Privacy Policy

1. Introduction & Who We Are

TripMazer Pvt Ltd. (registered in India) is the primary data controller for the TripMazer Services. Our registered office is: Koramangala, Bangalore, Karnataka 560095, India. This Policy covers the personal data we collect when you access tripmazer.com, use our mobile apps, or interact with our customer support, marketing, or partner integrations. Where we act as a joint controller with a travel partner (for example, when you complete a booking with a third party through our platform), we will provide specific notice about the controller relationship.

Our Terms of Service govern your use of the Services and are available at /legal/terms. This Privacy Policy explains how we process personal data in connection with providing the Services.

2. Personal Data We Collect

We collect and process different categories of personal data depending on how you use TripMazer. The following list summarizes the principal categories we handle:

2.1 Account & contact data

Data you provide when creating an account: full name, email address, phone number (optional), password (stored as a hash), country, time zone, and preferred language. We use this data to create and manage your account and to communicate with you.

2.2 Profile & preference data

Travel preferences and profile details such as travel style (luxury, budget), preferred airlines and hotel chains, saved destinations, dietary and accessibility preferences, budget ranges, and interests. These help us personalize recommendations and itineraries.

2.3 Booking-related data

Itinerary details you create or save on TripMazer: destinations, dates, passenger names, seat preferences, loyalty numbers, reservation IDs, special requests, and related notes. When you elect to book a flight, hotel, activity, or transfer through our partners, the partner may collect additional booking information as controller of the booking transaction.

2.4 Payment & subscription data

Billing name, billing address, invoice details, subscription plan type (Basic, Pro, Business), and transaction references. We do not store full credit card numbers or CVV codes. Payment card processing is handled by certified payment processors (e.g., Stripe, Razorpay) who are independent controllers or processors and who comply with PCI-DSS standards. We receive tokens or transaction IDs from those processors to manage billing and refunds.

2.5 Communication data

Messages you send to us (support tickets, in-app messages, survey responses), and records of our communications with you. We retain these to respond to your requests and improve our support.

2.6 AI interaction data

Prompts, conversation history, AI outputs, and related metadata when you use TripMazer's AI features (chat, itinerary generation, recommendation queries). This data is used to generate outputs and to maintain session context.

2.7 Device & usage data

Automatically-collected technical data such as IP address (used to determine approximate location, such as city/region), device type, operating system/version, browser, app version, pages/features used, clickstream events, timestamps, and diagnostic logs. This data powers analytics, monitoring, and security features.

2.8 Cookies & tracking technologies

We use cookies, local storage, and similar technologies to keep you signed in, remember your preferences, measure usage, and, with your consent, measure our campaigns. See Section 8 for more detail, including where analytics needs your consent first.

3. How We Use Your Personal Data

We use personal data for the core functions of the Services and related purposes. Where applicable, we indicate the typical legal basis for processing under GDPR-like frameworks.

• Provide and operate the Service — creating accounts, generating itineraries, powering AI chat and recommendation features, saving trips, enabling group collaboration and completing bookings (Legal basis: performance of contract / necessary for service delivery).
• Personalization & recommendations — tailoring suggestions and showing relevant offers based on your preferences and past trips (Legal basis: legitimate interests; consent where required).
• Payments & billing — processing subscription fees, issuing invoices, and handling refunds and chargebacks (Legal basis: performance of contract; legal obligation).
• Communications — transactional emails (bookings, receipts), security alerts, and customer support communications (Legal basis: performance of contract; legitimate interests).
• Marketing — newsletters, promotional offers, and remarketing where you have provided consent or where permitted by law (Legal basis: consent or legitimate interests).
• Analytics & product improvement — A/B tests, aggregated analytics, and diagnostics to improve performance and features. Google user data obtained through OAuth integrations is not used for analytics or product improvement (Legal basis: legitimate interests; cookie consent where applicable).
• Security, fraud prevention & compliance — detecting and preventing abuse, complying with legal obligations, and enforcing our Terms (Legal basis: legitimate interests; legal obligations).

3.10 LinkedIn connected account

If you connect LinkedIn, TripMazer uses Composio to request only the LinkedIn permissions you approve and to perform the profile, page, analytics, audience-planning, publishing, commenting, or deletion action you explicitly request. Mazer does not use LinkedIn OAuth tokens, profile data, post content, or media to train general-purpose AI models. Public writes require a separate exact-payload confirmation.

