Privacy policy

Information we collect

We collect the information needed to run your account, your company workspace, and the travel or spend features you use.

• Account details, including your email address and password. The password is stored as a hash. The browser keeps a session cookie and does not keep the password.
• Google sign-in, when you use it. Google provides the email address and account identifier for that sign-in. We do not receive your Google password. Google sign-in matches an existing Daro user. It does not create a new account.
• Profile details you or your company provide, such as name, phone number, date of birth, gender, nationality, job title, employee identifier, cost center, and department.
• Travel preferences, such as seat, meal, cabin, room, and accessibility, and an emergency contact name, relationship, phone, and email.
• Travel documents, such as a passport, driver licence, national identity card, or residence permit, including the document number, issuing country, and dates. The number is stored encrypted. You can see the full number. Other people see a masked number unless their role allows them to open it.
• Loyalty programme names and membership numbers. Membership numbers are stored encrypted.
• Sign-in records, including the session expiry, the IP address, and the browser user agent sent with the sign-in.
• Your role and the company workspace you belong to.

How we use information

• To create and protect your account, including a second sign-in check when your workspace requires one.
• To let your company manage people, travel policy, approvals, and spend.
• To search and book travel, and to show trips.
• To take payment and to issue or manage company cards.
• To send invitations, sign-in codes, and booking messages.
• To suggest a search filter or a room match from the in-product assistant, using information the app already has for your session. The assistant does not book travel on its own.
• To understand how the product is used and to fix errors, when analytics are turned on.

Travel bookings

Hotel, flight, and car bookings are placed through Daro. We collect the traveller and trip details the booking needs, such as names as they appear on a travel document, contact details, dates of birth, and document details for a flight. We share those details with the supplier that fulfils the booking.

A booking can name other people in the travel party, including a child. Those details are used for that booking. They are not a separate Daro account.

Your company can apply a travel policy and can require approval before a trip goes ahead. People with the right role in the company can see that activity. Car bookings are handled with Meili. Cruise reservations, where that service is used, are handled with Cruisebound and can include guest name, date of birth, citizenship, contact details, and address.

Payments and cards

Card payments for hotel, flight, and car checkout are processed by Stripe. We do not store the full card number or the security code. If you save a card for later personal bookings, we keep the brand, the last four digits, and the expiry so you can recognise it.

Company cards are issued with Pliant. We store the last four digits and the cardholder name. The full number and security code stay in a vault, and viewing them requires an extra verification. Receipt images can be stored for those transactions and, when receipt upload is in use, a copy can be sent to Pliant.

Who we share information with

We share personal data with the parties that provide the part of Daro you are using, and with your company for people in that workspace, according to their role.

• Travel suppliers, to search and to complete a hotel or flight booking.
• Meili, for car bookings.
• Cruisebound, for cruise reservations.
• Stripe, for card payments.
• Pliant, for company cards and receipt files.
• SendGrid, to deliver email.
• Google, for Google sign-in and for maps.
• TypeSafe, for the in-product assistant.
• PostHog, for product analytics.
• Userback, for the feedback widget.
• Amazon Web Services, which hosts the database and stored files.
• Sentry, for error monitoring on our API.

A person allowed to manage members can download a list of people in the company, including name, email, phone, role, and related workspace details. That export is for company administration.

Cookies and analytics

We use cookies and similar storage to keep you signed in, to remember preferences, and, when analytics are on, to understand how the product is used.

• Sign-in cookies keep your session. They cannot be read by scripts on the page. A session lasts 8 hours unless a different duration is set. A separate short-lived cookie is used only while Google sign-in is in progress.
• Preference cookies remember choices such as search currency and whether the sidebar is collapsed. These can last about a year.
• This browser can also store appearance, product-tour progress, and similar display choices on the device.

When analytics are on, PostHog receives your account id, email, name, role, account type, and company name after you sign in, and can record a session replay. Passwords and revealed card details are left out of that recording. On-screen text is masked. Text you type into other fields can still be included. Userback, when it is on, receives your account id, name, email, and company so we can read feedback you send. Google Maps loads on map screens when maps are in use.

How long we keep information

We keep account, booking, profile, document, and payment records while they are needed to provide Daro, to meet legal duties, and to resolve disputes. Some operational records are deleted on a shorter cycle.

• A sign-in session lasts 8 hours by default.
• An email sign-in code lasts 10 minutes.
• Car-rental searches and quotes are deleted 7 days after they expire, except records tied to a booking.
• Destination searches used for travel risk are removed after 30 days.
• Links to download a travel document or a receipt last 5 minutes.

Security

Passwords are stored as hashes. Session cookies cannot be read by page scripts and, in production, are sent only over HTTPS. Travel document numbers and loyalty membership numbers are encrypted. Card numbers for company-card charges are not held by Daro. Sensitive actions, such as revealing card details or changing a password, ask you to confirm it is you with an email code, an authenticator app, or a recovery code, depending on the action.

International transfers

Daro and its providers may process personal data in the United States and in other countries where they operate. Our application database and stored files are hosted on Amazon Web Services in US East (N. Virginia). Card issuing with Pliant can involve processing in the European Union. Analytics, email, payments, maps, and travel suppliers may process data in their own countries.

Your choices

You can update your profile, travel documents, and preferences in Daro. An administrator of your company workspace can update people in that workspace and can offboard a membership. You can sign out at any time, which ends the session in that browser.

If you use Daro through a company, contact an administrator of that workspace about access to your workspace data. They are the people who manage membership in the company account.

Children

Daro accounts are for people invited to a company workspace and, where offered, for personal accounts. A booking can still include a child as a passenger, because the supplier asks for the details of that traveller.

Changes to this policy

We will post any update on this page and change the date at the top.

Contact

For questions about this policy or about your data in a company workspace, contact an administrator of that workspace, or email support@nuitee.com.