Privacy Policy

Welcome to BharatYatra ("Platform", "we", "us", or "our"), accessible via https://bharatyatra.in (including associated mobile-optimized interfaces, applications, and subdomains). We are committed to safeguarding the digital privacy and personal data of our travellers, registered users, and partners.

Under the Digital Personal Data Protection Act, 2023 (DPDP Act) and Rule 3(1) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, BharatYatra operates as the Data Fiduciary determining the purpose and means of processing your personal data for travel discovery, AI itinerary generation, and travel booking coordination.

This Privacy Policy applies to all digital personal data collected, stored, processed, or shared by BharatYatra through:

• Our primary web application at https://bharatyatra.in and responsive mobile browser viewports.
• Our proprietary AI trip planning engine, destination exploration tools, and interactive Gujarat route maps.
• User registration, Google OAuth sign-in, account management, and traveller profile storage.
• Booking requests, voucher issuance, expense logs, and customer support communications.
• Travel partner and supplier onboarding portals where supplier personnel submit verification data.

This policy does not govern third-party platforms accessed via external hyperlinks (such as external airline portals, payment gateways, or state tourism boards), which operate under their own independent privacy notices.

In strict adherence with the statutory doctrine of data minimisation under Section 6 of the DPDP Act 2023, BharatYatra collects only personal information strictly necessary to provision requested travel services:

BharatYatra implements industry-standard, token-based authentication powered by Supabase Auth. We strictly refuse to maintain or handle plain-text user passwords on our application servers.

To deliver personalized AI travel recommendations without unnecessary server roundtrips, the Platform utilizes browser local storage and cloud database synchronization:

• Travel Preferences: Budget bands (e.g. Budget, Moderate, Luxury), travel pace, companion types (Solo, Family, Couple, Friends), and thematic interests (Heritage, Wildlife, Spiritual, Beach).
• Saved & Active Itineraries: Multi-day schedules, day-by-day stops, selected landmarks, and transport mode preferences saved to your account.
• Client-Side Cache: Non-sensitive contextual data (such as active landmark bookmarks and trip draft builders) is cached in your browser's localStorage under bharatyatra_travel_profile and bharatyatra_selected_destinations. You can clear this anytime through browser settings.

When navigating BharatYatra, our edge network and server infrastructure automatically log standard technical telemetry necessary for platform stability, security defense, and performance diagnostics:

• Network Indicators: Client IP address (pseudonymized and hashed at rest for DDoS mitigation), HTTP request headers, and response timestamps.
• Device & Browser Telemetry: User-agent string, operating system version, screen resolution, viewport geometry, and language header.
• Performance Metrics: Core Web Vitals (Largest Contentful Paint, First Input Delay, Cumulative Layout Shift) collected in aggregate without identifying individual users.
• No Third-Party Ad Trackers: BharatYatra does not install intrusive behavioral trackers, invasive social advertising pixels, or cross-context commercial tracking networks.

Under Section 4 and Section 6 of the Digital Personal Data Protection Act, 2023, BharatYatra processes personal data strictly on the grounds of Specific, Informed, and Unambiguous Consent and for legitimate fulfillment of contractual travel requests:

To provide a reliable cloud service, BharatYatra engages certified enterprise infrastructure sub-processors subject to contractual Data Processing Agreements (DPAs):

When you finalize a travel booking, essential traveller details are transmitted to the relevant third-party suppliers to issue confirmed vouchers and comply with statutory travel regulations:

• Rail Bookings: Transmitted through authorized IRCTC integration partners in compliance with Indian Railways passenger reservation directives.
• Air Travel: Passenger details (name, date of birth, contact number, government ID type) transmitted to airlines and civil aviation authorities in compliance with DGCA safety and security mandates.
• Hotels & Homestays: Lead guest name, contact details, stay duration, and check-in documentation requirements shared directly with the hotel or resort for reservation confirmation and police registration rules (Form C where applicable).
• Protected Reserves & National Parks: Visitor details (e.g., Sasan Gir Forest safari permits or Rann of Kutch check-post entries) shared strictly with Gujarat Forest Department or relevant administrative authorities for official permit validation.

Personal data is retained only for the duration necessary to accomplish the specified purposes for which it was collected, or to comply with statutory statutory retention mandates under Indian law:

BharatYatra implements comprehensive administrative, physical, and technical safeguards engineered to protect personal data against unauthorized access, alteration, disclosure, or accidental destruction:

• Transport Encryption: 100% of network traffic is encrypted via TLS 1.3 with automated HTTP Strict Transport Security (HSTS) headers and preloading.
• Content Security Policy: Strict CSP rules blocking unauthorized scripts, external cross-site scripting (XSS) vectors, and clickjacking attacks.
• Database Protection: PostgreSQL connections require TLS with Row-Level Security (RLS) enforcement, automated hourly transaction logging, and daily encrypted snapshots.
• Technical Limitations Disclaimer: While we enforce robust, modern security controls, no internet-connected platform can guarantee absolute invulnerability. Travellers are responsible for keeping account passwords, authentication links, and personal devices secure.

As a lawful Data Principal under the Digital Personal Data Protection Act, 2023, you possess statutory rights enforceable against BharatYatra:

To exercise any statutory right, submit a signed request to privacy@bharatyatra.in. We respond within the statutory timeframe (under 30 days).

We provide clear, verified pathways for travellers to update personal information or initiate complete account erasure:

Under Section 9 of the DPDP Act, 2023, BharatYatra does not permit registration, account creation, or contract execution by individuals under eighteen (18) years of age without verifiable parental or lawful guardian authorization.

Minor passenger information (e.g. child travellers accompanying parents on rail, air, or hotel reservations) is collected strictly when provided by an adult primary traveller who certifies lawful parental or guardianship authority. BharatYatra does not undertake behavioral tracking or targeted marketing directed at minors.

BharatYatra primarily stores and processes user personal data within sovereign data centers located in Mumbai and Bengaluru, India.

Where enterprise cloud providers (such as Supabase or Vercel edge networks) distribute compute nodes or encrypted backups internationally, data transfers are conducted strictly in compliance with Section 16 of the DPDP Act, 2023, adhering to Central Government negative list notifications and enforcing equivalent cryptographic safeguards abroad.

In accordance with Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and Section 13 of the DPDP Act, 2023, BharatYatra has established a formal consumer and privacy grievance mechanism:

BharatYatra reserves the right to periodically update this Privacy Policy to reflect modifications in platform features, cloud architecture, or statutory regulatory directives.

When material revisions occur, we will post an updated effective date on this page and, where appropriate, provide visible notice across account dashboards. Continued use of the Platform after the effective date of an amended policy constitutes acceptance of the modified practices.