Privacy Policy | Château Noir

Last updated 14 October 2026. Questions: legal@chateaunoirluxury.com.

Who is responsible
Accounts
Sessions and cookies
Inquiries, listings and contact forms
Air charter requests and quotes
Payments
Email
Page views
Where data is stored
How we use data
Sharing
Proof-of-ownership documents
Retention
Deleting your account
Your rights
Children
Changes

1. Who is responsible

Château Noir is operated from Texas, USA. This policy covers https://chateaunoirluxury.com and the emails it sends. Contact us about privacy at legal@chateaunoirluxury.com.

2. Accounts

When you create an account we store your name, email address, optional username, whether you joined to buy or to sell, the date you joined, the time you confirmed you are 18 or older, and the listings you save.

We never store your password. We store only a salted scrypt hash of it (a one-way scrambled value), so nobody, including us, can read your password. Password-reset links are single-use, expire after 24 hours, and are stored only as a hash.

3. Sessions and cookies

When you sign in we set two first-party cookies: cn_s, a random session token (HttpOnly, Secure, valid for 30 days, stored on our side only as a hash), and cn_in, which only tells the page you are signed in. Signing out, changing your password or deleting your account ends your sessions. We use no advertising, analytics or third-party tracking cookies.

4. Inquiries, listings and contact forms

When you send an inquiry, booking request or contact message we store your name, email, phone (if given), the listing and your message, and forward it to the listing party. When you submit a listing we store the listing details, photos, contact details, your attestation and any proof-of-ownership, insurance or licence documents you upload. We remove the IP address, browser user agent and referrer from our copy of each form submission.

5. Air charter requests and quotes

For charter requests we store your trip details (route, dates, times, passenger count, aircraft preference, pets, catering, luggage, ground transport), your phone, contact preference and notes, and the quote we prepare (operator, aircraft, prices, status and payments). We share trip details and your name with the operator named in your quote so it can confirm and operate the flight.

When you accept a quote we record your acknowledgment of the Part 295 disclosures: the time, the full name you typed, the disclosures shown, and a shortened one-way hash of your IP address (not the address itself), so we can show that you received the disclosures before paying.

6. Payments

Payments are processed by Stripe. Card details go directly to Stripe and never reach us. We receive the payment status, amount, currency, date, your email and Stripe reference numbers, and we keep a record of each payment and refund. Stripe’s own privacy policy applies to the data it processes.

7. Email

Account, inquiry, listing and charter emails are sent through our email provider, Resend, which processes the recipient address and message content to deliver them. We keep a copy of each transactional email we generate (the outbox) for up to 12 months. Every email includes an unsubscribe link; transactional messages you need, such as receipts and password resets, still reach you after you unsubscribe from other email.

8. Page views

We count page views per page and per day with our own counter. It sets no cookies and stores no IP address, device or user identifier. Our host keeps standard server logs for security.

9. Where data is stored

The site is hosted by Netlify. Accounts, sessions, form copies, charter requests and quotes, payment records, the email outbox, unsubscribe requests and page-view counts are stored in Netlify Blobs, Netlify’s data store. Uploaded files are stored by Netlify Forms. Data may be processed in the United States and other countries where these providers operate.

10. How we use data

To run your account; forward inquiries and booking requests; review, verify and publish listings; arrange charters and keep Part 295 records; take payments and issue refunds; send the emails described above; prevent fraud, spam and abuse (including rate limits keyed to one-way hashes of IP addresses and emails); and meet legal obligations. We do not sell personal information and do not share it for cross-context behavioural advertising.

11. Sharing

With the listing party you contact; with the charter operator named in your quote; with our service providers Netlify (hosting, storage, forms), Stripe (payments) and Resend (email); and where required by law or to protect users from fraud.

12. Proof-of-ownership documents

Proof-of-ownership, insurance and licence documents are used only to review the listing and are never published. They are deleted when we approve or reject the listing, and in any case no later than 90 days after upload, unless we must keep them to resolve a dispute or meet a legal obligation.

13. Retention

Accounts: until you delete them. Sessions: 30 days. Inquiry, listing and contact records: up to 24 months after the listing ends. Charter quotes, disclosure acknowledgments and payment records: as long as tax and transport law requires (normally 7 years). Email outbox: 12 months. Rate-limit counters: less than a day. Page-view counts: aggregate only.

14. Deleting your account

You can delete your account yourself on your account page by confirming your password, or by emailing legal@chateaunoirluxury.com from the address on your account. Deletion immediately removes your account, username, password hash, saved listings and sessions, and your inquiries, booking requests and charter requests. We keep only records the law requires, such as paid charter quotes with their disclosure acknowledgments and payment and refund records, and a hashed note that the deletion happened. Listing details already published can be removed on request.

15. Your rights

You can ask us to access, correct or delete your personal information, or to object to processing. Depending on where you live (for example the EU/UK under GDPR, or California under CCPA/CPRA) you may have additional rights, including complaining to a data-protection authority. We will not discriminate against you for using these rights.

16. Children

The site is only for people aged 18 or older. Every account holder confirms they are 18 or older, and we do not knowingly collect data from anyone under 18. If you believe a minor has given us data, contact us and we will delete it.

17. Changes

We will post any changes here and update the date above.