Privacy policy

Privacy Policy

Last Updated: August 6, 2026

This Privacy Policy describes how Conquering the Sky / NOMOREFEAR ("we", "us", "our") collects, uses, and discloses your personal information when you visit, interact with, or make a purchase through our website at nomorefear.vip and related services (the "Services").

Who we are (Data Controller). The entity responsible for your personal information is Juan Melero, operating from Onda, Spain. You can reach us using the contact details in Section 17. Because we are established in Spain, our lead supervisory authority in the EU is the Spanish Data Protection Agency (Agencia Española de Protección de Datos, "AEPD").

By accessing or using the Services, you confirm that you have read and understood this Privacy Policy.

If any term in this Privacy Policy conflicts with our Terms of Service, this Privacy Policy governs with respect to the collection, use, and disclosure of your personal information.

1. Personal Information We Collect

"Personal information" means any information that identifies, relates to, describes, or can reasonably be linked to an individual. We may collect or process the following categories:

  • Contact Information — Name and email address.
  • Financial Information — Credit/debit card numbers, payment method details, and transaction information. Payment processing is handled by Shopify Payments and/or third-party payment processors. We do not store your full card details on our servers.
  • Account Information — Username, password, preferences, and settings.
  • Transactional Information — Digital products viewed, purchased, downloaded, or accessed.
  • Communications — Information you provide when contacting us, including customer service inquiries and support messages.
  • Device Information — IP address, browser type, device identifiers, operating system, and network information.
  • Usage Information — How you interact with our Services, including browsing behavior, pages visited, session activity, and interaction patterns.
  • Marketing & Advertising Engagement Data — Email open rates, click-through rates, subscription preferences, consent records, and advertising interaction data (e.g., ad views, ad clicks, and conversions) processed through our email platform (Klaviyo) and our advertising partners (Meta, Google, and Microsoft).

Sensitive information. Our Services provide educational content for people who feel anxious about flying. We do not ask for, and do not intentionally collect, health information, diagnoses, or other special-category / sensitive personal information. Please do not send us sensitive personal information through our forms or support channels. Our content is educational only and is not a substitute for professional psychological advice or treatment.

2. Sources of Personal Information

We may collect personal information from:

  • You directly, when you create an account, make a purchase, subscribe to our email list, fill out a form, or communicate with us.
  • Automatically, through cookies, tracking pixels, analytics tools, and your device interactions with the Services.
  • Service providers, including Shopify (e-commerce platform), Klaviyo (email marketing), and payment partners.
  • Advertising and analytics partners (e.g., Meta, Google, Microsoft), where legally permitted.

3. How We Use Your Personal Information

We may use your personal information for the following purposes:

a. To Provide and Improve Services — Processing payments, granting access to digital products, account management, preferences, recommendations, and improving your user experience.

b. Marketing and Advertising — Sending promotional emails and marketing communications through Klaviyo; showing personalized content; running and measuring advertising campaigns on platforms such as Meta (Facebook and Instagram), Google, and Microsoft; retargeting; and analytics.

Legal basis for marketing (EU/UK): We process your data for marketing purposes based on your explicit consent, collected through opt-in checkboxes on our sign-up forms and, for non-essential cookies, through our cookie consent banner. You may withdraw consent at any time (see Sections 4, 6, and 7).

For US state residents: You may opt out of targeted advertising and of the "sale" or "sharing" of personal information as described in Sections 6 and 12.

c. Security, Fraud Prevention & Safety — Detecting and preventing fraud, unauthorized activity, and security incidents; ensuring safe transactions and account protection.

d. Customer Support — Responding to inquiries, assisting with access to products, and maintaining our relationship with you.

e. Legal Compliance — Complying with applicable laws, responding to lawful requests, litigation, investigations, and enforcing our policies.

4. Cookies and Tracking Technologies

We use cookies, pixels, SDKs, and similar technologies to:

  • Remember your preferences
  • Analyze website traffic and usage patterns
  • Deliver personalized content and advertising
  • Track email engagement (opens, clicks) through Klaviyo
  • Measure advertising performance and conversions

Types of cookies and technologies we use:

  • Essential cookies — Required for the website to function (e.g., cart, checkout).
  • Analytics cookies — Help us understand how visitors interact with our site (e.g., Google Analytics / GA4).
  • Marketing & advertising cookies and pixels — Used to deliver relevant ads and measure campaign effectiveness, including the Meta Pixel and Meta Conversions API, Google Ads tags, Microsoft Advertising (UET) tag, and Klaviyo tracking.

Consent (EU / UK and other consent-based regions). Where required by law, non-essential cookies and advertising/analytics technologies are only activated after you give consent through our cookie consent banner, which appears on your first visit. We use consent signals (e.g., Google Consent Mode and equivalent controls for Meta and Microsoft) so that tags respect your choices. You can change or withdraw your cookie choices at any time via the cookie settings link on our website.

Browser and preference signals. You can manage cookie preferences through your browser settings. Where required by applicable law, we honor recognized opt-out preference signals, including the Global Privacy Control (GPC) and other universal opt-out mechanisms, and treat them as a valid request to opt out of targeted advertising and the sale/sharing of personal information for the browser or device from which they are received.

Disabling certain cookies may affect the functionality of the Services.

5. How We Disclose Personal Information

We may share personal information with third parties in the following circumstances:

a. With Shopify — Shopify hosts our store and processes personal information to operate the Services. Shopify may use de-identified or aggregated information to enhance its platform. Shopify's Consumer Privacy Policy is available at shopify.com/legal/privacy.

b. With Klaviyo (Email Marketing Platform) — We use Klaviyo to manage email subscriptions, send marketing communications, and analyze engagement. Klaviyo processes your email address, name, consent status, purchase history, and engagement data on our behalf as a data processor under the GDPR. Klaviyo is self-certified under the EU-US Data Privacy Framework (DPF) and incorporates Standard Contractual Clauses (SCCs) for international data transfers. Klaviyo's privacy policy is available at klaviyo.com/legal/privacy.

c. With Advertising Partners — To run and measure advertising and to show you personalized ads, we share certain data (such as device identifiers, online activity, and conversion events) with:

  • Meta Platforms (Facebook and Instagram advertising), via the Meta Pixel and Meta Conversions API. When the Meta Pixel collects and transmits data from our site, we and Meta act as joint controllers for that collection and transmission under the GDPR; Meta's subsequent use of the data is governed by Meta's own policies. See facebook.com/privacy/policy.
  • Google (Google Ads and Google Analytics). See policies.google.com/privacy.
  • Microsoft Advertising (Bing search advertising, via the UET tag). See privacy.microsoft.com. 

Depending on your jurisdiction, this sharing may be considered a "sale" or "sharing" of personal data, or "targeted advertising," which you have the right to opt out of (see Sections 6 and 12).

d. Other Service Providers — Including payment processors, hosting providers, analytics providers, IT and cloud services, and customer support tools, acting as processors on our behalf.

e. Business Transfers — In case of mergers, acquisitions, asset sales, reorganizations, or insolvency.

f. With Your Consent — When you explicitly authorize disclosure.

g. Legal Requirements — To comply with legal obligations, law enforcement requests, court orders, or to protect our legal rights and users' safety.

6. Advertising and Your Choices

We use advertising partners to reach people who may be interested in our educational resources and to measure how our ads perform. You can control advertising in the following ways:

  • Cookie banner / settings — Decline or withdraw consent for advertising cookies and pixels via our cookie settings (EU/UK and other consent-based regions).
  • Opt-out preference signals — Turn on the Global Privacy Control (GPC) in your browser; where required by law we will honor it automatically.
  • Do Not Sell or Share — Use the "Do Not Sell or Share My Personal Information" link on our website, or contact us (see Section 12).
  • Platform-level controls:
    • Meta ad preferences: within your Facebook/Instagram account settings.
    • Google ad settings: adssettings.google.com.
    • Microsoft ad settings: account.microsoft.com/privacy/ad-settings.
  • Industry tools — youradchoices.com (US), youronlinechoices.eu (EU), and optout.aboutads.info.

We do not use advertising that relies on sensitive personal information, and we do not knowingly target advertising to minors.

7. Email Marketing and Consent (Klaviyo)

How we collect consent. We collect explicit opt-in consent for email marketing through checkboxes on our sign-up forms, pop-ups, and checkout process. Consent checkboxes are never pre-checked.

What you consent to. When you opt in, you agree to receive marketing emails including promotional offers, product updates, educational content, and discount codes.

How to withdraw consent. You can unsubscribe at any time by:

  • Clicking the "Unsubscribe" link at the bottom of any marketing email
  • Contacting us using the details in Section 17

When you unsubscribe, we will stop sending marketing emails promptly. We may still send transactional emails related to your purchases (e.g., order confirmations, download links).

Consent records. We maintain records of when and how consent was given, including the form used, the date, the IP address, and the specific language displayed at the time of opt-in, as required by the GDPR.

8. Data Retention

We retain personal information only as long as necessary for providing access to purchased digital products, maintaining your account, fulfilling legal compliance obligations, and resolving disputes and enforcing agreements.

Data type Retention period
Purchase and transaction data 7 years (tax/legal compliance)
Email marketing data (Klaviyo) Until you unsubscribe + 30 days for processing
Website analytics data 26 months
Advertising engagement data Up to 24 months, or until you opt out
Customer support communications 3 years
Consent records Duration of relationship + 3 years

After the retention period, personal data is deleted or anonymized.

9. Security

We use reasonable administrative, technical, and physical safeguards to protect your personal information, including encryption of data in transit (SSL/TLS), secure payment processing through Shopify Payments, and access controls.

However, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

10. International Data Transfers

Your data may be transferred to and processed in countries outside your country of residence, including the United States.

For EU/EEA, UK, Swiss, and other affected residents, we rely on the following lawful transfer mechanisms:

  • EU-US Data Privacy Framework (DPF) — where a recipient (such as Klaviyo) is self-certified.
  • EU Standard Contractual Clauses (SCCs).
  • UK International Data Transfer Agreement (IDTA) / UK Addendum.
  • Adequacy decisions where applicable.

