Privacy notice

TripBondhu (“we”, “us”) is a trip planner for Indian travellers: a website at tripbondhu.com and a WhatsApp bot. This notice explains, in plain language, what personal data we collect, why, who receives it, how long we keep it and how you can use your rights. We are the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the DPDP Rules, 2025, and the controller under the EU and UK GDPR for visitors from Europe.

The short version

• We use your data to plan your trips, send the WhatsApp messages you ask for, and keep the service safe
• We earn a commission when you book through our partner links. We do not sell your personal data
• Your chat messages are read by an AI model to draft itineraries. A person may review them only to fix problems
• Inactive accounts and chat history are deleted after 18 months; booking uploads 90 days after your trip ends
• You can download or delete your data at any time from My trips, or write to our Grievance Officer at privacy@tripbondhu.com

सार (हिंदी में)

What we collect

• WhatsApp details: your WhatsApp number (WhatsApp id) and profile name when you message us or sign in with WhatsApp
• Account details: your name and email, and for Google sign-in your Google account id and profile photo
• Trip details: destinations, dates, number of travellers, budget, home city, interests, notes, stay votes, shared expenses and UPI ids you add for settling up, and the trips you save
• Chat messages: what you and your group write to the bot or in the web planner's chat, and our replies. We keep the last 40 messages of your WhatsApp conversation as “chat memory” so the bot remembers your trip
• Uploaded bookings: ticket PDFs, screenshots and forwarded booking emails you send us, and the booking details we read from them (for example PNR, hotel name, dates)
• Region settings: the country you fly from, passport nationality, nearest airport and currency. We use passport nationality only to show entry rules and never ask for passport numbers or scans
• Cookies and ad click ids: see Cookies. If you arrive from an ad, the link may carry an ad click id (such as Google's gclid); we only note that you came from an ad and do not store the id with your account
• Technical data: IP address, browser type, pages requested and partner links clicked, in server logs and first-party analytics

Why we use it and on what basis

• To plan your trip: build and update itineraries, show prices in your currency, visa rules for your passport and flight searches, save trips and keep you signed in. Basis: your consent when you start using the service (DPDP Act s.6) and, for European visitors, the contract with you
• To send WhatsApp messages you switch on: booking reminders, deals on your route, nudges for half-planned trips and new trip ideas. At most one a day, between 9am and 9pm your time. Basis: consent, which you can withdraw at any time
• To earn commission from booking partners: we tell partners a booking came through our link so the service stays free. Basis: consent for partner cookies where the law requires it, otherwise legitimate use
• To keep the service secure: rate limits, abuse prevention, debugging and aggregate statistics. Basis: legitimate uses allowed by DPDP Act s.7 and, for Europe, legitimate interests
• To meet legal duties: respond to lawful requests and keep the records the law requires

We record every consent you give or withdraw (what it covered, when, and which version of this notice was live) and include that record in your data download.

AI processing of your chats

To turn your messages into an itinerary, we send the text of your conversation and your trip details to an AI model run through Cursor (Anysphere, Inc., USA), which acts as our processor. We do not send your phone number or email with it. AI output is a draft: check prices, timings, visas and bookings yourself before you rely on them. We do not use your chats to make decisions that have legal or similarly significant effects on you.

Who receives your data

We share personal data only with providers that help us run TripBondhu, under contract, and only what each one needs:

• Meta Platforms (WhatsApp Cloud API): delivers messages between you and the bot, including your number, name, messages and the files you send
• Cursor (Anysphere, Inc.): the AI model that drafts itineraries from your chat text, as described above
• Our hosting provider: stores our servers and backups
• Google: Google sign-in if you use it, and the Google Ads conversion tag (see Cookies). Pages also load fonts from Google Fonts, which sees your IP address
• Affiliate networks Travelpayouts, Stay22 and Cuelinks, and GetYourGuide's partner programme, and the booking sites they send you to (for example Booking.com, Agoda, Klook, GetYourGuide, MakeMyTrip, Cleartrip, Kiwi.com): when you click a partner link they receive the click, your IP address and browser, and the search in the link (city, dates, travellers, currency). They do not receive your name, email or phone number from us
• Xotelo (hotel prices from TripAdvisor data): receives only hotel ids and dates, never your personal data
• open.er-api.com (exchange rates): receives no personal data
• Wikimedia Commons: source of destination photos, which we download in advance, so your browser does not contact Wikimedia
• OpenStreetMap / Nominatim: not used yet. If we add map search, the place names you type will be sent there, and we will update this notice first
• Authorities, when the law requires it

We do not sell your personal data and do not share it for cross-context behavioural advertising.

