Privacy Policy
Last updated October 2026
What we collect, why we collect it, who sees it, and how to get it removed.
What we collect
Account data: your name, email address, phone number and a securely hashed password. We never store passwords in a readable form.
Booking data: the trip and departure chosen, the number of travellers, the names and identity document numbers of the people travelling, and a contact number for the trip.
Operator data: business details plus the CNIC and registration documents submitted for verification.
Why we use it
To create and manage your account, to pass your booking to the operator running the trip, to send transactional email such as booking updates and password resets, and to keep the marketplace free of fraudulent accounts.
Who we share it with
The operator you book with sees the traveller names, identity document numbers and contact number needed to run the trip. Their phone number is revealed to you only after they accept your booking.
We use a transactional email provider to deliver account and booking email, and infrastructure providers to host the application and database. We do not sell personal data to anyone.
Verification documents
CNIC scans and business registration documents submitted by operators are used only to verify identity, and are accessible to the operator who uploaded them and to our review team.
They are never shown on the public marketplace.
Cookies
We use a small number of first-party cookies and local-storage entries to keep you signed in, remember your compare tray and wishlist, and remember that you dismissed the cookie notice. We do not run third-party advertising trackers.
See our Cookie policy for the detail.
How long we keep it
Account and booking records are kept while your account is open and for a reasonable period afterwards, so that financial and dispute records survive. Verification documents are kept while the operator account is active.
You can ask us to delete an account that has no outstanding bookings.
Your rights
You can access and correct your profile details from your account settings. You can also ask us for a copy of your data, or ask us to delete it, by emailing us.
Security
Passwords are hashed with Argon2, sessions use signed JSON Web Tokens, and the admin console is restricted to accounts with the admin role.
No service can promise perfect security, but if we ever suffer a breach affecting your personal data we will tell you what was affected and what to do.
Contact
Privacy questions and data requests: [email protected].