Privacy Policy
Last updated: 3 October 2026
1. Who is responsible for your information
Tripora is operated by Usman Feroz trading as Tripora, 15 Newmarket Street, Colne, BB8 9BJ, United Kingdom. Contact hello@tripora.tech for privacy enquiries or to exercise your rights.
We are the controller for our own business enquiries, operator account administration, billing, support and service security. Where an operator uses Tripora to manage passengers, drivers and journeys, that operator generally controls those records and Tripora processes them on its instructions. Contact the operator shown on your booking first about its use of your information. We can help route a request if you cannot identify the operator.
2. Information handled by Tripora
- Enquiries and support: name, business, contact details, fleet size and messages you send us.
- Operator accounts and billing: business details, account email, billing identifiers, subscription and invoice records, service settings and integration credentials.
- Bookings and customer accounts: passenger name, email and phone, pickup and destination addresses, journey dates, flight details, vehicle choice, passenger and luggage counts, fares, payment status, booking notes and change requests.
- Driver records: identity and contact details, availability, assigned jobs, responses and progress; compliance documents and expiry information where uploaded by an operator.
- Security and service records: login/session identifiers, hashed passwords or sign-in codes, booking events, notification delivery records and technical information such as IP addresses and request logs.
Information comes from you, your operator or authorised users, and connected services. Please avoid adding unrelated sensitive information to booking notes or messages. We do not need your full card details: payment checkout is handled by Stripe.
3. Why we use information
For our controller activities, we use information to answer enquiries and provide an agreed service (contract or steps requested before a contract); manage business contacts, support and protect accounts against misuse (legitimate interests in running and securing the service); and maintain records required by tax or other law (legal obligation). For contacts acting for a company, business communication and account administration generally rely on legitimate interests rather than a contract with that individual. You can object to processing based on legitimate interests.
Where we rely on consent for optional communications or processing, you can withdraw it at any time without affecting earlier lawful processing. Journey notifications are service communications, not permission to send unrelated marketing. For operator-controlled booking and driver data, the operator decides the purposes and lawful basis; its privacy notice should explain them.
If you do not provide information essential to an account, enquiry or booking, the relevant service may not be available. AI output is reviewed by the operator: the booking import feature does not itself make a final booking or a decision with legal or similarly significant effects.
4. Who receives information
Access is limited to people who need the information for the relevant task, including authorised operator users, assigned drivers, Tripora support and service providers. An assigned driver receives journey and passenger contact details needed for the job. We may disclose records when legally required or necessary to establish or defend legal claims.
Providers supported by the service include Hostinger for hosting; Stripe for payments and subscriptions; Google Maps for address lookup and journey calculations; Resend for email; Twilio for configured SMS delivery; and OpenAI for optional AI Booking Import. Features and recipients depend on the operator's configuration. Opening or sending a WhatsApp message also involves WhatsApp/Meta. These external services have their own privacy information and may act as processors or independent controllers depending on their role.
For AI Booking Import, the pasted text is submitted to OpenAI to extract booking details. Do not submit a whole conversation when a short relevant message is enough. Request current provider and processing details from hello@tripora.tech before enabling the feature for sensitive information.
5. Where processing takes place
The service uses hosting and external providers whose processing locations depend on the account and feature. Some provider processing may take place outside the UK. Do not assume every record remains in the UK. Where a restricted international transfer is involved, an applicable UK adequacy decision, appropriate contractual safeguards or another lawful mechanism is required. Contact hello@tripora.tech for the current processing locations and details or copies of safeguards relevant to your service.
6. How long information is kept
We determine retention by the purpose of the record, the active business relationship, relevant tax and accounting requirements, security needs, and the time needed to resolve complaints or legal claims. Account information is needed while the service is provided; enquiry and support records are kept while follow-up or an unresolved issue requires them. Financial records may be kept after an account closes where required by law.
Operators determine the retention of their passenger, driver and booking records and instruct us through the applicable processing agreement. Closing an account does not mean every record disappears immediately. Data return, deletion and any remaining backups must be addressed as part of account closure; legally required records may be retained. Email us for the retention criteria applicable to your records or to request deletion. Short-lived sign-in codes and quote tokens expire, but expiry alone is not a promise that every underlying log record is immediately erased.
7. Security
The application uses measures including secure connections, password hashing, access controls and role-specific sessions. Operators must also protect their devices, credentials and API keys, control user access and report suspected breaches. No online system can promise absolute security. Email hello@tripora.tech if you suspect unauthorised access to Tripora.
8. Cookies and device storage
Tripora uses authentication cookies to keep requested accounts signed in. These support account access and security. Blocking them can prevent sign-in or account features from working.
| Cookie | Purpose | Maximum browser lifetime |
|---|---|---|
| tripora_session | Operator sign-in | 7 days |
| tripora_customer | Customer sign-in | 7 or 30 days, depending on sign-in method |
| tripora_driver | Driver sign-in | 7 days |
| tripora_platform | Platform owner sign-in | 12 hours |
Signing out clears the relevant login cookie. The driver interface can also remember the navigation provider you choose in local storage on your device until you clear it. We do not add advertising trackers through this update. External services such as Google Maps and Stripe may handle technical information under their own notices. Where consent is required for additional storage or tracking, it must be obtained before that technology is used. Your browser can clear cookies and local storage.
9. Your rights and complaints
Depending on the circumstances, you can request access, correction, deletion, restriction or portability of personal information; object to processing, including direct marketing; and withdraw consent where used. These rights are subject to legal conditions. We may need to verify your identity before disclosing records. Contact hello@tripora.tech; for records controlled by a transport operator, direct your request to that operator. We will assist it where appropriate.
You can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or telephone 0303 123 1113. You do not have to contact us first, although we welcome the opportunity to resolve your concern.
10. Updates
We will update this notice when relevant practices change and draw significant changes to affected users' attention where appropriate. The date above identifies this version. An operator's own privacy notice remains relevant to its transport services.