Your data, handled with care

Privacy policy

We collect only what we need to plan, book and support your trips — and we never sell your personal data.

Last updated October 2026

What we collect

Account details: name, email, mobile number, city and, if you add them, date of birth and nationality.
Booking details: traveller names and ages, contact details, special requests and, if you ask for a GST invoice, your GSTIN.
Payment records: amounts, status and gateway references. Card and UPI credentials are handled by Razorpay and never reach our servers.
Usage data: basic logs and cookies needed to keep you signed in and protect the site.

How we use it

To create and manage your bookings, issue invoices and process refunds.
To share the details a vendor needs to deliver your trip (traveller names, contact, dates and requests).
To send booking updates, payment reminders and support replies.
To prevent fraud and meet legal and tax obligations.

Cookies

We use secure, http-only cookies for sign-in sessions and a CSRF token to protect your account. We do not use third-party advertising cookies.

Sharing

We share data only with the vendor delivering your booking, our payment gateway (Razorpay), and service providers who help us run the platform under confidentiality — or when required by law.

Retention and your rights

We keep booking and invoice records for as long as tax law requires. You can view and update your profile anytime, and ask us to correct or delete personal data that we are not required to keep by writing to support@thavel.in.