Privacy Policy

First Class Journey LLC Effective Date: September 23, 2026

1. Who We Are

First Class Journey LLC is a limited liability company organized under the laws of the State of New Mexico, United States. Our registered and business address is 1209 Mountain Road Pl NE, Ste R, Albuquerque, NM 87110, United States. We operate the website at https://journeyfirstclass.com (the "Site"). We are a skincare brand preparing our first product collection. The Site is an informational brand landing page; no products are sold through it.

For the purposes of the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the UK General Data Protection Regulation as retained in UK law ("UK GDPR"), First Class Journey LLC is the data controller of personal information collected through the Site.

2. Scope

This Privacy Policy applies to personal information collected through the Site when you visit it, read its content, or submit an enquiry through the contact form. It does not apply to information you provide to third parties, even if you reach them through a link on our Site. Because no products are sold through the Site, this policy covers no payment data, no account data, and no purchase history.

3. Information We Collect

3a. Contact Form Data

When you submit the contact form on our Site, we collect the following:

• First and last name
• Email address
• Phone number (optional, if you choose to provide it)
• Enquiry type, selected from: launch list, routine question, or gifting/press/partnership
• Your message
• A record of whether you checked the required privacy-policy acknowledgement checkbox
• A record of whether you checked the separate, optional checkbox to receive launch and product news by email

The form also includes a hidden anti-spam honeypot field that is not visible to human visitors and is not used to collect any personal information. Its sole purpose is to detect and discard automated spam submissions.

Submitted form data is transmitted by email through the Site's own mail server to support@journeyfirstclass.com and is stored in that mailbox. We do not use a third-party form service, a customer relationship management (CRM) system, or a newsletter platform at launch.

3b. Technical Server Logs

Our hosting server automatically records the following information each time a browser requests a resource from the Site:

• IP address of the requesting device
• User-agent string (browser type and version, operating system)
• Date and timestamp of the request
• URL of the requested resource

These logs are retained for security purposes for up to 30 days and are then deleted. They are not used to build visitor profiles or for marketing.

3c. Browser Storage

The Site does not set any cookies. It uses two localStorage entries in your browser:

• fcj-lang: stores your chosen display language (English or Spanish). This is a preference entry.
• fcj-consent: stores your consent choices made in the consent banner. This is a strictly necessary entry required to honour your choices.

No analytics, advertising pixels, social media embeds, or third-party tracking scripts are loaded on the Site at launch. Third-party fonts are not loaded at runtime; all fonts are self-hosted on our server. A more detailed description of browser storage appears in Section 7 below and in our Cookie Policy.

4. How We Use Your Information and Legal Bases Under GDPR / UK GDPR

4a. Responding to Enquiries

We use the name, email address, optional phone number, enquiry type, and message that you submit to read, assess, and respond to your enquiry. The legal basis is Article 6(1)(b) GDPR / UK GDPR: processing is necessary to take steps at your request prior to entering into a contract, or to perform a contract. Where you submit a general question or interest not tied to a contractual relationship, we rely on Article 6(1)(f): our legitimate interest in communicating with prospective customers and in operating our business responsibly, balanced against your interest in receiving a response you have actively requested.

4b. Launch and Product News Emails

If you check the separate, optional opt-in checkbox on the contact form, we will use your email address to send you launch announcements and product news by email. The legal basis is Article 6(1)(a) GDPR / UK GDPR: your freely given, specific, informed, and unambiguous consent. You may withdraw this consent at any time by emailing support@journeyfirstclass.com; withdrawal does not affect the lawfulness of processing before withdrawal.

We do not send marketing emails on the basis of legitimate interests. We only send them where you have given separate, specific opt-in consent as described above.

4c. Security and Anti-Spam

We use server logs (IP address, user agent, timestamps, URLs) and the honeypot mechanism to detect and mitigate security threats, abuse, and spam. The legal basis is Article 6(1)(f): our legitimate interest in protecting the integrity and security of the Site and our communications infrastructure.

4d. Legal Compliance

We may process and retain personal information where we are required to do so under applicable law or to respond to a lawful request from a competent authority. The legal basis is Article 6(1)(c): processing is necessary for compliance with a legal obligation.

4e. No Automated Decision-Making

We do not use your personal information for automated decision-making or profiling that produces legal or similarly significant effects.

5. Marketing Emails - Opt-In Requirement

We only send launch announcements and product news by email to individuals who have affirmatively checked the separate, clearly labelled optional checkbox on the contact form before submitting it. That checkbox is unchecked by default. Checking the required privacy-policy acknowledgement checkbox does not constitute consent to receive marketing emails; the two checkboxes are separate.

If you did not check the marketing opt-in checkbox when you submitted the form, you will not receive marketing emails from us on the basis of that submission. If you change your mind and wish to receive such emails, you may contact us at support@journeyfirstclass.com to provide your consent.

To stop receiving marketing emails, email support@journeyfirstclass.com at any time. We will process your withdrawal promptly.

