This Privacy Policy explains how Ecoway Conservation ("Ecoway", "we", "our", or "us") collects, uses, stores, and protects your personal information when you use our website, eco-trip booking services, and related platforms (the "Services").
1. Information We Collect
- Account information — your name, email address, phone number, password (stored hashed), and profile photo.
- Booking information — tour selection, booking date, number of participants, participant ID details (where required by the operator), special requests, and contact details.
- Payment information — bank transfer proofs you upload. We do not collect or store full bank account numbers or card details on your behalf; verification is done by reviewing the proof you submit.
- Authentication data — if you sign in with Google, we receive your basic profile (name, email, avatar) from Google.
- Technical data — IP address, device and browser type, and activity logs used for security and rate limiting.
2. How We Use Your Information
- To create and manage your account;
- To process bookings, issue invoices, and verify payments;
- To send transactional emails (verification, invoices, payment confirmations, booking updates);
- To respond to your inquiries and provide customer support;
- To prevent fraud and abuse, and to comply with legal obligations;
- To improve our Services and customer experience.
3. Sharing of Information
We do not sell your personal information. We may share limited information only when necessary:
- With our authorized admin team to verify payments and confirm bookings;
- With tour operators and partner guides to deliver your booked experience (e.g., participant names, special requests);
- With service providers that help us operate the Services (email delivery, file storage, OAuth authentication), bound by confidentiality obligations;
- When required by law, regulation, or a valid legal request.
4. Data Storage & Security
Personal data is stored on secured servers, with passwords hashed using bcrypt and uploaded files held in access-controlled storage. We use TLS for data in transit and apply rate limiting and CAPTCHA protection on sensitive endpoints. While we use commercially reasonable safeguards, no online system is fully secure.
5. Data Retention
We retain your account and booking records for as long as your account is active and as needed to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements. You may request deletion of your account at any time (subject to records we are required to keep for accounting or regulatory purposes).
6. Your Rights
You may, subject to applicable law, request to:
- Access the personal data we hold about you;
- Correct inaccurate or outdated information;
- Delete your account and associated data;
- Withdraw consent for non-essential communications.
To exercise these rights, contact us via the channels on the About page.
7. Cookies & Sessions
We use essential cookies to keep you signed in and to remember your cart between visits. We do not use third-party advertising cookies. You can clear cookies in your browser at any time, but doing so may sign you out and reset your cart.
8. Children's Privacy
The Services are not directed to children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can remove it.
9. Changes to This Policy
We may update this Privacy Policy from time to time. The updated version will be posted on this page with a new "Last updated" date. Material changes will be notified through the Services or via email when appropriate.
10. Contact
For questions, requests, or concerns about your data, please contact us through the channels listed on our About page.