Privacy Policy
1. About this policy
This policy explains how [Company name] Private Limited ("TripiTrail", "we") handles personal data. It covers the people who use TripiTrail at a travel agency, visitors to https://tripitrail.com, and, briefly, the customers of those agencies.
2. Agencies’ customers
When a travel agency stores its customers' details in TripiTrail, the agency decides why and how that data is used. The agency is the Data Fiduciary and TripiTrail is its Data Processor. We handle that data only to provide the service to the agency, as set out in our Terms of Service.
If you are a customer of an agency and want to see, correct or erase your data, please contact the agency directly. It can export or erase your record. If you contact us, we will pass your request to the agency.
3. What we hold about agency staff
Name, work email address and role, and the agency you belong to.
A secure hash of your password, never the password itself.
Sign-in records: time, IP address and browser, and failed attempts, used to protect accounts from misuse.
Your activity in the audit log, such as viewing passport details or issuing invoices, so the agency can see who did what.
Your preferences, such as light or dark theme, and the record of any Terms of Service you accepted on behalf of your agency, with the time and IP address.
4. Why we use it
To let you sign in and use the workspace, to keep accounts and data secure, to send emails the service needs (such as invitations and password resets), to provide support, to bill the agency, and to meet our legal obligations. We do not sell personal data, and we do not use it for advertising.
5. Who we share it with
Only the service providers that run TripiTrail:
Hetzner Online GmbH (Germany): Servers and the database that run the service.
Cloudflare, Inc. (Global network): Storage of uploaded documents, logos and exports; domain name service.
Resend (Ireland): Sending email on the agency’s behalf, such as invoices and password resets.
And authorities, where the law requires it.
6. Where it is stored
Data is stored on servers in Germany and on the storage network named above. Where data is processed outside India, we do so in line with the Digital Personal Data Protection Act, 2023 and any restrictions notified under it.
7. How long we keep it
Staff accounts are kept while the agency uses TripiTrail. When an agency leaves, its data is deleted 30 days later, as described in the Terms of Service.
Invoices, credit notes and the audit log are kept for as long as tax and other laws require, which for tax records is typically eight years.
If you ask for a demo or a free trial on our website and do not become a customer, we remove your name, email, phone number and message 180 days after we last dealt with your request. We keep only the agency name and dates, to count requests.
8. Your rights
You may ask to access, correct or erase the personal data we hold about you, to withdraw consent where we rely on it, and to nominate someone to exercise your rights. Where your data is held by an agency, the agency handles the request. Some data cannot be erased while the law requires us to keep it.
9. Security
Each agency's data is isolated at the database level, passport numbers are encrypted, passwords are hashed, connections are encrypted, and access to sensitive data is recorded in an audit log that cannot be altered.
10. Grievance officer
If you have a complaint about how your personal data is handled, contact our Grievance Officer: [Grievance officer name], [Company name] Private Limited, [Registered office address]. Email [Grievance officer email].
We will acknowledge your complaint and aim to resolve it within the time the law requires. If you are not satisfied with our response, you may approach the Data Protection Board of India.
11. Changes to this policy
Each version of this policy has a number and an effective date. When it changes, agency owners are asked to accept the new version before the workspace can be used again.