Privacy Policy

Trust and Trip Experiences Pvt. Ltd. ("Trust and Trip", "we") plans and books travel. This policy explains what personal data we collect through trustandtrip.com, WhatsApp, email and our ads, why, who we share it with, how long we keep it, and your rights under India's Digital Personal Data Protection Act, 2023. We do not sell or rent personal data.

• Enquiries (name, phone, email, destination, dates, group size, budget, message): to reply to you and plan your trip. When you enquire, you get an automated first reply on WhatsApp within about a minute, written by an AI model and signed as our AI co-pilot. A planner then follows up by WhatsApp, phone or email.
• Bookings (traveller names, contact details, itinerary, payment reference): to book and deliver the trip, and to meet tax and accounting law.
• Chat and itinerary tools (what you type): to answer you. An AI model drafts replies and itineraries; a person reviews anything that becomes a quote. If you ask for an itinerary by email, we first email you a link to confirm the address is yours.
• Account data if you register (profile, saved trips): to run your account.
• Newsletter (email): only if you subscribe, with an unsubscribe link in every marketing email. If you have an account with a saved cart, or a booking, we may also email you a reminder or ask for a review, and those emails carry the same unsubscribe link.
• Usage data (pages viewed, device, approximate location from IP): to keep the site working and understand what helps. Analytics and advertising cookies are set only after you accept them; see Cookies below.

We share personal data only with the service providers that help us run the business, each for the purpose listed, and with hotels, airlines and ground operators to fulfil a booking:

• Supabase (database) and Vercel (hosting)
• Razorpay (payments)
• Resend (email delivery) and Meta WhatsApp Business (messaging)
• Anthropic (AI model that drafts chat replies, itineraries and the automated WhatsApp first reply)
• Our customer-relationship system, used by our planners to follow up
• Slack and Telegram (internal alerts to our planners, with your phone and email masked)
• Google (Analytics, Tag Manager and Ads measurement) and PostHog (analytics)
• Upstash (rate limiting, which processes IP addresses)
• Meta (Facebook and Instagram advertising measurement, as described below)
• Sentry (error monitoring; we remove names, emails and phone numbers, but error reports can include IP address and device details)

When you submit an enquiry or complete a booking, we also share a record that a conversion happened — an enquiry or a purchase — with our advertising partners, currently Meta (Facebook and Instagram), so they can measure and improve the ads that brought you to us. What we send is your email address and phone number, converted into an irreversible SHA-256 hash; we never send your name, email address, or phone number in plain text for this purpose. This transmission also includes your device's IP address and browser user agent, which Meta uses for matching and fraud prevention — unlike your contact details, these two are sent as-is, not hashed.

If you are visiting from the European Economic Area, the United Kingdom, or Switzerland, none of this is shared until you have given consent on our cookie banner. If you are visiting from elsewhere, we rely on legitimate interest instead: submitting an enquiry with your contact details is itself a request that we act on it, so we treat that submission as the basis for sharing that the conversion happened.

We may also share your email address and phone number, as an irreversible SHA-256 hash, with Meta so we can show relevant travel offers to past enquirers and customers on Facebook and Instagram, and so we don't show new-customer offers to people who already travel with us. Reply STOP to any of our WhatsApp offers, or contact us, and we will remove you from these lists.

To opt out, reject marketing cookies on the cookie banner. Wherever you are visiting from, a rejection stops the conversion sharing described above (for the ad audience lists, reply STOP or contact us as described above). To change an earlier choice, contact us using the details under "Your rights" below.

Some of these providers store or process data outside India, including in the United States and the European Union. We transfer data only to providers bound by contract to protect it, and never to a country the Government of India has restricted under the DPDP Act.

• Enquiries: deleted 24 months after your last contact with us; archived enquiries are deleted 36 months after they were made.
• Bookings and invoices: 8 years, as Indian tax law requires.
• Unconfirmed itinerary emails: 30 days.
• Itineraries, quiz answers and trip plans: 24 months.
• Newsletter: until you unsubscribe. We keep your address on a do-not-email list so we never mail you again by mistake.

Necessary cookies keep the site and your session working. Analytics and advertising cookies are set only after you accept them on the cookie banner, and you can reject them. Before you choose, Google tags run in a restricted mode that sets no cookies but still receives basic request data such as your IP address and the page you are on. PostHog and the Meta Pixel do not load until you accept.

You can ask us to tell you what we hold about you, correct it, or delete it, and you may nominate someone to exercise these rights for you. Deletion requests are handled as described on our data deletion page. We reply within 30 days. You can also email support@trustandtrip.com.

Akash Mishra, Founder, Trust and Trip Experiences Pvt. Ltd. Email support@trustandtrip.com with "Grievance" in the subject. We acknowledge within 48 hours and resolve within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.

Our services are for adults. We collect a child's details only from a parent or guardian booking travel for them.

We will update the date at the top when this policy changes, and tell registered users by email about any material change.