TripMazer temporarily caches bounded LinkedIn identity, organization, and post references for up to 30 minutes so follow-up requests such as “the second post” can resolve safely. Operational logs contain request IDs, hashed account and LinkedIn identifiers, provider status, rate-limit metadata, and verified receipt flags—not OAuth tokens, signed upload URLs, raw profiles, or post copy. Disconnecting revokes the Composio connection and removes this cached follow-up context and provider circuit state. Generated documents you chose to keep and minimal write receipts used to prevent duplicate publishing remain until you delete them or your account, subject to legal and security obligations.

4. How We Share Personal Data

We do not sell your personal information in exchange for money. We share data with third parties only when necessary to provide the Services, comply with law, or with your consent. Categories of recipients include:

4.1 Service providers & processors

Cloud hosting and infrastructure, analytics providers, email delivery platforms, customer support systems, identity verification providers, and payment processors. These parties act as processors or independent controllers and are contractually obliged to protect your data.

4.2 Travel partners & booking providers

When you instruct TripMazer to complete a booking, we share necessary booking information with the airline, hotel, OTA, tour operator, or payment partner you select. Those partners become independent controllers for the booking record and have their own privacy policies.

4.3 AI technology providers

We work with cloud AI infrastructure and specialized AI vendors to generate model outputs. These vendors process the data we provide to them, strictly under contractual terms that limit use and forbid their use of identifiable TripMazer user data to train their external general-purpose models.

4.4 Business partners & co-marketing

Aggregated, non-identifying usage data may be shared with tourism boards, travel brands, or co-marketing partners. If identifiable data is needed for a joint offer or referral, we will request your consent before sharing.

4.5 Legal requirements & protection

We may disclose data to law enforcement, courts, or regulators where required by law or necessary to protect our rights, safety, or property. We also share data with professional advisors (lawyers, auditors) under confidentiality obligations.

4.6 Corporate transactions

If we undergo a merger, acquisition, or sale of assets, personal data may be transferred as part of the transaction. We will notify you of material changes to how your data is processed in such events.

5. International Data Transfers

TripMazer operates globally and your data may be transferred and processed outside your country of residence, including to countries without equivalent data protection laws. We implement appropriate safeguards such as Standard Contractual Clauses (SCCs), reliance on adequacy decisions, or other legal transfer mechanisms where required.

If you would like more detail about specific transfer mechanisms used for your data, please contact privacy@tripmazer.com and we will provide available safeguards.

6. Retention of Personal Data

We retain personal data only as long as necessary for the purposes described in this Policy and to comply with legal, tax, or accounting requirements. Typical retention periods include:

• Account data: retained while your account is active; basic records retained up to 12 months after deletion for disputes and audits
• Booking & reservation data: retained for the booking lifecycle and up to 5 years for regulatory and visa purposes
• Payment records: retained for up to 7 years to meet tax and accounting obligations
• AI interaction logs: retained up to 2 years for quality and support unless deleted earlier
• Device & usage logs: retained up to 90 days and then aggregated/anonymized for analytics
• Redacted LinkedIn integration diagnostics: retained up to 30 days; short-lived follow-up context expires after 30 minutes

When you request deletion of your account, we will delete or anonymize your personal data within 30 days except where we are required to retain it for legal or security reasons. Backup copies may persist for a limited time but are not used for business purposes.

7. Your Rights and Choices

Depending on your jurisdiction, you may have rights to access, correct, delete, restrict, or port your personal data, or to object to certain processing. California residents have additional rights under CCPA/CPRA, including the right to know categories of data collected and to opt out of sales/sharing. We do not sell personal information. We describe key rights below and how to exercise them.

How to exercise your rights

To exercise any rights, contact us at privacy@tripmazer.com or dpo@tripmazer.com for GDPR-related inquiries. We will verify your identity and respond within applicable timeframes (typically 30 days for GDPR requests and 45 days for CCPA requests, subject to permitted extensions).

