Privacy Policy

This Privacy Policy explains how SKYBUY PRIVATE LIMITED ("we", "us"), which operates Tripvya at tripvya.in, collects, uses, shares and protects your personal data when you search for, book or manage travel with us. We process personal data in accordance with the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000 and the rules made under them. By using Tripvya you agree to this policy.

1. Who is responsible for your data

SKYBUY PRIVATE LIMITED is the Data Fiduciary for personal data collected through Tripvya.

2. Personal data we collect

3. How we use your data

• To create and secure your account, including sending OTPs for sign-in and password reset.
• To make, confirm, change and cancel bookings with airlines, bus operators, hotels and holiday partners, and to issue e-tickets and vouchers.
• To collect payments, verify UPI transactions, prevent fraud and process refunds.
• To send service messages about your booking (confirmations, cancellations, refunds and schedule changes).
• To answer support requests and resolve complaints.
• To issue GST invoices and meet our tax, accounting and other legal obligations.
• To keep the website secure and working (for example, rate-limiting sign-in attempts).

We do not sell your personal data and we do not use it for third-party advertising.

4. Consent and legitimate uses

We process your data on the basis of your consent, which you give when you create an account or make a booking, and for legitimate uses permitted by law, such as completing the service you asked for, complying with legal obligations and responding to emergencies. You may withdraw consent at any time (see section 9); this will not affect processing already carried out, and we may be unable to provide services that depend on that data.

5. Who we share data with

• Travel service providers: the airline, bus operator, hotel or holiday partner fulfilling your booking receives the traveller and contact details needed to deliver the service. For international travel this may involve transfer to providers outside India.
• Payment partners: our payment gateway and banks receive the order amount, reference and your contact details to process UPI payments and refunds.
• Technology providers: our hosting provider and email (SMTP) provider process data on our behalf to run the website and send emails.
• Authorities: government, law-enforcement or regulatory bodies when required by law or to protect rights, safety and property.

Everyone we share data with may use it only for the purpose for which it was shared.

6. Cookies

We only use cookies that are strictly necessary for the website to work:

• Session cookie: keeps you signed in and remembers your booking progress.
• XSRF-TOKEN: protects forms against cross-site request forgery.
• Remember-me cookie: only if you tick "Remember me" when signing in.

We do not use advertising or cross-site tracking cookies. Our pages load fonts, icons and styles from third-party content networks (Google Fonts, cdnjs, Tailwind CDN), which receive your IP address when your browser fetches those files.

7. How long we keep data

• Account data: until you delete your account.
• Booking, invoice and payment records: for as long as required by tax and company law (currently up to 8 years), even if you delete your account. After account deletion these records are kept only for legal purposes.
• Support messages: up to 3 years after the issue is closed.
• OTPs: until used or expired (10–15 minutes).
• Server logs: up to 90 days.

8. How we protect data

We use HTTPS encryption, one-way password hashing, encrypted storage of payment and email credentials, role-based admin access, rate-limited sign-in and OTP attempts, and regular updates. No method of transmission or storage is completely secure. If a personal data breach affects you, we will inform you and the Data Protection Board of India as required by law.

9. Your rights

Under the Digital Personal Data Protection Act, 2023 you have the right to:

• Access a summary of the personal data we hold about you and how it is used.
• Correct and update your data. You can edit your name and mobile number in My Account.
• Erase your data. You can delete your account in My Account; records we must keep by law are retained as described above.
• Withdraw consent for further processing.
• Grievance redressal through our Grievance Officer (section 12), and if you are not satisfied, to complain to the Data Protection Board of India.
• Nominate another person to exercise these rights in the event of your death or incapacity.

To exercise any right, use our contact form (topic "Privacy / my data") or email the Grievance Officer. We may need to verify your identity before acting on a request.

10. Children

You must be 18 or older to create an account or make a booking. Bookings for children must be made by a parent or legal guardian, who consents to us processing the child's data for that booking. We do not knowingly use children's data for any other purpose.

11. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top shows the latest version; significant changes will be highlighted on the website.

12. Grievance Officer

For any question, complaint or request about your personal data, contact our Grievance Officer. We will acknowledge your complaint within 48 hours and resolve it within one month.