Privacy Policy

AllTravl ("AllTravl", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you access or use our website, applications, and services (collectively, the "Platform") to discover destinations, join or host trips, share live location with your travel group, split expenses, and connect with fellow travelers.

This Policy is published in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000, and the rules made thereunder, including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. By using the Platform, you consent to the practices described in this Policy.

For the purposes of the DPDP Act, AllTravl acts as the Data Fiduciary that determines the purpose and means of processing your personal data. If you have questions, requests, or grievances regarding your data, contact our Grievance Officer:

We acknowledge every grievance within 24 hours and resolve it within 15 days. If you are not satisfied with our response, you may take your complaint to the Data Protection Board of India.

We collect the following categories of personal data:

• Account data: name, email address, password (stored only in hashed form), and profile photo.
• Profile data: bio, age, gender, languages, interests, location/city, and verification status.
• Trip data: trips you create or join, group memberships, chat messages, polls, packing lists, itineraries, and shared expenses or settlements.
• Direct messages: the content of 1:1 messages you exchange with other members (visible only to you and the recipient, and to moderators when a message is reported).
• Identity verification data: if you choose to verify with Aadhaar, your Aadhaar number is sent directly to a UIDAI-authorised eKYC provider with your explicit consent and is never stored by us — we retain only the last 4 digits, the verification outcome, and the name returned by the provider.
• Newsletter data: your email address if you subscribe to travel-deal emails on our landing page; you can unsubscribe anytime with the link at the bottom of every newsletter, or from Settings.
• Blog content: if an administrator approves you as an author, the posts you write — their text, photos and your author byline (name, profile photo and bio) — together with view counts. Published posts are public; see section 6.
• Location data: precise GPS coordinates, but only while you have explicitly enabled Live Location Sharing for a specific trip. Coordinates are never collected automatically and are deleted when you pause, hide, or stop sharing.
• Usage & device data: pages viewed, searches, interactions, IP address, browser type, device identifiers, and approximate location derived from your IP.
• Communications: messages you send to other members or to our support team.

We process your personal data for the following purposes, on the legal bases of your consent and our legitimate interests:

• To create, manage, and secure your account and verify your identity.
• To match you with relevant trips, destinations, and compatible travel companions — our buddy-match score compares your interests, languages, age, and trust score with a trip's preferences.
• To generate suggested itineraries when a host requests one: the trip's destination, duration, budget, and activity preferences (never your personal messages or location) may be processed by a third-party AI provider such as Anthropic.
• To enable group features such as messaging, expense splitting, and live location sharing.
• To maintain community safety through trust scores, reviews, reporting, and moderation.
• To send service communications, and (where you have opted in) newsletters and travel deals.
• To detect, prevent, and address fraud, abuse, security incidents, and violations of our Terms.
• To comply with legal obligations and respond to lawful requests from authorities.

Live Location Sharing is strictly opt-in and operates per trip. When enabled, your coordinates are shared only with confirmed members of that trip so you can find each other. Your location is never visible to anyone outside the trip or to the public. Sharing stops — and stored coordinates are removed — when you pause, hide, or stop sharing, when you leave the group, when the trip ends, or after an automatic timeout (currently 12 hours). We do not track your location in the background or when you are not actively sharing.

Parts of the Platform are public and can be viewed without an account. Our blog is one of them: if an administrator approves you as an author, the posts you publish — together with your name, profile photo and bio — appear on pages that anyone can read and that search engines such as Google may crawl and index.

A trip's public details (title, destination, dates, price, cover photo and host profile) are likewise visible to anyone holding its shareable link.

Please note that once a page has been indexed or copied by a third party, we cannot guarantee its removal from that third party's systems. If you ask us to delete published content we will remove it from the Platform, but it may continue to appear in search engine results, caches or archives maintained by others for some time afterwards, and those services are outside our control. You should therefore only publish information you are comfortable making permanently public.

We use strictly necessary cookies to keep you signed in and to maintain your session and preferences (such as theme). We may use limited analytics to understand aggregate usage and improve the Platform. You can control cookies through your browser settings, though disabling essential cookies may affect core functionality such as staying logged in.

We do not sell your personal data. We may share information as follows:

• With other members: your public profile (name, photo, trust score, reviews) is visible to other users; trip details and shared content are visible to members of those trips.
• Public trip share pages: a trip's title, destination, dates, price, photo, and its host's public profile appear on the trip's shareable link so hosts can recruit members outside the platform. Your private data, messages, and location are never included.
• With service providers (Data Processors): the companies below process personal data on our behalf, only to provide the Platform and under appropriate confidentiality and security obligations.
• For legal reasons: when required by applicable law, court order, or to protect the rights, safety, and property of AllTravl, our users, or the public.
• In a business transfer: in connection with a merger, acquisition, or sale of assets, subject to this Policy.

We retain your personal data for as long as your account is active or as needed to provide the Platform. Some data is retained for shorter periods: live location coordinates are deleted as described above, and certain logs are kept only for limited durations. You can delete your account from Settings at any time: it is permanently deleted, together with your associated data, 7 days after you ask (you can cancel during those 7 days). Content you contributed to shared places, such as destinations, is anonymized rather than deleted. We keep data beyond this only where the law requires it.

We implement reasonable security practices and procedures, including hashed password storage, encryption of data in transit over HTTPS, access controls, and restricted access to personal data. While we strive to protect your information, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. We keep a log of security-relevant events (such as sign-ins, consent changes, account deletions and administrator actions) for one year, to detect and investigate misuse. In the event of a personal data breach, we will inform affected users without delay — what happened, what it means for them and what they can do — and report it to the Data Protection Board of India within 72 hours, as the DPDP Rules require.

Subject to applicable law, you have the right to:

• Access and obtain a summary of the personal data we hold about you.
• Correct, complete, or update inaccurate or incomplete data via your account settings.
• Erase your personal data and delete your account.
• Withdraw consent at any time, as easily as you gave it (this will not affect prior lawful processing). Because we can't run your account without processing its data, withdrawing consent means deleting your account, which you can do from Settings.
• Nominate another individual to exercise your rights in the event of death or incapacity.
• Grievance redressal through our Grievance Officer, and escalation to the Data Protection Board of India.

You can correct your data and delete your account yourself from Settings. To exercise any other right, email our Grievance Officer at grievance@alltravl.com.

The Platform is intended for users aged 18 and above, and everyone confirms they are 18 or older when they create an account. We do not knowingly collect personal data from children. If we learn that we have collected data from a child without verifiable parental consent as required by the DPDP Act, we will delete it promptly.

Our database and application servers are in India (Mumbai). Some of the providers listed in section 8 — such as Google, Cloudflare and Anthropic — may process data on servers outside India as part of their services. We do not transfer personal data to any country the Government of India has restricted, and we take steps to ensure transferred data is protected consistent with this Policy and applicable law.

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above and, where appropriate, by notice on the Platform. Your continued use after changes take effect constitutes acceptance of the revised Policy.

For questions about this Policy or our data practices, email grievance@alltravl.com or see our Help Center. This Policy should be read together with our Terms of Service.