Privacy notice

1. Who we are

Tavora is a trip planning and booking service run by RailRoute (railroute.in). For the personal data described here, we are the “Data Fiduciary” under India's Digital Personal Data Protection Act, 2023 (the “DPDP Act”): we decide why and how it is used.

Contact for anything in this notice: info@railroute.in or WhatsApp +91 83699 27133. Our Grievance Officer is Dhruv Shah, Founder and Grievance Officer (hello@railroute.in, +91 83699 27133).

2. What we collect, and why

Here is every kind of personal data we hold, what it is for, and where it comes from.

We don't collect ID numbers (Aadhaar, PAN, passport), copies of ID documents, or financial details such as card numbers. We don't make decisions about you by automated means, and we don't build marketing profiles.

The full list of which supplier receives which traveller detail is on Traveller details: who gets what.

3. The legal basis we rely on

• Your consent, which you give when you create an account, request a trip, or enter traveller details for a booking. You can withdraw it at any time (see your rights). Withdrawing doesn't undo what was lawfully done before, and if bookings are already made we may still need some details to complete or cancel them.
• Legitimate uses allowed by section 7 of the DPDP Act, such as using details you have given us voluntarily for the booking you asked for, and keeping records that tax and other laws require.

4. Children

Accounts are only for people aged 18 or over. We don't offer anything aimed at children, and we never track children's behaviour or show them advertising.

Children often travel with their families, and railways, airlines and hotels need their name, age and gender too. The DPDP Act requires a parent's or lawful guardian's verifiable consent before we process a child's data. So:

• when an organiser adds a traveller under 18, they must confirm that they are the child's parent or lawful guardian, or that they have the parent's or guardian's permission;
• if the organiser is not the parent or guardian, we contact the parent or guardian directly (by email or WhatsApp) and ask them to confirm before we book anything for the child;
• we use a child's details only to book their travel and stay, and keep them only as long as the booking records require.

5. Service providers who handle data for us

These companies process personal data on our behalf, only to provide their service to us and under contract:

Neon

Database hosting (servers in Singapore). Stores accounts, trips, traveller details and booking records.

Railway

Hosting for this website and its servers (Singapore). Handles every request, including server logs.

Maileroo

Sends our emails (sign-in, password resets, trip updates). We switch off open and click tracking.

Google

Sign-in, only if you choose “Continue with Google”. Google shares your name, email address and profile picture with us.

Razorpay

Takes payments and sends refunds, once online payment is switched on. Razorpay handles your card, UPI or bank details; we never see or store them.

OpenRouter and Sarvam AI

Turn a sentence you type in the “tell us” box into trip filters. Only that text is sent, and we don’t store it. Please don’t type personal details there.

WhatsApp (Meta)

If you message us on WhatsApp, the chat is carried by WhatsApp under its own privacy policy.

Suppliers you book through us (railways, bus operators, airlines, hotels, cab operators and local partners) receive the traveller details they need for your booking and handle them under their own policies. See who gets what.

Maps and photos. Trip maps load map tiles from OpenFreeMap, and many destination photos load from Wikimedia Commons. Your browser fetches these directly, so those services see your IP address and browser type, as any website you visit would. We don't send them anything about you.

We do not sell personal data, and we don't share it with anyone for their own marketing. We disclose data to authorities only when the law requires it.

6. Data stored outside India

Our database and servers are in Singapore, and some service providers above (Google, OpenRouter, Maileroo) may process data in other countries, including the United States. The DPDP Act allows this, except to countries the Government of India restricts by notification. If a country we use is ever restricted, we will move that processing.

7. How long we keep it

Your account

Until you delete it or ask us to. If an account has had no sign-in and no trip for 3 years, we email you and delete it 48 hours later unless you sign in.

Trips you didn't book

Saved and requested trips that were never paid for are deleted 2 years after the trip date, or earlier with your account.

Booking and payment records

Invoices and the booking records behind them, including travellers' names, are kept for 72 months from the due date of the GST annual return for that financial year (about 8 years), as section 36 of the CGST Act, 2017 requires. Then they are deleted.

Sign-in and server logs

Sign-in sessions expire after 60 days. Records of access to personal data are kept for 1 year, as the DPDP Rules, 2025 require, then deleted.

Messages with us

3 years after your last trip or message, unless a complaint or dispute is open.

Partner applications

For as long as the partner is listed; rejected applications are deleted after 1 year.

If you ask us to delete your data, we delete everything that the law does not require us to keep within 30 days, and keep the rest only until its period above ends.

8. Cookies and storage on your device

We use only what the site needs to work:

• Sign-in cookies, set when you sign in, so you stay signed in. They are essential and expire after 60 days or when you sign out.
• Your browser's local storage remembers the places you shortlist. These stay on your device; we never receive them.

We don't use advertising cookies, analytics cookies or third-party trackers, so there is nothing to opt out of. If that ever changes, we will ask first.

9. Keeping it safe

Data is encrypted in transit and stored by providers that encrypt it at rest. Passwords are stored only as one-way hashes. Access to customer data is limited to the people who plan and book trips, and we keep records of that access.

No system is perfectly secure. If a personal data breach happens, we will tell the people affected without delay, in plain language, with what happened and what they can do, and report it to the Data Protection Board of India within the time the DPDP Rules set (72 hours for the detailed report).

10. Your rights

Under the DPDP Act, you can:

• access: get a summary of the personal data we hold about you, what we do with it, and who we have shared it with;
• correct and update: fix anything inaccurate or incomplete;
• erase: ask us to delete data we no longer need, or withdraw your consent;
• nominate: name someone who can exercise these rights for you if you die or become unable to;
• raise a grievance with us, and if you aren't satisfied with our answer, complain to the Data Protection Board of India, set up under the DPDP Act.

Travellers whose details an organiser gave us have the same rights and can contact us directly. To use any right, write to info@railroute.in from the email on your account (or tell us how to verify you). We reply as soon as we can and within 90 days at the latest, which is the longest the DPDP Rules allow.

11. Changes to this notice

If we change this notice in a way that matters, such as a new purpose or a new kind of data, we update the date at the top and email people with an account before the change applies. Where the law requires fresh consent, we ask for it.