Privacy Policy

Effective October 15, 2026

This Privacy Policy explains how Coral Travel Incorporated, a Delaware corporation ("Coral," "we," "us"), collects, uses, and shares personal information when you use coraltravel.io, our applications, APIs, supplier bid links, client review links, rooming-list links, and related services (the "Service"). It also covers our website visitors and people we contact about the Service.

Two roles. For account, billing, usage, website, and marketing information, Coral is the controller (or "business"). For data our customers enter into their workspaces — hotel contacts, client details, guest names on rooming lists, message content — the customer is the controller and Coral processes it on the customer's instructions under our Terms of Service and any data processing agreement. If you are a hotel contact, a traveler, or a client whose information was entered by a Coral customer, that customer is responsible for that data; contact them first, and we will assist.

Information we collect

Information you give us

Account and profile: name, work email, phone, employer or agency, title, branch and office IDs, IATA or other accreditation numbers, default commission rate, currency, email signature, and login credentials.
Organization and team: company name, address, billing contact, team members, roles, and permissions set by an administrator.
Customer Data you enter: projects, trips, venues, dates, room blocks, budgets, customer codes and names, hotel and supplier contacts (names, titles, business emails, phones, brands, properties, notes), email templates, questionnaires, bids, bookings, confirmation codes, invoices, remarks, and rooming lists (which may include guest names, room assignments, and special requests).
Communications: messages you send and receive through the Service, attachments, support requests, feedback, and survey answers.
Payment information: billing name and address and the last four digits and expiry of your card. Full card numbers go directly to our payment processor; we never store them.

Information from connected accounts

When you connect Microsoft 365, Google Workspace, or another email or calendar account, we receive your account identifier, OAuth tokens, and, with your permission, the ability to send email as you, read replies to messages the Service sent and their threads, access contacts for auto-suggest, and read or create calendar events for trips. See Section 5.

When you connect a back-office system such as AdvisorOS, we receive booking, room-type, customer-code, and invoice data from it.

Information from hotels, clients, and other users

Bid submissions through supplier links: rates, fees, policies, questionnaire answers, submitter name and title, and attachments.

Client submissions through review and rooming-list links: ratings, notes, comments, and edited guest details.

Contacts and templates shared with you by your organization.

Information we collect automatically

Usage: pages and features used, searches, filters, clicks, emails sent, open and reply events, timestamps, and session recordings or replay for troubleshooting.
Device and connection: IP address, browser, operating system, device identifiers, language, approximate location derived from IP, and crash and performance logs.
Cookies and similar technologies: see Section 6.

Information from third parties

Hotel and supplier data from providers such as Google (hotel listings, photos, ratings, reviews, distances), GIATA, Vervotech, and public sources.

Contact enrichment and verification data from providers such as Apollo, LinkedIn Sales Navigator, Hunter, and NeverBounce, used to maintain the accuracy of business contact records.

Analytics, advertising, and fraud-prevention partners, and public records.

How we use information

We use personal information to:

Provide, operate, secure, and maintain the Service, including sending bid requests, follow-ups, reminders, invoices, and links on your instructions.
Create and manage accounts, teams, roles, and permissions; authenticate users; and verify identity.
Process payments, invoices, fees, and commissions, and prevent fraud and non-payment.

Power Coral AI features, including drafting messages and replies, summarizing and comparing bids, generating estimates, and answering questions about your projects. AI processing may involve third-party AI providers bound by confidentiality. We do not use Customer Data to train generally available AI models without your consent; we may use it to evaluate and improve the Service's own features.

Maintain, verify, deduplicate, and improve Coral's supplier and contact database (see Section 3).

Produce de-identified and aggregated statistics, such as group-rate benchmarks by market and season, supplier response times, commission capture rates, and savings versus published rates, for product improvement, research, benchmarking, and marketing.

Provide support, respond to requests, and send transactional notices about your account, bookings, invoices, security, and changes to terms.
Send product updates, onboarding guidance, newsletters, event invitations, and marketing, where permitted. You can opt out at any time.
Analyze usage, troubleshoot, test features, and develop new products and services.
Detect, investigate, and prevent abuse, spam, security incidents, and violations of our Terms.

Comply with law, respond to legal requests, enforce our agreements, and protect the rights, property, and safety of Coral, our users, and others.

Carry out a merger, acquisition, financing, or sale of assets.
Any other purpose disclosed to you at the time of collection or with your consent.

