Privacy Policy

Last updated: June 2025  ·  Effective date: June 2025

This policy applies to users in India (governed by the Digital Personal Data Protection Act, 2023) and Canada (governed by PIPEDA). Where obligations differ by jurisdiction, both are addressed. If you have questions about how this affects you, contact us at privacy@cotrawell.com.

1. Introduction

Cotrawell Inc. ("Cotrawell", "we", "our", or "us") operates the peer-to-peer travel marketplace at cotrawell.com. This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and your rights over it.

By accessing or using the Cotrawell platform, you agree to the collection and use of information as described in this policy.

2. Data We Collect

We collect data in three ways: information you give us directly, information generated by your use of the platform, and information from third parties.

Category Examples Source
Account data Name, email address, phone number, profile photo, password (hashed) You (registration)
Identity verification Government-issued ID (where required for host verification) You (verification flow)
Travel data Trip details, routes, stopovers, seat availability, preferences You (trip listing/booking)
Payment data Transaction amounts, booking IDs; card/bank details handled by our payment processor You + Payment processor
Communications Chat messages between travellers and trip hosts on the platform You (in-app chat)
Usage data Pages visited, search queries, click events, session duration, device type Automatically (analytics)
Technical data IP address, browser type, OS, Cognito authentication tokens Automatically (system logs)
Support data Messages you send us when reporting issues or requesting help You (support)

3. How We Use Your Data

  • To create and manage your Cotrawell account
  • To facilitate trip listings, search, booking, and payments
  • To enable real-time communication between travellers and hosts
  • To send transaction emails, booking confirmations, and service notifications
  • To detect fraud, prevent abuse, and maintain platform safety
  • To analyse usage patterns and improve platform performance
  • To comply with legal obligations in India and Canada
  • To respond to disputes, complaints, or law enforcement requests

We do not sell your personal data to third parties. We do not use your data for automated decision-making that produces legal effects without human oversight.

5. Sharing Your Data

We share your data only in the following circumstances:

  • With other users: Your display name, profile photo, and trip details are visible to other users as part of the marketplace.
  • With service providers: AWS (cloud infrastructure), payment processors, and analytics providers under data processing agreements.
  • Legal compliance: Where required by law, court order, or government authority in India or Canada.
  • Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity.

All third-party service providers are contractually required to protect your data and use it only for the purpose for which it was shared.

6. Data Retention

We retain your personal data for as long as your account is active, or as long as necessary to provide services and comply with legal obligations. Specifically:

  • Account data: retained while your account exists and for 2 years after closure
  • Transaction records: retained for 7 years for financial and tax compliance
  • Chat messages: retained for 12 months after the related trip concludes
  • Usage and analytics data: retained for 13 months on a rolling basis

You may request deletion of your data at any time (see Your Rights below). Some data may be retained longer if required by law or for legitimate dispute resolution.

7. Your Rights

Depending on your jurisdiction, you have the following rights over your personal data:

  • Right to access
  • Right to correction
  • Right to erasure
  • Right to data portability
  • Right to withdraw consent
  • Right to nominate (DPDP)
  • Right to complain to a regulator

To exercise any of these rights, email privacy@cotrawell.com. We will respond within 30 days. Indian users may also approach the Data Protection Board of India. Canadian users may contact the Office of the Privacy Commissioner of Canada.

8. Cookies

We use cookies and similar tracking technologies. Our full Cookie Policy is available at cotrawell.com/cookie-policy. You can manage your cookie preferences at any time through your browser settings or our cookie consent banner.

9. Security

We implement industry-standard security measures including HTTPS/TLS encryption in transit, AWS Cognito for authentication, HttpOnly cookies for session tokens, and role-based access controls. However, no system is completely secure. Please notify us immediately at security@cotrawell.com if you believe your account has been compromised.

10. Children

Cotrawell is not intended for users under the age of 18. We do not knowingly collect personal data from minors. If we become aware that a minor has provided us with personal information, we will delete it promptly. If you believe a minor has registered on our platform, contact us at privacy@cotrawell.com.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes by email and by posting a prominent notice on the platform at least 14 days before changes take effect. Continued use of Cotrawell after the effective date constitutes acceptance of the updated policy.