Privacy Policy

1.1 Information you provide directly:

• Mobile number — used for account creation and OTP-based authentication via Firebase.
• Name — to personalise your booking experience.
• Email address — optional; used for booking confirmations and receipts.
• Pickup & drop addresses — required to provide transport services.
• Flight number — collected for airport transfer bookings to track delays.
• Travel dates and times — to schedule your ride.

1.2 Information collected automatically:

• Device information — device type, operating system, and browser.
• IP address — for security, fraud prevention, and approximate location.
• Usage data — pages visited, features used, and session duration.
• Cookies and local storage — to maintain your session and preferences.

1.3 Location information:

We may request access to your device location (with your permission) to auto-fill your pickup address and improve routing accuracy. You can disable location access in your device settings at any time.

We use the information we collect to:

• Create and manage your account.
• Process, confirm, and fulfil your bookings for outstation rentals, airport transfers, and hourly rentals.
• Send booking confirmations, driver details, and trip updates via SMS, email, or push notification.
• Track flight status for airport transfer bookings and adjust driver dispatch accordingly.
• Process payments and issue refunds or receipts.
• Provide 24/7 customer support and resolve disputes.
• Detect and prevent fraud, abuse, or unauthorised access.
• Comply with applicable Indian laws and regulations, including the IT Act 2000 and its rules.
• Improve our services through aggregated, anonymised analytics.

We do not use your personal data for automated decision-making or profiling that significantly affects you.

Indian Tours Travels accepts online payments for booking services. All payment transactions are processed through PCI-DSS compliant third-party payment gateways (such as Razorpay, PayU, or similar). We do not store your full card number, CVV, or banking credentials on our servers.

We may store:

• Transaction reference IDs for reconciliation and support.
• Payment status (success / failure / refund) linked to your booking.
• Partial masked card details (e.g. last 4 digits) provided by the payment gateway for display purposes only.

Refunds, if applicable, are processed back to the original payment method within 5–7 business days, subject to our cancellation policy.

We share your information only in the following circumstances:

• Drivers & vendors: Your name, mobile number, pickup location, and trip details are shared with the assigned driver or vendor to fulfil your booking.
• Payment processors: Billing details are shared with our payment gateway to complete transactions.
• Firebase (Google): Your mobile number is shared with Firebase for OTP-based phone authentication.
• Legal obligations: We may disclose information if required by law, court order, or government authority.
• Business transfer: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity under the same privacy protections.

We do not sell your personal information to third parties for marketing purposes.

We retain your personal information for as long as:

• Your account remains active.
• It is necessary to provide our services.
• It is required by applicable law (e.g. financial records are retained for 7 years under Indian tax law).

You may request deletion of your account and associated data by contacting us at privacy@indiantourntravels.in. Note that some data may be retained for legal or fraud-prevention purposes even after account deletion.

We implement industry-standard security measures to protect your information, including:

• HTTPS encryption for all data in transit.
• HMAC-signed session tokens stored as HttpOnly, Secure cookies.
• Passwords (where applicable) stored as bcrypt hashes — never in plain text.
• Restricted database access on a need-to-know basis.
• Regular security reviews and dependency updates.

Despite these measures, no system is 100% secure. If you suspect unauthorised access to your account, please contact us immediately at privacy@indiantourntravels.in.

Under applicable Indian privacy laws, you have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Delete your account and personal data (subject to legal retention requirements).
• Withdraw consent for optional data processing (e.g. marketing communications).
• Data portability — request a copy of your data in a structured, machine-readable format.

To exercise any of these rights, contact us at privacy@indiantourntravels.in. We will respond within 30 days.

We use the following types of cookies:

You can control cookies through your browser settings. Disabling the session cookie will require you to log in on every visit.

Our services integrate with the following third parties, each governed by their own privacy policies:

• Firebase (Google) — phone OTP authentication. Firebase Privacy Policy
• Payment Gateway (Razorpay / PayU) — secure online payment processing.
• Google Maps — for route display and location autocomplete.
• Google Analytics — anonymised website traffic analysis.

We are not responsible for the privacy practices of these third parties.

Our services are not directed to children under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information without parental consent, please contact us immediately and we will delete it promptly.

We may update this Privacy Policy from time to time to reflect changes in our services, technology, or legal requirements. When we do, we will update the "Last updated" date at the top of this page. For significant changes, we will notify you via SMS or email. Continued use of our services after the effective date constitutes acceptance of the revised policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your data, please reach out to our Privacy Officer: