travel companion(s) names, emergency contacts, and photographs
• Passport number, nationality and country of residence
• Use of products and services such as self-service devices, flight status notification and online check-in
• Information provided via survey, focus group or other marketing research efforts
• Information provided to customer-service representatives to research and resolve issues or questions
• Corporate-contract, employer and/or other corporate affiliation (e.g., employer name, title, work address and contact information), including Business Extra account information (e.g., tax ID, business type, number of employees, number of business travelers, and travel manager information)

To the extent that the personal information we collect constitutes sensitive personal information under applicable law, American will collect and process this sensitive personal information within the limits provided by applicable law, and only after establishing reasonable security safeguards for such sensitive personal information. Where required by law, American will seek your consent before processing sensitive personal information.

Minors

Due to the nature of our Services, we may collect travel information, which may include personal information, about children when it is required to comply with the law, including federal aviation or security regulations, or as otherwise required to provide transportation needs and services. We may retain personal information when required to provide transportation and related services to a child. American does not knowingly collect personal information directly from children – persons under the age of 13, or another age if required by applicable law – other than when required to comply with the law or for safety and security reasons.

If you are a parent or guardian of a child who has provided personal information without your knowledge and consent, you may request we remove this children’s information by emailing privacy@evaair.com.

Automatically collected information (including cookies and geolocation)

When you use our Services, we may receive technical information such as your browser type, the type of operating system you use, your geolocation, the name of your internet service provider, mobile advertising identifiers, and pages visited on our Services. American gets this information by using technologies, including cookies, web beacons, and mobile device geolocation to provide and improve our Services and advertising, including across browsers and devices (also known as cross-device linking). We also use this information to verify that visitors meet the criteria required to process their requests and for reporting activity on our Services. For example, we may want to know how long the average user spends on our Services or which pages or features get the most attention. This automatically collected information may be combined with information that is personally identifiable in order to personalize our Services and advertising to your interests, including across browsers and devices.

Additionally, American may combine the information we receive from you with information collected from other sources. This information may be used to provide offers and/or services specifically tailored to your interests in accordance with applicable laws.

Information collected by third parties on our Services

Some of the content, advertising, and functionality on our Services may be provided by third parties that are not affiliated with us. As noted above, these and other third parties may collect or receive technical information about your use of our Services, including through the use of cookies, web beacons, and other technologies, and this information may be collected over time and combined with information collected on different websites and online services.

For example, some of our Services include social network or other third-party plug-ins (such as Facebook’s "Like" button) that enable you to login to certain of our Services, to comment on content available on our Services, and to share things you find on our Services with your social network. The providers of these plug-ins may be able to collect information about you even if you do not click on or otherwise interact with the plug-in or widget and regardless of whether you have an account or other relationship with these social networks and third parties. If you use social network tools or visit social networking sites, you should read their privacy disclosures to learn what information they collect, use, and share.

Also, some third parties collect information about users of our Services in order to provide interest-based advertising (on our Services and elsewhere, including across browsers and devices, also known as cross-device linking). These third parties may use the information they collect on our Services to make predictions about your interests in order to provide you ads (from us and other companies) across the internet. Some of these third parties may participate in an industry organization that gives users the opportunity to opt out of receiving ads that are tailored based on online activities. For more information about interest-based advertising and how to opt out, please visit the Digital Advertising Alliance. Due to differences between using apps and websites on mobile devices, you may need to take additional steps to disable targeted ad technologies in mobile apps. Many mobile devices allow you to opt out of targeted advertising for mobile apps using the settings within the mobile app or your mobile device. For more information, please check your mobile settings. You also may uninstall our apps using the standard uninstall process available on your mobile device or app marketplace.

To opt out of interest-based advertising across browsers and devices, please opt out through the Digital Advertising Alliance or Network Advertising Initiative website and also through the settings within the mobile app or your mobile device. Your opt-out choice may apply only to the browser or device you are using when you opt out, so you should opt out on each of your browsers and devices if you want to disable all cross-device linking for interest-based advertising. If you opt out, you will still receive ads but they may not be as relevant to you and your interests.

How your information will be used

Our Services

We use personal information to complete transactions and fulfill requests for our products and services. For example, we require you to provide personal information when making a reservation to purchase airline tickets or related products and services such as renting cars or booking hotel rooms through an American Airlines Reservations Agent, travel agent, the evaair.com website or other travel-related website, or enrolling in the AAdvantage and Business Extra programs.

