Privacy Policy

AllTravl ("AllTravl", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you access or use our website, applications, and services (collectively, the "Platform") to discover destinations, join or host trips, share live location with your travel group, split expenses, and connect with fellow travelers.

This Policy is published in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000, and the rules made thereunder, including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. By using the Platform, you consent to the practices described in this Policy.

For the purposes of the DPDP Act, AllTravl acts as the Data Fiduciary that determines the purpose and means of processing your personal data. If you have questions, requests, or grievances regarding your data, you may contact our Grievance Officer at info@alltravl.com. We aim to acknowledge grievances within 24 hours and resolve them within the timelines prescribed under applicable law.

We collect the following categories of personal data:

• Account data: name, email address, password (stored only in hashed form), and profile photo.
• Profile data: bio, age, gender, languages, interests, location/city, and verification status.
• Trip data: trips you create or join, group memberships, chat messages, polls, packing lists, itineraries, and shared expenses or settlements.
• Direct messages: the content of 1:1 messages you exchange with other members (visible only to you and the recipient, and to moderators when a message is reported).
• Identity verification data: if you choose to verify with Aadhaar, your Aadhaar number is sent directly to a UIDAI-authorised eKYC provider with your explicit consent and is never stored by us — we retain only the last 4 digits, the verification outcome, and the name returned by the provider.
• Newsletter data: your email address if you subscribe to travel-deal emails on our landing page; you can unsubscribe anytime by contacting us.
• Location data: precise GPS coordinates, but only while you have explicitly enabled Live Location Sharing for a specific trip. Coordinates are never collected automatically and are deleted when you pause, hide, or stop sharing.
• Usage & device data: pages viewed, searches, interactions, IP address, browser type, device identifiers, and approximate location derived from your IP.
• Communications: messages you send to other members or to our support team.

We process your personal data for the following purposes, on the legal bases of your consent and our legitimate interests:

• To create, manage, and secure your account and verify your identity.
• To match you with relevant trips, destinations, and compatible travel companions — our buddy-match score compares your interests, languages, age, and trust score with a trip's preferences.
• To generate suggested itineraries when a host requests one: the trip's destination, duration, budget, and activity preferences (never your personal messages or location) may be processed by a third-party AI provider such as Anthropic.
• To enable group features such as messaging, expense splitting, and live location sharing.
• To maintain community safety through trust scores, reviews, reporting, and moderation.
• To send service communications, and (where you have opted in) newsletters and travel deals.
• To detect, prevent, and address fraud, abuse, security incidents, and violations of our Terms.
• To comply with legal obligations and respond to lawful requests from authorities.

Live Location Sharing is strictly opt-in and operates per trip. When enabled, your coordinates are shared only with confirmed members of that trip so you can find each other. Your location is never visible to anyone outside the trip or to the public. Sharing stops — and stored coordinates are removed — when you pause, hide, or stop sharing, when you leave the group, when the trip ends, or after an automatic timeout (currently 12 hours). We do not track your location in the background or when you are not actively sharing.

We use strictly necessary cookies to keep you signed in and to maintain your session and preferences (such as theme). We may use limited analytics to understand aggregate usage and improve the Platform. You can control cookies through your browser settings, though disabling essential cookies may affect core functionality such as staying logged in.

We do not sell your personal data. We may share information as follows:

• With other members: your public profile (name, photo, trust score, reviews) is visible to other users; trip details and shared content are visible to members of those trips.
• Public trip share pages: a trip's title, destination, dates, price, photo, and its host's public profile appear on the trip's shareable link so hosts can recruit members outside the platform. Your private data, messages, and location are never included.
• With service providers (Data Processors): hosting, database, email, and infrastructure providers who process data on our behalf under appropriate confidentiality and security obligations.
• For legal reasons: when required by applicable law, court order, or to protect the rights, safety, and property of AllTravl, our users, or the public.
• In a business transfer: in connection with a merger, acquisition, or sale of assets, subject to this Policy.

We retain your personal data for as long as your account is active or as needed to provide the Platform. Some data is retained for shorter periods: live location coordinates are deleted as described above, and certain logs are kept only for limited durations. After account deletion, we delete or anonymize your data within a reasonable period, except where retention is required to comply with legal obligations, resolve disputes, or enforce our agreements.

We implement reasonable security practices and procedures, including hashed password storage, encryption of data in transit over HTTPS, access controls, and restricted access to personal data. While we strive to protect your information, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. In the event of a personal data breach, we will notify the Data Protection Board and affected users as required by the DPDP Act.

Subject to applicable law, you have the right to:

• Access and obtain a summary of the personal data we hold about you.
• Correct, complete, or update inaccurate or incomplete data via your account settings.
• Erase your personal data and delete your account.
• Withdraw consent at any time (which will not affect prior lawful processing).
• Nominate another individual to exercise your rights in the event of death or incapacity.
• Grievance redressal through our Grievance Officer, and escalation to the Data Protection Board of India.

To exercise any of these rights, contact us at info@alltravl.com.

The Platform is intended for users aged 18 and above. We do not knowingly collect personal data from children. If we learn that we have collected data from a child without verifiable parental consent as required by the DPDP Act, we will delete it promptly.

We may process and store data on servers located in or outside India. Where data is transferred across borders, we take steps to ensure it is protected consistent with this Policy and applicable law.

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above and, where appropriate, by notice on the Platform. Your continued use after changes take effect constitutes acceptance of the revised Policy.

For questions about this Policy or our data practices, email info@alltravl.com or see our Help Center. This Policy should be read together with our Terms of Service.