Where a transfer relies on the DPF and that framework's status changes, we will rely on SCCs or another valid mechanism to continue protecting your data.

11. Automated Decision-Making

We use automated tools for marketing personalization and audience segmentation (for example, deciding which educational emails or ads may be relevant to you based on your interests and engagement). These processes help us tailor content and advertising.

We do not use automated decision-making that produces legal effects concerning you or that similarly significantly affects you (such as decisions about credit, employment, insurance, or access to essential services). Where automated processing is used, it is limited to marketing and does not replace human judgement in any decision that materially affects your rights.

(This section also satisfies the automated decision-making transparency requirement under Australia's Privacy Act 1988 (Cth), effective 10 December 2026, and Article 22 of the GDPR.)

12. Your Rights and Choices by Region

Your privacy rights depend on your location. To exercise any right, contact us using the details in Section 17. We may require identity verification before fulfilling a request, and you may use an authorized agent where the law allows. We will not discriminate against you for exercising your rights.

All users — Right to access, delete, and correct your personal information; withdraw consent for marketing; and unsubscribe from emails at any time.

EU / EEA residents (GDPR) — In addition to the above: right to data portability; to restrict processing; to object to processing; to withdraw consent at any time without affecting prior lawful processing; and to lodge a complaint with your local Data Protection Authority (in Spain, the AEPD — aepd.es).

Legal bases (GDPR): Consent (marketing communications and non-essential cookies), contract performance (processing purchases and delivering digital products), legitimate interest (fraud prevention, security, and improving our Services), and legal obligation (tax and regulatory compliance).

UK residents (UK GDPR & Data Protection Act 2018) — The same rights as EU/EEA residents. You may lodge a complaint with the UK Information Commissioner's Office (ICO — ico.org.uk).

United States — state privacy rights — Depending on your state of residence (including California, Colorado, Connecticut, Texas, Virginia, and other states with comprehensive privacy laws now in effect), you may have the right to:

  • Know / access the personal information we collect, use, and disclose
  • Delete your personal information
  • Correct inaccurate personal information
  • Data portability
  • Opt out of the "sale" or "sharing" of personal information and of targeted advertising
  • Limit the use of sensitive personal information
  • Non-discrimination for exercising your rights
  • Appeal a decision on your request, where your state provides that right

Categories we may "sell" or "share" for targeted advertising: device identifiers, browsing/interaction activity, and advertising engagement data, shared with advertising partners such as Meta, Google, and Microsoft. To opt out, use the "Do Not Sell or Share My Personal Information" link on our website, enable the Global Privacy Control, or contact us. California residents may also complain to the California Privacy Protection Agency (CPPA) or the California Attorney General.

Australia residents (Privacy Act 1988 & Australian Privacy Principles) — To the extent the Privacy Act applies to us, you have the right to access and correct your personal information, to opt out of direct marketing, and to make a complaint. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC — oaic.gov.au). See also our automated decision-making disclosure in Section 11.

Canada residents (PIPEDA and provincial laws, including Quebec Law 25) — You have the right to access and correct your personal information and to withdraw consent, subject to legal and contractual limits. You may complain to the Office of the Privacy Commissioner of Canada (OPC — priv.gc.ca) or your provincial regulator (in Quebec, the CAI).

Other jurisdictions — If you reside elsewhere, you may have similar rights under your local data protection law. Contact us and we will handle your request in accordance with applicable law.

Response times. We aim to respond within one month (GDPR/UK GDPR, extendable where permitted), 45 days (US state laws, extendable to 90 days), or the period required by your local law. Opt-out-of-sale/share requests are processed within 15 business days.

13. Third-Party Websites and Services

Our Services may contain links to third-party websites not operated by us. We are not responsible for the privacy practices of such third-party platforms. We encourage you to review their privacy policies before providing personal information.

14. Children's Data

The Services are directed to adults and are not intended for children under 16 years of age (or the minimum age required in your jurisdiction, such as 13 in the US or 14 in Spain). We do not knowingly collect personal information from minors, and we do not knowingly target advertising to them.

If you believe a minor has provided information to us, please contact us and we will delete it promptly.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will update the "Last Updated" date at the top. For material changes, we will notify you by email (if we have your email address) or by posting a prominent notice on our website. Your continued use of the Services after any changes constitutes acceptance of the updated Privacy Policy.

16. Do Not Sell or Share My Personal Information

If you have the right to opt out of the "sale" or "sharing" of your personal information for cross-context behavioral / targeted advertising, you may:

  • Use the "Do Not Sell or Share My Personal Information" link on our website
  • Enable the Global Privacy Control (GPC) in your browser
  • Email us with the subject "Do Not Sell or Share My Information"

We will process your request within 15 business days.

17. Contact Us

If you have questions about this Privacy Policy, wish to exercise your rights, or want to file a complaint, you may contact us at:

📧 conqueringthesky@nomorefear.vip 

Conquering the Sky / NOMOREFEAR — nomorefear.vip