Administrative, marketing, analytical purposes

In addition to processing, confirming and fulfilling the travel or other services or products you request, American may use personal information for administrative, analytical, and marketing purposes such as information systems management, accounting, billing and audits, credit card processing and verification, customer-relations correspondence, and/or operation of the AAdvantage and Business Extra programs. American also uses personal information to identify, develop and market products and services that we believe you will value, including across browsers and devices, in accordance with applicable laws.

• Business purposes and communication: To provide flight services or information you requested, to communicate with you for business or customer service reasons, or for other such reasons such as changes to our policies or in response to your inquiry
• Financials transaction management: To facilitate payment for services or provide refunds
• Legal and Regulatory Obligations: To comply with legal, regulatory, or fiscal obligations, or in connection with litigation or an internal investigation or audit
• Tailored web experience: To personalize your advertising experience when visiting our sites, and to manage details about your account, when security updates are available, or when an action is required to keep the account active
• Marketing and Analytics: To perform data analyses and other processing for marketing purposes
• Site maintenance: To improve content, functionality, and usability of our sites and to offer opportunities to participate in surveys and provide feedback to us
• Security management: To secure American’s premises, assets, and information
• Third party requests: To respond to and comply with outside requests initiated by you, as well as in response to legal requests
• Audit and controls: To evaluate internal controls and audits for compliance (including those conducted by American’s internal and external audit service providers)

There are Closed Circuit Television (CCTV) cameras in operation within and around our stations and other premises, which are used for the following purposes:

• to prevent and detect crime;
• to protect the health and safety of American’s customers and employees;
• to manage and protect American’s property and the property of American’s guests and other visitors; and
• for quality assurance purposes.

Security

When you buy an American Airlines ticket or access your AAdvantage account over the web, your web browser connects to our Services through SSL (Secure Sockets Layer). SSL is an industry-standard way to send information over the internet in a more secure way. SSL also ensures you are actually sending data to American and not someone who claims to be American.

Please note, however, that while American attempts to safeguard your personally identifiable information, no method of transmitting or storing electronic information is ever completely secure, and thus we make no warranty, express, implied, or otherwise, that your information will never be accessed, used or released in a manner that is inconsistent with this Privacy Policy. IN NO EVENT SHALL WE BE LIABLE FOR ANY DAMAGES (WHETHER CONSEQUENTIAL, DIRECT, INCIDENTAL, INDIRECT, PUNITIVE, SPECIAL OR OTHERWISE) ARISING OUT OF, OR IN ANY WAY CONNECTED WITH, A THIRD PARTY'S UNAUTHORIZED ACCESS TO YOUR INFORMATION, REGARDLESS OF WHETHER SUCH DAMAGES ARE BASED ON CONTRACT, STRICT LIABILITY, TORT OR OTHER THEORIES OF LIABILITY, AND ALSO REGARDLESS OF WHETHER WE ARE GIVEN ACTUAL OR CONSTRUCTIVE NOTICE THAT DAMAGES WERE POSSIBLE, EXCEPT AS PROVIDED UNDER APPLICABLE LAWS.

With whom your information will be shared

General

American does not share personal information with third parties except as stated in this Privacy Policy. We may disclose information to companies affiliated with American and/or unaffiliated third parties (i) to provide the products and services you have requested; and (ii) for administrative, analytical, and marketing purposes. For example, we may provide information we collect about you to third parties to distribute promotions, sweepstakes, marketing surveys, focus groups, interviews and other opportunities offered by American.

We may also disclose personal information to third parties, such as employers, who have arranged for discounts, purchased travel or other services on your behalf.

In addition, from time to time, we may share information with affiliated American companies such as Envoy Air Inc., and with certain third party companies with which we have a business relationship, including AAdvantage and Business Extra participants. These companies may send you offers based on the information you have provided us. Where we are required by applicable law, we will seek your consent prior to sharing your personal information with such third parties for marketing purposes. Also, as described below, you can opt out of having your information shared with third parties for those parties' direct marketing purposes by emailing us at privacy@evaair.com.

