Privacy policy

Only what a booking cannot be made without:

• Your full name as printed in your passport, and the same for anyone travelling with you. The airline and the hotel put this on the reservation. It has to match your passport exactly or the booking is not usable for your application.
• Your email address. To send you the order confirmation and the completed documents, and to reply if we need to ask you something about the booking.
• Your phone number. So we can reach you quickly if something about your booking needs a decision before we can complete it.
• Your travel cities and dates. These are what we book. Without them there is nothing to reserve.

We do not ask for your passport number, your date of birth, or a scan of any document, because the booking does not need them. We never see your card details — payment goes through Razorpay.

One other party: our booking partner, who places and cancels the reservations. They receive the traveller names and the travel cities and dates, because the booking cannot be made without them. They act only on our instructions, under a written agreement, and only for that purpose.

We do not give them your email address or your phone number, and we do not share any of it with anyone else. We do not sell data, we run no advertising trackers, and the site loads nothing from a third party — including our emails, which contain no tracking pixel.

• Personal details: erased 180 days after your order is delivered or cancelled. That means the passport names, your email address, your phone number and the documents themselves.
• We email you at least 48 hours before we erase anything, so you can download a copy first if you want one. If that email does not reach you, nothing is erased.
• Access and audit logs: one year at minimum. The DPDP Rules require us to keep a record of who accessed personal data and when. Those logs identify staff and systems, not you — they reference your order by its number.
• Payment records: as long as the law requires. The amount, the date and the gateway's reference. These do not contain your passport name.

Encrypted while we hold it. Every passport name, email address and phone number is encrypted before it is written down, with a key held outside the database. Someone with a copy of the database and nothing else cannot read any of it.

The documents too. Your booking confirmations are stored encrypted, outside the public part of the server, and can only be fetched through a link that checks who is asking.

Every access is logged. Each time a member of staff or a scheduled job reads personal data, a record is written that cannot afterwards be edited or deleted. We review it.

It is not in our logs or our error reports. Personal values are stripped before anything is written to a log file.

You can ask us to:

• give you a copy of everything we hold about you,
• correct anything that is wrong,
• erase it,
• act on instructions from someone you nominate to exercise these rights for you.

How to make a request — or email hello@visareserve.com from the address on your order. We aim to respond within 7 days.

You can withdraw your consent at any time, as easily as you gave it. If you withdraw before we have made the booking, we refund you in full. If you withdraw after, we cannot undo a reservation already made in your name, but we will erase everything we hold.

Our grievance officer is Nirmal Singh, reachable at grievance@visareserve.com. You can also raise a grievance here and we will give you a reference. Either way we respond within 7 days.

If we do not, you can complain to the Data Protection Board of India. You can do that directly — you do not have to come through us first, and you do not need our permission.