Cookies and similar technologies

• Essential: sign-in session keeps you signed in (up to 90 days, or until you sign out)
• Essential: tb_mkt remembers your region, passport, airport and currency (12 months; a copy is kept in your browser's local storage)
• Essential: tb_consent remembers your cookie choice (6 months). If you are signed in, we also add the choice to your consent record
• Essential: tb_src remembers whether your last visit came from an ad, a social post or a search engine (30 days; it stays on our site)
• Essential: WhatsApp sign-in a short-lived cookie that links your browser to the sign-in code you send (15 minutes)
• Partner (affiliate) cookies: scripts from Travelpayouts, Stay22 and GetYourGuide, and the booking sites you visit through our links, may set cookies so a booking is credited to us
• Advertising measurement (Google Ads): when you arrive from one of our Google ads, Google's tag notes the visit and whether you then open a booking partner's link. See policies.google.com/technologies/ads

In the European Economic Area, the UK and Switzerland, partner cookies and the Google Ads tag load only after you choose “Accept all”. Elsewhere they load by default and you can switch them off with Cookie settings or your browser.

How long we keep data

• Accounts, saved trips and WhatsApp chat memory: while you use TripBondhu. After 18 months with no activity (no sign-in, message or trip edit) we delete them. We warn you on WhatsApp 14 days before if we can reach you; sign in or send any message to keep your account
• Uploaded booking files (PDFs, screenshots): 90 days after your trip ends, or one year after upload if the trip has no dates. The booking details we read from them stay with the trip until the trip is deleted
• Tripboards made without an account: 18 months after the last edit
• Server logs, admin audit logs and our log of messages sent: 1 year, as the DPDP Rules require for security, then deleted
• First-party analytics events: 120 days
• Consent record: while your account exists. When you delete your account we keep one entry saying it was deleted, with no phone number or email
• Support requests: until your account is deleted, or 18 months after the request if you have no account

Your rights

• Access and download: get a summary and a copy of your data. Signed in? Use Download my data on My trips for an instant JSON file
• Correction and update: edit your details on My trips, or ask us
• Erasure: use Delete account on My trips (instant), or see Delete account. This removes your account, trips, chat memory, uploads, group memberships and votes, support requests and analytics tied to you
• Withdraw consent as easily as you gave it: reply STOP on WhatsApp, switch off updates on My trips, or change Cookie settings. Withdrawal does not affect what we did before
• Nominate someone to use your rights if you die or become unable to (DPDP Act s.14): email us their name and contact details
• Grievance redressal: contact our Grievance Officer (below). If you are not satisfied, you can complain to the Data Protection Board of India. In Europe you can complain to your local data protection authority
• European visitors can also object to or restrict processing based on legitimate interests

We reply within 30 days, and always within the 90 days the DPDP Rules allow. We may need to confirm your identity first, usually by a message from the WhatsApp number or email on your account.

Grievance Officer

Grievance Officer, TripBondhu
Email: privacy@tripbondhu.com
WhatsApp: +91 80314 50300

Children

TripBondhu is not meant for anyone under 18 unless a parent or legal guardian sets up and manages the account and gives consent for them. We do not knowingly collect a child's data without that consent, and we do not track, profile or target ads at children. If you think a child has given us data, contact us and we will delete it.

Security and breaches

We use HTTPS throughout, store sign-in tokens only as hashes, limit access to personal data to people who need it, log admin access and keep backups. If a personal data breach affects you, we will tell you without delay: what happened, when, the likely impact, what we are doing and what you can do. We will also report it to the Data Protection Board of India, with a full report within 72 hours, and to European regulators where the GDPR requires it.

Data stored outside India

Some providers above, such as Meta, Google and Cursor, process data outside India, including in the USA. The DPDP Act allows this except to countries the Government of India restricts, and we will stop any transfer the government restricts. For data from the EEA, UK or Switzerland we rely on safeguards such as the European Commission's Standard Contractual Clauses offered by these providers.

Changes

If we change this notice in a way that matters, we will update the date and version above and tell signed-in users before the change takes effect. Where a change needs fresh consent, we will ask for it.

Contact

Privacy and data requests: privacy@tripbondhu.com. Everything else: hello@tripbondhu.com.