In the event we undergo a business transition involving another company, such as a merger, corporate reorganization, acquisition, the lease or sale of all or a portion of our assets, or in the event of bankruptcy, information that we have collected from or about you or your devices may be disclosed to such other entity as part of the due diligence or business integration process and will be transferred to such entity as one of the transferred assets.

Legal requirements

Please note that the laws and regulations of several countries, including without limitation, the requirements imposed under the Transportation Security Administration Secure Flight program, require us to provide foreign and domestic government agencies with access to the personal information you disclose to us and data that we have about you and your travel plans, history, or status, including both before and after a flight arrives. American does not have control or knowledge of the storage and use of that data after it has been delivered to the respective government entity. Further, to the extent required by law, we may disclose personal information to government authorities, or to third parties pursuant to a subpoena or other legal process, and we may also use or disclose your information as permitted by law to protect the rights or property of American, our customers, our services, or its users.

Obtaining and handling your consent

By using our Services and submitting personal information to this site, you are accepting and consenting to the practices and uses described in this Privacy Policy. This Privacy Policy is not a contract. American will seek to obtain your additional consent where required by applicable law.

Application of local laws

Where required by local law, you may have the right to access, update or request that we delete your personal information. To inform us of inaccuracies or changes to your personal information, please use the below contact information to reach out to American. American will, in accordance with applicable law, update, grant access to, or delete such information. Please note, requests to correct, transfer or delete personal information are subject to applicable legal, ethical reporting, or document retention obligations imposed on us.

When you provide us with your information, you acknowledge that this information may be stored, transferred, and processed on servers located anywhere in the World, including either inside or outside of the USA or the European Economic Area.

Links to other sites

We'd also like to remind visitors that we provide additional links to resources we think you'll find useful. These links will lead you to sites that are not affiliated with American and may operate under different privacy practices. Our visitors are responsible for reviewing the privacy policies for such other websites, as we have no control over information that is submitted to these companies.

Opt out of marketing communications and sharing your information with third parties for direct marketing purposes

American's websites do not honor web browsers' Do-Not-Track signals. You do have choices, however, when it comes to your privacy and internet browsing.

As noted above, some third parties collect information about users of our Services in order to provide interest-based advertising elsewhere, including across browsers and devices (also known as cross-device linking). Some of these companies provide online users with the ability to opt out of receiving interest-based advertising.

Due to differences between using apps and websites on mobile devices, you may need to take additional steps to disable targeted ad technologies in mobile apps. Many mobile devices allow you to opt out of targeted advertising for mobile apps using the settings within the mobile app or your mobile device. For more information, please check your mobile settings. You also may uninstall our apps using the standard uninstall process available on your mobile device or app marketplace.

To opt out of interest-based advertising across browsers and devices, please opt out through the Digital Advertising Alliance or Network Advertising Initiative website and also through the settings within the mobile app or your mobile device. Your opt-out choice may apply only to the browser or device you are using when you opt out, so you should opt out on each of your browsers and devices if you want to disable all cross-device linking for interest-based advertising. If you opt out, you will still receive ads but they may not be as relevant to you and your interests.

If you’re an AAdvantage member and you want to opt out of receiving marketing email, log in to your AAdvantage profile and update your preferences or contact AAdvantage Customer Service. Please note, you’ll continue to receive AAdvantage program updates and email products for which you’ve subscribed. If you’re a Business Extra member and you want to opt out of marketing emails, log in to the Business Extra website and update your preferences.

If you’re not an AAdvantage program member and you want to opt out of marketing emails, you can join the AAdvantage program and register your preferences or send an email with the word “unsubscribe” in the subject line to privacy@evaair.com from the address you wish to unsubscribe. In addition, marketing email from American will have valid opt-out links in the email. Please be aware that unsubscribing by email will unsubscribe all users at this address, even if they are registered AAdvantage members and Business Extra members with registered preferences.

If you want to opt out of receiving forms of communication from American other than marketing email, or if you want American to stop sharing your personal information with third parties for those parties' direct marketing purposes, please email privacy@evaair.com with your request. Regardless of your opt-out preferences, we reserve the right to send you certain communications and share your information with third parties for administrative and analytical purposes.

Other companies or programs of American affiliates may require different steps to change your preferences for participation. Please consult the privacy policies of the relevant companies or programs for further information.