Privacy Policy

fairtravels.ai is operated by Velocity Digital Labs. This Privacy Policy explains how we collect, use, share, and protect your personal information when you use our AI-powered travel planning and booking platform.

We operate in the United States (default) and India, and comply with the California Consumer Privacy Act (CCPA), applicable US state privacy laws, and the Digital Personal Data Protection Act, 2023 (DPDP Act) of India.

1. Information We Collect

Information you provide

• Account information: Name, email address, and password (stored securely using one-way hashing — we never store plaintext passwords)
• Profile information: Phone number (optional), travel preferences, and saved destinations
• Booking data: Travel dates, passenger details, itinerary selections, and booking history
• Payment information: Processed securely by Stripe (USA) or Razorpay (India). We do not store your credit card numbers, bank account details, or UPI IDs on our servers
• Communications: Messages you send to our support team or feedback you provide

Information collected automatically

• Usage data: Pages visited, search queries, features used, and interaction patterns
• Device data: Browser type, operating system, screen resolution, and language preference
• Location data: Country and general region (derived from IP address) to serve relevant currency, language, and travel content

2. How We Use Your Information

We use your personal information for the following purposes:

• Provide our services: Process bookings, generate AI-powered travel recommendations, and manage your account
• Personalization: Tailor search results, itinerary suggestions, and pricing to your preferences and location
• Payments: Facilitate secure payment processing through Stripe or Razorpay
• Communications: Send booking confirmations, travel updates, and respond to your support requests
• Improve the platform: Analyze usage patterns to enhance features, fix issues, and develop new services
• Security: Detect fraud, prevent abuse, and protect the integrity of our platform
• Legal compliance: Meet tax, regulatory, and legal obligations in applicable jurisdictions

We do not sell your personal data. We do not use your personal information for purposes unrelated to our travel services without your consent.

3. Third-Party Services

We share information with the following categories of service providers, only to the extent necessary to operate our platform:

• Payment processors: Stripe (USA) and Razorpay (India) process your payments. They receive payment details directly and are governed by their own privacy policies. We receive only transaction confirmation and limited card details (last four digits, expiry) for your records
• Travel suppliers: Airlines, hotels, and activity providers receive the traveler details necessary to fulfill your bookings (names, dates, contact information)
• Authentication: Google OAuth, if you choose to sign in with Google. We receive your name, email, and profile photo from Google
• AI services: Anthropic (Claude AI) powers our travel recommendations. Search queries and preferences are sent to generate personalized suggestions. No payment or identity data is sent to AI services
• Email delivery: Resend handles transactional emails (booking confirmations, password resets). They receive your email address and message content
• Analytics: justanalytics.app helps us understand how the platform is used. It collects anonymized usage data, error reports, and performance metrics
• Background processing: Inngest handles event-driven tasks such as booking status updates and notifications. It processes task metadata on our behalf

All third-party providers are contractually required to protect your data and use it only for the services they provide to us.

4. Cookies and Tracking

We use cookies and similar technologies for the following purposes:

• Essential cookies: Required for authentication, session management, and security. These cannot be disabled
• Preference cookies: Remember your language, currency, and display settings
• Analytics cookies: justanalytics.app tracking helps us understand page views, feature usage, and performance. This data is aggregated and does not identify you personally

We do not use advertising cookies or retargeting pixels. You can manage cookie preferences through your browser settings. Disabling essential cookies may prevent the platform from functioning correctly.

5. Data Security

We take the security of your data seriously and implement the following measures:

• All data transmitted between your browser and our servers is encrypted using TLS (HTTPS)
• Passwords are hashed using industry-standard one-way algorithms and are never stored in plaintext
• Payment information is handled entirely by PCI DSS-compliant processors (Stripe, Razorpay) and never touches our servers
• Access to personal data is restricted to authorized personnel on a need-to-know basis
• We conduct regular security reviews of our infrastructure and codebase

No system is 100% secure. If we become aware of a data breach affecting your personal information, we will notify you and the relevant authorities as required by law.

6. Data Retention

• Account data: Retained for as long as your account is active. If you delete your account, we remove your personal data within 30 days, except where retention is required by law
• Booking records: Retained for 7 years after the travel date to comply with tax and legal obligations
• Analytics data: Aggregated and anonymized usage data may be retained indefinitely for product improvement
• Support communications: Retained for 2 years after resolution to provide context for future inquiries

7. Your Rights

All users

• Access: Request a copy of the personal data we hold about you
• Correction: Update or correct inaccurate personal information
• Deletion: Request deletion of your account and associated personal data
• Opt-out: Unsubscribe from marketing communications at any time

US residents (CCPA and state privacy laws)

• Right to know what personal information we collect, use, and disclose
• Right to delete your personal information
• Right to non-discrimination for exercising your privacy rights
• We do not sell personal information and do not use it for targeted advertising

Indian residents (DPDP Act 2023)

• Right to access, correct, and erase your personal data
• Right to nominate another person to exercise your rights
• Right to grievance redressal — we will respond to complaints within 30 days
• We process your data based on consent and legitimate purposes as defined under the DPDP Act

To exercise any of these rights, email us at privacy@fairtravels.ai. We will verify your identity and respond within 30 days.

8. Children's Privacy

fairtravels.ai is not directed at children under the age of 18. We do not knowingly collect personal information from minors. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

9. International Data Transfers

Our servers are located in the United States. If you access our services from India or other countries, your data may be transferred to and processed in the United States. We ensure appropriate safeguards are in place for such transfers in compliance with applicable data protection laws.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the “Last updated” date. Continued use of the platform after changes constitutes acceptance of the revised policy.

11. Contact Us

For privacy-related questions, data requests, or complaints:

• Email: privacy@fairtravels.ai
• Company: Velocity Digital Labs

We aim to resolve all privacy inquiries within 30 days of receipt.