How we handle
your data.

We collect the minimum personal information needed to book your flight or stay, keep it only as long as we have to, and never sell it. Razorpay handles your card; we never store it.

01 · Who is the Data Fiduciary?

The Data Fiduciary under § 2(i) of the Digital Personal Data Protection Act 2023 is NomadNudge Private Limited, CIN U63040HR2011PTC042985, with registered office at Unit 16A, 16B & 17A, Ground Floor, Tower B-3, Spaze Itech Park, Sector 49, Gurugram (Gurgaon), Haryana 122018, India. We determine the purposes and means of processing your personal data on this site and we are accountable to you for it.

02 · What we collect

We collect personal data in four categories. Each row below explains what we collect, why, and how long we keep it.

We do not collect biometric data, health data, financial data beyond what's listed above, or sensitive personal information as defined under § 3(36) of the DPDP Act, except where the airline or government regulation requires it for international travel (in which case we collect only what's required and share it with the airline / authority directly).

03 · Why we process it — lawful purposes

Under § 4 of the DPDP Act we process your personal data only for the specific purposes you have consented to, or for legitimate uses prescribed by law:

• Booking & ticketing — to make and manage your booking with the Operator (consent at the time of booking).
• Payment processing — to charge your card and reconcile the transaction (consent + Section 4(b) legitimate use).
• Customer support — to respond to your queries and grievances (consent).
• Fraud prevention — to detect and prevent fraudulent bookings (Section 4(b) legitimate use).
• Tax & statutory compliance — to issue tax invoices and retain records as required by the GST and Income Tax Acts (Section 4(b)).
• Service improvement — aggregated, anonymised analytics only. No individual profiling.

04 · Who we share it with

• Operators — the airline you are flying or the hotel you are staying at. We share the minimum needed to make the booking: passenger names, contact details, dates, payment confirmation. They are Data Fiduciaries in their own right.
• Razorpay Software Private Limited — our Payment Aggregator. Razorpay processes your card and is a Data Processor under § 8(6) of the DPDP Act in respect of payment data. Razorpay's privacy policy is at razorpay.com/privacy.
• Inventory & ticketing partners (GDS) — to retrieve fares and issue tickets. Names and travel details only.
• Law enforcement — only on receipt of a valid order under the Criminal Procedure Code or the Information Technology Act 2000.
• Auditors and tax authorities — booking records, on request, for compliance.

We do not sell personal data to advertisers, data brokers, or list-vendors. We do not run third-party ad-targeting cookies on the booking flow.

05 · Cross-border transfers

Operator and GDS partners process bookings on servers located in multiple jurisdictions. Cross-border transfers are made only to jurisdictions not restricted by the Central Government under § 16 of the DPDP Act, and in accordance with the Operator's own data-protection commitments. Razorpay's processing infrastructure is located within India.

06 · Your rights

Under Chapter III of the DPDP Act 2023 you have the right to:

• Access — request a summary of personal data we hold about you (§ 11).
• Correct, update, or erase — request that inaccurate data be corrected or that we erase data no longer needed (§ 12). We will retain data we are legally required to keep (tax, statutory records).
• Withdraw consent — at any time, with effect for future processing (§ 6(4)). Withdrawal does not affect lawfulness of past processing.
• Nominate — name a person who may exercise your rights in the event of your death or incapacity (§ 14).
• Grievance — file a complaint with our Grievance Officer (below) before approaching the Data Protection Board of India.

Where you are located in the EU/EEA or the UK, you also retain rights under the GDPR (data portability, restriction of processing, objection). Where you are located in California, you retain rights under the CCPA (right to know, right to delete, right to opt out of "sale" — although as noted we do not sell personal data).

07 · How we protect it

• TLS 1.2 or higher for every connection to the site (HSTS enforced, two-year preload).
• Card data tokenised by Razorpay in PCI-DSS Level 1 environment; never stored on our servers.
• Access to booking data on a need-to-know basis, with logged audit trail for support actions.
• Annual review of access permissions and removal of dormant accounts.
• Personal-data breach notification: in the event of a Personal Data Breach under § 8(6) of the DPDP Act, we will notify both the Data Protection Board and affected Data Principals as soon as practicable.

08 · Cookies & site storage

• Strictly necessary — session token for sign-in, trip-cart cookie. Required for the site to function.
• Functional — display preferences (currency, cabin class). Stored in your browser's localStorage; not sent to any third party.
• Analytics — server-side request logs only (Vercel access logs). No browser-side analytics, no Google Analytics, no Meta Pixel on the booking flow.

09 · Children's data

Bookings on this site require a user aged 18 or above. Where a booking includes a minor traveller, we collect that minor's name and date of birth solely for the airline / hotel booking, with the booking adult's consent under § 9 of the DPDP Act. We do not knowingly market to minors.

10 · Grievance Officer

Under Rule 5(9) of the IT Rules 2011 and § 8(9) of the DPDP Act 2023:

If our response is unsatisfactory, you may approach the Data Protection Board of India under § 28 of the DPDP Act.

11 · Updates to this policy

If we change this policy materially, we will post the revised version on this page at least 14 days before the change takes effect, and notify account-holders by email. The "Effective" date in the header reflects the current version.

12 · Reaching us