Privacy Policy

Last updated: 21 October 2026

This policy explains what personal data TripOrbit stores, why, and the choices you have. It covers this website and the TripOrbit app.

1. Two kinds of data

• Agency data. When a travel agency signs up, we are responsible for its account data (section 2).
• Traveller data. When an agency enters details about its own clients, the agency decides what is collected and why. We store and process that data only on the agency's instructions, to run the Service for it. If you are a traveller, please contact the agency that sent you the proposal about your data; we will help them respond.

2. What we collect about agencies and their team

• Account details: name, work email, mobile number, role and a securely hashed password (we never store the password itself).
• Agency details you add for your documents: business name and address, GSTIN, PAN, bank account and UPI ID, logo, colours and policies.
• Usage records needed to run and protect the Service: sign-in sessions, IP address and browser type for security and rate limiting, and an activity log of actions in your account.

3. What we collect from travellers through agency links

When a traveller accepts a proposal we record the name they type, the time and their IP address, so the agency has a record of the acceptance. We also record when a proposal link is opened, so the agency can see it was viewed.

4. Why we use it

• To provide the Service: build and send proposals and invoices, record payments and send the reminders you turn on.
• To keep accounts secure and prevent abuse.
• To send you service emails, such as sign-up confirmation, password resets and billing notices.

We do not sell personal data, do not show advertising, and do not use your data or your clients' data to train AI models.

5. Cookies

We use one essential cookie, triporbit_session, to keep you signed in. It is HTTP-only and expires after 14 days or when you sign out. This website does not use analytics or advertising cookies.

6. Who we share data with

• Our hosting and database providers, which store data on our behalf.
• The email server, WhatsApp Business account or Razorpay account that an agency chooses to connect, only to deliver the messages and payments that agency sends.
• Built-in photos load from Unsplash's image service, which receives your browser's IP address when a photo is shown.
• Authorities, if the law requires us to.

7. How we protect it

Each agency's data is separated so only its own team can see it. Connections are encrypted in transit, integration secrets are encrypted at rest, passwords are hashed, and sign-in attempts are rate-limited.

8. How long we keep it

We keep agency data while the account is active. After an account is closed we delete it within 90 days, except records we must keep longer by law, such as invoices for tax purposes.

9. Your rights

Under the Digital Personal Data Protection Act, 2023 you can ask to access, correct or erase your personal data, withdraw consent where we rely on it, and nominate someone to act for you. Email contact@layzox.com and we will reply within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.

10. Grievance officer

For any privacy concern, write to the Grievance Officer at contact@layzox.com with "Privacy" in the subject.

11. Changes

If we change this policy in a way that matters, we will tell signed-in users by email or in the app before the change takes effect.