Privacy Policy

The registered business identified below operates ELARO and is the controller for the booking and support information it handles. Contact ELARO Support for privacy questions or requests.

We use your name, email, booking contact details, trip and flight information, passenger and luggage counts, vehicle preferences and relevant service requests to assess and coordinate your transfer. Optional LINE or WeChat details are contact information, not enrolment in automated messaging.

We also keep booking and operational history, support and incident information, payment and refund references, the offer and policy version you accepted, and necessary security and audit records. Source and campaign parameters supplied with a request are retained. Stripe collects card details through hosted Checkout; ELARO does not receive full card details from that flow.

Vercel hosts the application. Supabase provides the database and operations authentication. Stripe processes enabled payments and refunds. Resend delivers enabled customer emails, including the private status link and necessary trip information. Supabase Auth also sends operations account emails through its configured email service.

Our local transport partner and the assigned driver receive the operational information needed for the trip. Their existing manual dispatch communications may use LINE. Email and the private booking page are ELARO's customer communication paths. We do not claim an automated WhatsApp, LINE or WeChat service. Assignment photographs may load from the partner's HTTPS media host, which receives the browser request.

The HttpOnly elaro_current_booking cookie remembers your private booking route for up to 180 days; the underlying private link can expire separately. Operations users use Supabase authentication cookies configured for up to 400 days, subject to session expiry, refresh and sign-out. The operations password-recovery grant expires after 10 minutes. These support booking access, authentication and security.

This application does not add optional analytics or marketing cookies, advertising subscriptions or marketing consent. Google Sheets sync is not active. Accepting booking terms is not marketing consent. Your browser can remove cookies, which may remove remembered access or sign you out.

Booking records are private. A public ELA reference does not authorize access. Named operations accounts, role restrictions and private booking links limit access. We keep encrypted notification links and message payloads where needed for reliable delivery, alongside delivery and audit evidence.

Relevant information is available to our transport partner in Thailand and is processed by the providers used for hosting, payments and communication. We retain records for the booking, support, security, financial records and applicable obligations; these purposes do not imply a single fixed retention period.

Email ELARO Support to request access, correction, deletion or other applicable data rights. We may need to verify your authority and preserve records required for financial, legal or security purposes. Do not send passwords, card details or private capability links. We do not sell personal data.

If you open a partner booking link, the HttpOnly elaro_source_partner cookie remembers the original referring partner for up to 90 days on this browser. We retain that source with the booking separately from the driver who performs the trip. A separate signed HttpOnly elaro_booking_link cookie records the latest distribution link for up to 30 days on this browser. It can accompany a new booking so we can measure that link separately from the original referring partner. It grants no access to booking information. Clearing cookies removes the browser reminders, but does not change existing booking records.

Ratings and written feedback submitted through your private booking page are linked to that booking and its driver assignment. They are available to authorized ELARO administrators and are not automatically published or shared with partners.