6. Service Providers and Disclosures

6a. Hosting and Email Provider

Our web agency operates a dedicated server on our behalf. That server is located in Germany, European Union, and hosts both the Site and the support@journeyfirstclass.com mailbox. Our web agency processes personal information stored on that server only on our instructions and does not use it for its own purposes.

6b. No Other Third-Party Data Processors at Launch

At launch, we do not use any third-party analytics service, advertising network, social media platform, CRM, newsletter platform, or payment processor in connection with the Site.

6c. Other Disclosures

We may disclose personal information in the following circumstances:

• To comply with a court order, subpoena, or other lawful legal process
• To respond to a verified request from a law enforcement or regulatory authority
• To protect the rights, property, or safety of First Class Journey LLC, our users, or the public where required or permitted by law
• In connection with a merger, acquisition, reorganization, or sale of assets, where the receiving party is bound to treat the information in accordance with this policy or to notify you of any material change before the information is used differently

We do not sell, rent, trade, or otherwise disclose personal information for monetary or other valuable consideration to any third party.

7. Browser Storage and Cookies

The Site does not place any cookies on your device. The only client-side storage the Site uses is two localStorage entries: fcj-lang (preference, stores your language choice) and fcj-consent (strictly necessary, stores your consent selections). Neither entry is used for advertising, analytics, or cross-site tracking.

When you first visit the Site, a consent banner invites you to Accept, Reject non-essential storage, or Manage preferences. The preference categories in the banner are Necessary, Preferences, Analytics, and Marketing. The Analytics and Marketing categories are currently inactive; no scripts or tools in those categories are loaded. If we introduce analytics or marketing tools in the future, we will update this policy before doing so, and those tools will only be activated after you have given opt-in consent.

A "Cookie preferences" link in the Site footer allows you to reopen the consent banner and change your choices at any time.

For a complete technical description of browser storage, please see our Cookie Policy.

8. International Transfers

First Class Journey LLC is based in the United States. Our server is located in Germany, which is within the European Economic Area (EEA); personal information you submit through the Site is stored on that server and therefore remains within the EEA at rest.

However, because we are a US-based company, our access to and use of that data constitutes a transfer of personal information from the EEA and the United Kingdom to the United States. To ensure adequate safeguards for such transfers, we rely on the following mechanisms:

• Standard Contractual Clauses (SCCs) approved by the European Commission, incorporated into our agreement with our web agency and, where applicable, into arrangements governing our own access to EEA-hosted data as a US-based controller
• For transfers from the United Kingdom, the International Data Transfer Agreement (IDTA) issued by the UK Information Commissioner's Office, or the UK Addendum to the EU SCCs, as appropriate

You may request a copy of the relevant transfer safeguards by contacting us at support@journeyfirstclass.com.

9. Retention

We retain personal information only for as long as necessary for the purposes described in this policy:

• Enquiry correspondence: retained for up to 24 months after the date of last contact between us and the enquirer, then deleted from the mailbox.
• Launch-list opt-ins: retained until you withdraw your consent (unsubscribe) or until we close the launch list, whichever is earlier, then deleted.
• Server logs: retained for up to 30 days for security purposes, then deleted automatically.
• Browser localStorage entries: stored in your browser until you clear your browser storage or withdraw and change consent settings; they are not stored on our server.

When we delete personal information, we do so by removing it from the relevant mailbox and any accessible backups within the applicable retention period.

10. Security

We take reasonable and appropriate technical and organisational measures to protect personal information against unauthorised access, loss, alteration, disclosure, or destruction. Specific measures include:

• Hosting on a dedicated server (not shared hosting) operated in a European data centre
• Access controls limiting mailbox access to authorised personnel
• Encrypted transmission of form submissions over HTTPS
• Server log retention limited to 30 days
• Honeypot anti-spam controls on the contact form
• No unnecessary collection of sensitive or payment data

No method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee absolute security, but we are committed to notifying affected individuals and relevant supervisory authorities in the event of a personal data breach as required by applicable law.

11. Your Rights Under GDPR / UK GDPR

If you are located in the European Economic Area or the United Kingdom, you have the following rights with respect to your personal information:

• Right of access: you may request confirmation of whether we process your personal information and a copy of it.
• Right to rectification: you may ask us to correct inaccurate or complete incomplete personal information.
• Right to erasure: you may ask us to delete your personal information where it is no longer necessary, where you withdraw consent, or where processing is unlawful.
• Right to restriction: you may ask us to restrict processing in certain circumstances, for example while you contest accuracy.
• Right to data portability: where processing is based on consent or contract and carried out by automated means, you may ask us to provide your data in a structured, commonly used, machine-readable format.
• Right to object: you may object to processing based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Right not to be subject to solely automated decisions: we do not carry out such processing, but you have the right to request human review if we ever do.

To exercise any of these rights, contact us at support@journeyfirstclass.com. We will respond within one month of receiving a valid request, or notify you if we need an extension. We may need to verify your identity before processing a request.

You also have the right to lodge a complaint with a supervisory authority. In the EU, this is the data protection authority of your EU member state of habitual residence. In the United Kingdom, this is the Information Commissioner's Office (ICO), which can be reached at https://ico.org.uk.

12. Your Rights Under US State Privacy Laws

12a. Applicability

This section applies to residents of US states that have enacted comprehensive consumer privacy laws, including California (CCPA as amended by CPRA), and other states with similar enacted privacy frameworks. We provide the rights described below to all US residents who submit requests to us, regardless of state, to the extent required by applicable law.

12b. Categories of Personal Information We Collect

We collect identifiers (name, email address, IP address), optional contact information (phone number), and the content of messages you send us. We do not collect sensitive personal information as defined under CCPA/CPRA beyond what is described in this policy. We do not collect data from children under 16.

12c. Right to Know

You have the right to request that we disclose:

• The categories of personal information we have collected about you
• The categories of sources from which we collected it
• The business or commercial purposes for collecting it
• The categories of third parties with whom we share it
• The specific pieces of personal information we have collected about you

12d. Right to Delete

You have the right to request that we delete personal information we have collected from you, subject to certain exceptions permitted by law (for example, completing a transaction you requested, security purposes, or complying with a legal obligation).

12e. Right to Correct

You have the right to request that we correct inaccurate personal information that we maintain about you.

12f. Right to Opt Out of Sale or Sharing

We do not sell personal information for monetary or other valuable consideration. We do not share personal information for cross-context behavioral advertising. Because we do not sell or share personal information in those ways, there is nothing to opt out of, but we honor this right and will confirm our practices upon request.

12g. Non-Discrimination

We will not discriminate against you for exercising any privacy rights. We will not deny you goods or services, charge you different prices, provide you a different level of service, or suggest you will receive different treatment because you exercised a privacy right.

12h. Authorized Agents

You may designate an authorized agent to submit a rights request on your behalf. We will require the authorized agent to provide written proof of authorization and may require you to verify your own identity directly with us before we fulfill the request.

12i. Appeals

If we deny your rights request, in whole or in part, you may appeal by sending us a written explanation of the basis for your appeal to support@journeyfirstclass.com. We will respond to appeals within the timeframe required by applicable state law. If your appeal is denied, you may contact the relevant state attorney general or data protection authority.

12j. Submitting a Request

To submit any US state privacy rights request, email support@journeyfirstclass.com with the subject line "Privacy Rights Request" and include sufficient information for us to identify your records (such as the name and email address you used when contacting us). We will respond within 45 days; we may extend this period by an additional 45 days where reasonably necessary and will notify you within the first 45-day period if an extension is needed.

13. Do Not Track / Global Privacy Control

Some browsers transmit a "Do Not Track" (DNT) signal to websites. Because the Site does not use cookies or tracking technologies at launch, there is currently no tracking to disable. We treat DNT signals consistently with that approach.

The Site is designed to respect the Global Privacy Control (GPC) signal. Where we detect a GPC signal from your browser, we treat it as a request to opt out of any sale or sharing of your personal information. Because we do not sell or share personal information, this has no additional operational effect, but we record and honor the signal in accordance with applicable law.

14. Children

The Site is not directed at children under the age of 16. We do not knowingly collect personal information from anyone under 16. If we become aware that we have collected personal information from a child under 16 without verifiable parental consent, we will delete it promptly. If you believe we may have received information from a child under 16, please contact us at support@journeyfirstclass.com.

15. Sensitive Information

Our products are cosmetics intended for topical use by adults. The Site does not request or require any health or medical information.

Please do not include sensitive health information, medical history, diagnoses, prescriptions, or descriptions of skin conditions, diseases, or reactions in any message you send us through the contact form or by email. We are not equipped to receive, process, or respond to such information. If you have questions about a skin condition, an allergic reaction, a medical diagnosis, or the suitability of any cosmetic product for your specific health circumstances, please consult a qualified healthcare professional.

Nothing on the Site or in any communication from us constitutes medical advice, and our products are not intended to diagnose, treat, cure, or prevent any disease.

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Site, or applicable law. When we make material changes, we will update the effective date at the top of this policy and post the revised version at https://journeyfirstclass.com. If we intend to process personal information in a materially different way from the manner described at the time it was collected, we will provide notice and, where required by law, obtain fresh consent before doing so.

We will not add analytics or marketing tools to the Site without first updating this policy and obtaining your opt-in consent for those tools.

We encourage you to review this policy periodically. Continued use of the Site after any update constitutes acknowledgement of the revised policy.

17. Contact

For questions about this Privacy Policy, to exercise any of the rights described above, or to raise an accessibility concern regarding our legal pages, please contact us:

First Class Journey LLC 1209 Mountain Road Pl NE, Ste R Albuquerque, NM 87110 United States

Email: support@journeyfirstclass.com

We aim to respond to all privacy and accessibility inquiries within 10 business days.

First Class Journey LLC - Privacy Policy - Effective September 23, 2026