GDPR-style rights

• Access: request a copy of personal data we hold about you
• Correction: update inaccurate or incomplete data
• Erasure: request deletion in certain circumstances
• Restriction and objection: limit or object to specific processing (e.g., profiling for marketing)
• Data portability: receive data in a machine-readable format

California (CCPA/CPRA) rights

• Right to know categories and specific personal information collected and disclosed
• Right to delete personal information (with exemptions)
• Right to opt out of the sale or sharing of personal information — TripMazer does not sell personal information
• Right to non-discrimination for exercising privacy choices

8. Cookies and Similar Technologies

We use cookies and similar browser storage in three ways:

• Essential and preferences — always on. Keep you signed in, protect your account, and remember choices you make, such as theme and currency.
• Analytics. Google Analytics shows us which pages and planning tools are used. In the European Union, the European Economic Area, the United Kingdom and Switzerland, analytics cookies are set only after you accept them. Elsewhere, analytics cookies are on by default and you can reject them at any time.
• Marketing — only with your consent, everywhere. Measures our advertising campaigns and partner travel deals.

Whenever analytics cookies are off, because you rejected them or have not yet chosen where consent is required, Google Analytics sets no cookies and sends only anonymous, cookieless signals, which Google uses to estimate overall traffic.

We decide which rule applies from your device's time zone and treat any European time zone as requiring consent. You can change your choice at any time through Cookie settings in the site footer, Settings > Privacy & Data when signed in, or your browser settings.

9. Children's Privacy

TripMazer is not intended for children under 16. We do not knowingly collect personal information from children under 16. If you become aware that a child has provided personal data without parental consent, please contact us so we can remove the information.

10. Security

We implement reasonable technical and organizational measures to protect personal data, including TLS/SSL encryption for data in transit, strong encryption for data at rest, role-based access controls, regular security training, and incident response processes. While we strive to protect data, no security measure is impenetrable, and we cannot guarantee absolute security.

11. AI Generated Content and Privacy Risks

Our AI features can provide helpful itinerary ideas, local guidance, and conversational assistance. Be cautious about sharing sensitive information (passport numbers, bank account or credit card numbers, medical records) in free-text prompts. Users are responsible for any sensitive data they provide in chats or uploads. AI outputs may be imperfect — always verify critical information before relying on it.

12. Third Party Sites and Services

The Services integrate with third-party booking engines, payment processors, identity and social login providers, and other services. These third parties have their own privacy policies and, when you use them, their processing practices apply. We are not responsible for the privacy practices of external sites; review their policies before providing personal information.

TripMazer integrates with Google Calendar to allow users to export itinerary items as calendar events. Google user data is used only to provide the Google Calendar export functionality requested by the user. For full details on how we handle Google user data, see Section 14 below.

13. Region Specific Disclosures

13.1 European Union & United Kingdom

For residents of the EEA and UK, TripMazer is the data controller. Processing is based on legal bases including consent, contract performance, legal obligations, and legitimate interests as described above. Contact our DPO at dpo@tripmazer.com for data protection inquiries or to exercise your rights.

13.2 California (CCPA/CPRA)

California residents may request details about categories of personal information collected, disclosed, or sold, and may request deletion of personal information subject to certain exceptions. TripMazer does not sell personal information as defined by CCPA. To submit a CCPA request, contact privacy@tripmazer.com.

13.3 Other jurisdictions

If you reside in another jurisdiction with specific privacy laws (Canada, Australia, Singapore, etc.), please contact us to discuss applicable rights and transfer mechanisms.

14. Google API Services User Data Policy

Trip Mazer's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Trip Mazer accesses Google user data only when a user explicitly connects their Google account and grants permission through Google OAuth.

For the Google Calendar integration, Trip Mazer uses the https://www.googleapis.com/auth/calendar.events scope solely to create, update, or delete calendar events that correspond to itinerary items generated by the user within the application.

Google user data obtained through this integration is used exclusively to provide and operate this feature.

Trip Mazer does not:

• Use Google user data for advertising purposes
• Sell Google user data to third parties
• Use Google user data for profiling or marketing
• Use Google user data to train artificial intelligence or machine learning models

Access to Google user data is limited to what is necessary to provide the user-requested functionality within Trip Mazer.

15. Changes to This Privacy Policy

We may update this Policy to reflect changes to our services or legal requirements. Material changes will be communicated by email or prominent notice at least 30 days before they take effect. The "Last updated" date at the top indicates when this Policy was last revised.

16. Contact Us

For questions about this Privacy Policy or to exercise your rights, contact us: