Privacy policy

What we collect

From operators: business name, owner and staff names, email address, phone number and password (stored only as a secure hash).

From travellers who book through an operator's page: name, phone number, email, the details the operator asks for (such as age or emergency contact), ID documents if the operator asks for them, and payment status.

Why we use it

To run the service: to show bookings to the operator, send booking and payment updates, and let the operator contact their travellers. We do not sell personal data or use it for advertising.

Traveller details belong to the operator the traveller booked with. The operator decides how they are used; we store and process them on the operator's behalf.

Who else sees it

Only the services needed to run TourDesk: cloud hosting (Oracle Cloud and Cloudflare), the operator's own payment gateway when a traveller pays online (PhonePe or Razorpay, which handle card and UPI details themselves; we never see or store them), and Google Sheets if the operator turns on the sheet backup.

We may share data if the law requires it.

How we keep it safe

Data is sent over HTTPS. Payment keys are stored encrypted. ID documents are not public and can only be opened by the operator's account. The app keeps you logged in with a token saved in your browser; we use no advertising or tracking cookies.

How long we keep it

Until the operator deletes it or closes their account. Travellers can ask the operator, or us, to correct or delete their details.