Privacy Policy

We collect two categories of information: information you provide directly, and information collected automatically when you visit our site.

Information you provide directly:

• Identifiers: First name, last name, email address.
• Commercial & Travel Information: State or country of primary residence, destination country, travel dates, and relationship to the insured.
• Quote Context: Age at coverage start, selected plan name, quoted premium, coverage limit, deductible, and answers to pre-existing condition questions — collected only when you proceed to purchase a plan.
• Communications: Any optional message you include when contacting us.

Information collected automatically (only with your consent):

• Usage Data: Pages visited, time on page, referring URL, and browser/device type — collected via Google Analytics only after you accept analytics cookies. See Section 4 for full details.

We collect and use this information for the following business purposes:

• To determine your eligibility for specific travel medical insurance plans based on your jurisdiction.
• To redirect your inquiry to our contracted insurance partners to generate an accurate quote and process your application.
• To send you marketing and educational emails regarding insurance products — only if you have explicitly opted in via our marketing consent checkbox.
• To analyze aggregate site usage patterns to improve our content and user experience — only when you have accepted analytics cookies.

We do not sell your personal information, nor do we "share" it for cross-context behavioral advertising. In the preceding 12 months, we have only disclosed data for business purposes to the following essential third parties:

• Contracted Insurance Partners: Licensed carriers and brokers we partner with to provide your quote and policy (Treppy, Inc.; IMG Global; Trawick International; WorldTrips).
• CRM Service Providers: HubSpot, Inc. — used solely to store contact information and manage authorized email communications. Data is stored on HubSpot's servers in the United States.
• Analytics Providers: Google LLC (Google Analytics 4) — only when you have accepted analytics cookies. See Section 4 for details. Google may process data outside your country of residence. Google's privacy policy is available at policies.google.com/privacy.

We use Google Analytics 4 (GA4) to understand how visitors use our site in aggregate — which pages are most visited, how users navigate the quote flow, and where they leave. This helps us improve the experience for everyone.

How we handle consent:

We implement Google Consent Mode v2. When you first visit our site, GA4 runs in cookieless mode — it sends anonymous, non-identifiable pings and does not set any cookies or link data to your device. A cookie banner appears offering you a choice:

• "Accept analytics": GA4 sets the _ga and _ga_* cookies with a two-year expiry and begins full session tracking.
• "Necessary only": GA4 remains in cookieless mode. No cookies are set. Google still receives anonymous, aggregated signals that do not identify you.

Your choice is saved in your browser's localStorage and remembered on future visits. You can change your preference at any time by clearing your browser's site data for chocobao.com, which will show the banner again on your next visit.

What GA4 does not do:

• We do not enable advertising features, remarketing, or any Google signal sharing. Ad-related consent (ad_storage, ad_user_data, ad_personalization) is permanently denied regardless of your cookie choice.
• IP addresses are anonymized before storage (anonymize_ip: true).
• We do not use GA4 data to build individual user profiles or serve targeted advertising.

Other storage:

• Quote session state is stored in sessionStorage under the key chocobao_quote. This is not a cookie — it exists only for your current browser tab and is deleted automatically when you close it.
• Cookie preference is stored in localStorage under the key chocobao_cookie_consent ("granted" or "denied"). Clearing site data resets this.

To comply with California Department of Insurance regulations (Title 10, CCR § 2190.2), we are legally required to retain records of all insurance quotes and transactions for a minimum of five years. Contact data for users who opt into marketing is retained until you unsubscribe or request deletion from our marketing lists.

Google Analytics data is retained for 14 months within Google's infrastructure, after which it is automatically deleted. This is the minimum retention period Google allows.

Under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), California residents have the right to:

• Know & Access the specific pieces and categories of personal information we have collected.
• Delete personal information we have collected from you. (This right is subject to mandatory state insurance recordkeeping laws outlined in Section 5.)
• Correct inaccurate personal information.
• Opt-Out of the sale or sharing of personal information. (Chocobao does not engage in these practices.)
• Opt-Out of Analytics Cookies at any time by selecting "Necessary only" in the cookie banner, or by clearing site data for chocobao.com in your browser settings to reset your preference.
• Non-Discrimination for exercising your privacy rights.

To exercise your California privacy rights, or to unsubscribe from our communications, please contact us at: privacy@chocobao.com. We will verify your identity by matching the email address used in your original request and will respond within 45 days.