Hotel contacts and the Coral supplier database

Coral maintains a database of hotel properties and the business contact details of hotel sales, group, and revenue staff (name, title, property or brand, work email, work phone). We build it from public sources, hotel and brand websites, contact-enrichment providers, bid responses submitted through the Service, and contacts our customers add and mark as team or global.

This is business contact information processed for legitimate business-to-business communication about group accommodations. We do not collect sensitive personal information about hotel contacts.

Contacts a customer marks private are visible only to that customer's organization. Contacts marked team are visible within the organization. Contacts marked global or contributed to the Coral database may be made available to other Coral customers.

We may verify, enrich, deduplicate, and update contact records using third-party providers and bid-response data, and may flag records as stale.

If you are a hotel contact and do not want to receive bid requests through Coral, email hi@coraltravel.io or use the opt-out link in any message. We will suppress your address across the Service, although individual customers may still have your details in their own records.

How we share information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share it as follows:

Hotels and suppliers: when you send a bid request, follow-up, booking confirmation, rooming list, or invoice, the recipient receives your name, organization, email, and the content you send, including trip, group, room-block, and guest details.
Clients and travelers: when you share a review link or rooming list, the recipient sees the options, bids, notes, and guest details the link exposes. Hotels may see other hotels' bids in anonymized form where that feature is enabled.
Your organization: administrators and, depending on permissions, other members of your organization can see projects, contacts, messages, bookings, and activity in the workspace.
Other Coral customers: contact records designated as global or contributed to the Coral database, and de-identified aggregate benchmarks.

Service providers and processors who act on our instructions, including cloud hosting and databases (such as Supabase and its infrastructure providers), application platforms, email delivery and connected-email providers (Microsoft, Google), AI model providers, payment processors (such as Stripe), back-office integrations (such as AdvisorOS), hotel-data providers, contact-enrichment and verification providers, analytics, session-replay, observability (such as Datadog), customer support, issue tracking, and document tools.

Development partners engaged to build, operate, and support the Service under confidentiality obligations.
Affiliates under common control, for the purposes in this Policy.
Legal and safety: to comply with law, subpoenas, or government requests; to enforce our Terms; to investigate fraud, abuse, or security issues; or to protect the rights, property, or safety of Coral, our users, or the public.
Business transfers: in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our business, personal information may be transferred to the successor, subject to this Policy.
With your direction or consent, including when you connect a third-party service.
We may share de-identified or aggregated information with anyone for any purpose.

Connected email and calendar accounts

Connecting your Microsoft 365, Google Workspace, or other account is optional and controlled by you. When connected, Coral:

Sends outreach, follow-ups, confirmations, and invoices from your own address so replies reach your inbox and thread normally.

Reads and stores replies and threads related to messages the Service sent, so bids, questions, and updates appear in your Coral inbox and can be summarized by Coral AI.

Reads contacts to power auto-suggest in recipient fields.
Reads and writes calendar events for trips, where you enable it.

We do not read, store, or analyze email unrelated to messages sent through the Service. We do not use connected-account data for advertising. You can disconnect at any time in Settings or through your provider's account permissions; we then stop syncing and delete stored tokens, although previously synced messages remain in your workspace until you delete them.

Google API Services User Data Policy. Coral's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Coral's use of information received from Microsoft APIs adheres to the Microsoft APIs Terms of Use.

Cookies and tracking

We and our providers use cookies, local storage, pixels, and SDKs to keep you signed in, remember preferences, measure usage, replay sessions for troubleshooting, detect fraud, and, on our marketing site, measure campaigns. Categories:

Strictly necessary (authentication, security, load balancing) — always on.
Functional (preferences, saved filters, collapsed panels).
Analytics and performance (usage measurement, session replay, error monitoring).
Marketing (campaign attribution on the public website only).

You can control cookies through your browser and, where offered, our cookie banner. Blocking necessary cookies will break the Service. We do not respond to browser "Do Not Track" signals, but we honor Global Privacy Control signals as an opt-out of sale or sharing where required by law. Email messages sent through the Service may include open and link tracking so you can see supplier engagement; recipients can disable image loading to limit this.

Retention

We keep personal information as long as needed for the purposes in this Policy, which generally means:

Account and workspace data: for the life of the account plus 30 days for export, then deletion from active systems, with backups purged on a rolling basis (typically within 90 days).
Bookings, invoices, commission records, and billing data: at least 7 years to meet tax, accounting, and audit obligations.
Messages and bid records: for the life of the related project, or longer where the customer retains them.
Supplier and contact database records: until the contact opts out, the record is determined stale, or the business purpose ends.
Usage logs and session recordings: typically 12 to 24 months.
De-identified and aggregated data: indefinitely.

We may retain information longer to comply with law, resolve disputes, enforce agreements, or where deletion is not technically feasible without disproportionate effort.

Security

We use administrative, technical, and physical safeguards appropriate to the sensitivity of the data, including encryption in transit and at rest, access controls and role-based permissions, multi-factor authentication for internal systems, logging and monitoring, and vendor due diligence. No method of transmission or storage is completely secure, and we cannot guarantee security. You are responsible for your credentials, for who you share links and passcodes with, and for the security of your connected accounts. If we learn of a breach affecting your personal information, we will notify you and any regulator as required by law.

Your rights and choices

All users. You can update account details in Settings, disconnect connected accounts, opt out of marketing email through the unsubscribe link or by contacting us, and close your account. Transactional and security notices continue while you have an account.

Data entered by a Coral customer. If your information was entered by a customer (for example, you are a hotel contact or a traveler on a rooming list), direct requests to that customer. We will help them respond.

U.S. state privacy laws. Depending on where you live (including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, and other states with comprehensive privacy laws), you may have the right to know what personal information we collect, use, and disclose; to access and obtain a copy; to correct inaccuracies; to delete; to opt out of sale, sharing, targeted advertising, and certain profiling; and not to be discriminated against for exercising these rights. We do not sell personal information or share it for targeted advertising. Most of these laws exempt business-to-business and employment data, which covers most information Coral handles, and some apply only to businesses above revenue or volume thresholds. We honor applicable requests regardless.

California notice at collection. In the last 12 months we have collected the categories listed in Section 1 (identifiers, commercial information, internet activity, professional information, inferences, and, for connected accounts, communications content), for the purposes in Section 2, retained as described in Section 7, and disclosed to the categories of recipients in Section 4 for business purposes. We have not sold or shared personal information. We do not use or disclose sensitive personal information to infer characteristics.

How to exercise rights. Email hi@coraltravel.io with your name, account email, and request. We will verify your identity (for example, through your account login or a confirmation email) and respond within the time required by law, generally 45 days. You may use an authorized agent with written authorization. If we deny a request, you may appeal by replying to our response; we will explain the outcome of the appeal and, where applicable, how to contact your state attorney general.

International users

Coral is operated from the United States and the Service is intended for users in the United States and Canada. If you use it from elsewhere, your information is transferred to and processed in the United States and in the countries where our providers operate, which may have different data-protection laws.

EEA, UK, and Switzerland. Where the GDPR or UK GDPR applies, our legal bases are: performance of a contract (providing the Service to you or your organization); our legitimate interests (operating, securing, and improving the Service, B2B outreach, maintaining the supplier database, preventing fraud, and marketing to business contacts), balanced against your rights; compliance with legal obligations; and consent, where we ask for it (for example, non-essential cookies). You have rights of access, rectification, erasure, restriction, portability, and objection, and the right to withdraw consent and to lodge a complaint with your supervisory authority. Transfers out of the EEA/UK rely on standard contractual clauses or other approved mechanisms. Customers who need a data processing agreement may request one at hi@coraltravel.io.

Canada. We comply with PIPEDA and applicable provincial laws. You may request access to or correction of your personal information and may withdraw consent subject to legal and contractual restrictions.

Children

The Service is for business users 18 and older. We do not knowingly collect personal information from anyone under 18 as a user. Rooming lists may include minors as travelers; the customer who enters that information is responsible for having the authority to do so. If you believe we hold a child's information improperly, contact us and we will delete it.

Third-party sites, changes, and contact

Third-party sites. The Service links to hotel websites, maps, payment pages, and other third-party sites and tools. Their privacy practices are their own; this Policy does not cover them.

Changes. We may update this Policy at any time. We will post the revised version with a new effective date and, for material changes, notify you by email or in the Service. Continued use after the effective date means you accept the revised Policy.

Contact. Coral Travel Incorporated, 205 Race Street, Philadelphia, PA 19106. Email: hi@coraltravel.io