Privacy Policy

Last updated: 21 August 2026

This policy explains what data SafarOS collects, why it collects it, where it is kept, who it is shared with, and what control you have over it. It is written to align with India's Digital Personal Data Protection Act, 2023 (DPDP Act).

1. Two kinds of data — the difference matters

SafarOS is B2B software used by travel businesses. That means there are two separate things here, each with a different responsibility attached:

Your data (you = the subscribing travel company). Your name, business name, email, mobile, billing details and login records. For this, we are the Data Fiduciary.
Your customers’ data. The leads, bookings, passenger details and payments you enter into SafarOS. For this, you are the Data Fiduciary and we are only the Data Processor — we hold and process that data on your instructions, and never use it for our own purposes.

2. What we collect

Account and billing

Name, company name, email address, mobile number
Subscription plan, billing cycle, payment history
Login records — when a user signed in, and the browser user-agent

What you enter into the CRM

Lead and customer records: name, mobile, email, city, enquiry details
Booking and trip records, passenger lists, itineraries
Payments, receipts, invoices, quotations, expenses
Staff records, attendance, targets
Documents and images that you upload

Technical

A session cookie — HttpOnly and signed. It only records that you are logged in.
Basic usage logs — how much each feature was used (for plan limits)

We do not run advertising tracking, third-party ad pixels or cross-site profiling. The cookie exists purely for your session.

3. Why we collect it (purpose)

To run the service — the work you subscribed for
To manage billing and subscriptions
To provide support when you ask for it
Security — login history, and detecting suspicious activity
To meet legal obligations (GST records and similar)

4. Which services your data reaches

Running SafarOS requires a few external services. Each has a specific purpose, and only the data needed for that purpose is sent:

Supabase — database hosting. All application data lives here.
Vercel — application hosting and delivery.
Razorpay — subscription payments. Card and UPI details go directly to Razorpay; we never see or store them.
Cloudinary — the images and documents you upload.
Google (Gemini) and Groq — AI features. When you use the AI Copilot or itinerary generator, only the text of that request reaches these providers. If you do not use AI features, nothing is sent.
WhatsApp and SMTP email — sending notifications. On WhatsApp you connect your own number.

None of these sell or use your data for their own purposes. We do not sell your data or your customers’ data to anyone.

5. Where the data lives

The application is served from the Mumbai (India) region. The database and some service providers (Supabase, Cloudinary, AI providers) process on their own infrastructure, which may sit outside India. This is permitted under the DPDP Act, and each provider carries its own security commitments.

6. How long we keep it

While the subscription is active — all data.
When the account is closed — you receive a full export. After that there is a 30-day grace period, then the data is deleted.
Deleted records — held in the Recycle Bin for 30 days, then permanently deleted.
Billing and GST records — for as many years as Indian tax law requires (typically 8 years).
Login history — the most recent 500 records.

7. Security

Passwords are stored as salted scrypt hashes — never in plain text.
Session cookies are HttpOnly, signed (HMAC), and Secure in production.
The entire site runs over HTTPS with HSTS.
Each company’s data is kept separate in the database.
Repeated wrong passwords lock the account for a short period.
Daily backups.

No system is ever 100% secure. If something looks wrong, tell us straight away on +91 76006 75522.

8. Your rights (DPDP Act, 2023)

Access — the right to see your data and export it to Excel. This is already built into the CRM.
Correction — the right to have incorrect data fixed.
Erasure — the right to have data deleted, except records the law requires us to keep.
Grievance redressal — the right to raise a complaint (below).
Nomination — the right to nominate someone to exercise these rights in the event of your death or incapacity.

To exercise these rights, contact the Grievance Officer listed below.

9. Children

SafarOS is a business tool and is not intended for anyone under 18. We do not knowingly collect children’s data. If you enter details of your customers’ children (in a passenger list, for example), obtaining the necessary consent for them is your responsibility.

10. Grievance Officer

For complaints under the DPDP Act:

Name: Harsh Bhavsar
Email: safarostech@gmail.com
WhatsApp: +91 76006 75522
Address: C-102, Titanium City Center Corporate Office, Satellite, Ahmedabad, Gujarat 380015

We aim to respond within 30 days.

11. Changes to this policy

If anything changes, this page is updated and the “Last updated” date above changes with it. For a significant change, we will let you know on your registered email.