Privacy Policy

We have prepared a transparent, modern Privacy Policy to explain how Mazer Labs Private Limited collects, uses, and protects your personal data across the TripMazer platform.

This summary outlines our core practices, including account data, travel bookings via LiteAPI, payment processing (Razorpay & Polar), voice/vision processing in Mazer Live, AI persistent memory (user_memory), regional cookie consent, and your statutory rights under India’s Digital Personal Data Protection Act 2023 (DPDP Act), the EU GDPR, and California’s CCPA/CPRA.

Quick Overview

Below is a summary of our privacy practices. For full legal disclosures and technical specifications, please consult the complete Privacy Policy.

1. What Information We Collect

• Account Information: Name, email address, password hash, profile avatar, country, time zone, and language settings.
• Travel Preferences & Memory: Travel styles, dietary constraints, loyalty programs, budget ranges, and persistent preference vectors saved in user_memory to personalize future recommendations.
• Travel & Booking Data: Destination searches, dates, saved itineraries, e-tickets, and passenger details submitted when booking flights or hotel rooms via our integrated partner (LiteAPI).
• Payment Information: Billing name, billing address, and transaction references. We never store credit card numbers or CVV codes directly; transactions are processed by certified gateways (Razorpay in India, Polar globally).
• Multimodal & Voice Data: Travel photos, tickets, or landmark photos uploaded for AI analysis (transient session images expire in 2 hours), and audio streams during Mazer Live real-time voice sessions.
• Messaging Data: Telegram user IDs or WhatsApp telephone numbers when interacting with our official messaging bots.
• Device & Location: IP address, device telemetry, and session-based geolocation (used strictly with your permission for nearby recommendations and SOS emergency guides).

2. How We Use Your Information

• Provide personalized AI trip planning, day-by-day pacing, and real-time itinerary re-routing.
• Facilitate hotel and flight bookings through integrated supplier APIs (LiteAPI).
• Process subscriptions and compute top-ups via Razorpay and Polar.
• Sync travel plans with Google Calendar and auto-import booking confirmations from Gmail upon your explicit authorization.
• Enable collaborative group planning and expense splitting.
• Deliver offline emergency assistance, local hospital locators, and embassy information via SOS v3.
• Protect our platform against fraud, scraping, and adversarial attacks.

3. AI & Data Privacy Commitment

4. Who We Share Your Data With

• Travel Partners (LiteAPI & Airlines/Hotels): When you confirm a booking, passenger details are transmitted to issue your reservation.
• Payment Processors: Razorpay (domestic Indian INR) and Polar (international payments as Merchant of Record).
• Cloud Infrastructure: Supabase (AWS, PostgreSQL with Row Level Security), Fly.io (application servers), and Resend (transactional emails).
• Integration Middleware: Composio (secure OAuth gateway for Google, LinkedIn, and productivity tools).
• Law Enforcement & Regulatory Authorities: Strictly when compelled by valid legal court orders under Indian or applicable international law.

We never sell, rent, or trade your personal data to advertisers or data brokers.

5. Your Statutory Rights

Under the Indian Digital Personal Data Protection Act 2023 (DPDP Act), EU/UK GDPR, and California CCPA/CPRA, you have the right to:

• Access & Export: Download a full machine-readable JSON copy of your data anytime in Settings → Privacy & Data.
• Correction & Erasure: Rectify inaccurate details or permanently delete your account and associated AI memory.
• Withdraw Consent: Revoke connected Google, LinkedIn, or messaging accounts with instant effect.
• Grievance Redressal: Submit inquiries or complaints directly to our designated Grievance Redressal Officer at grievance@tripmazer.com.

6. Security & Data Isolation

All data in transit is protected using TLS 1.3 encryption. Database access is strictly governed by PostgreSQL Row Level Security (RLS) ensuring that only you have access to your personal trips, documents, and memory vectors.

7. Regional Cookie Consent

Essential cookies keep you securely authenticated. In the European Union, UK, EEA, and Switzerland, analytics cookies operate strictly on an opt-in basis. In other regions, analytics are enabled by default with immediate opt-out available. You can change your preferences at any time by clicking “Cookie settings” in the website footer.

8. Children’s Privacy Protection

TripMazer is intended for users aged 18 and older. Under Section 9 of the Indian DPDP Act 2023, we do not knowingly process personal data of minors without verified parental consent. If an account is created by a minor under 18, it will be promptly removed upon notice.

9. Third-Party Integrations (Composio)

TripMazer connects to third-party platforms (Google Calendar, Gmail, LinkedIn, Splitwise) via Composio to execute only the tasks you explicitly authorize. Public writes or bookings require an additional confirmation gate.

10. Google API Services User Data Policy (Calendar & Gmail)

TripMazer’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

TripMazer accesses Google user data only when you explicitly connect your Google account via OAuth:

• Google Calendar (calendar.events): Used solely to create, update, or remove calendar entries matching itinerary items generated within the platform.
• Gmail Integration (Restricted Scopes: gmail.readonly, gmail.compose): Used solely to parse incoming travel bookings (flights, hotels), resolve PDF attachments, and compose itinerary emails you direct the agent to send.

TripMazer strictly affirms that we:

• Never use Google user data for advertising or marketing.
• Never sell Google user data to third parties.
• Never allow human reading of Google user data without your express affirmative consent.
• Never use Google user data to train artificial intelligence or machine learning models.

11. Contact Information & Grievance Officer

For any questions or data requests, contact our team:

Want to read the full legal text?