Privacy Policy

1. Who we are

Tratwo is a travel planning app run by J M Mehta Travel & Tour Co Pvt Ltd, No. 44, 2nd Floor, Oasis Industrial Complex, Nehru Road, Vakola, Santacruz East, Mumbai 400055 ("we", "us"). We decide why and how your personal data is used, so we are the data fiduciary for the data described here. This policy covers the Tratwo website and app at tratwo.com, our WhatsApp and Instagram channels, and the emails and messages we send you.

2. What we collect and why

We do not buy personal data about you from anyone.

3. Our basis for using your data

We use your data with your consent, which you give when you sign up, add information or switch on a feature, and where the law allows us to use it without consent, for example to provide a service you have asked for, to keep our systems secure, or to meet a legal duty such as keeping tax records. We tell you the purpose when we ask, and we use your data only for that purpose.

4. Who receives your data

We use the services below to run Tratwo. Each receives only what it needs for its job. Some of them store or process data outside India (see section 14).

These services are bound by their own terms and privacy policies. We do not sell your personal data. We share it with authorities only when the law requires it.

Sharing your details with suppliers to complete your booking. When you ask us to book a flight, a hotel, transport or a package that combines them, we have to give the airline, hotel or transport provider the details it needs to issue and deliver your booking. Depending on the service, that is your name exactly as on your passport or ID, date of birth, gender, nationality, passport or ID number and expiry, mobile number, email address, and any seat, meal, access or other request you gave us. Without this we cannot make the booking, so if you do not want us to share it, tell us before we book.

Each supplier then holds your details as a data fiduciary in its own right and uses them under its own privacy policy, for example to check you in, hold your room, or meet security and immigration rules. Some suppliers are outside India (see section 14). We cannot recall data once it has been given to a supplier, so withdrawing your consent later does not undo a booking already made, and the supplier may keep the data for as long as its policy and the law require. We share only what each supplier needs, and only for your booking.

5. Cookies and analytics

Tratwo uses cookies and similar technologies. Essential ones keep you signed in and keep the app secure. Analytics and marketing ones (PostHog, Google Analytics, Meta Pixel) help us understand how the app is used and measure our marketing.

You can block or clear cookies in your browser settings. If you block essential cookies, sign in will not work. You can opt out of Google Analytics with Google's browser add-on, and manage how Meta uses data for ads in your Meta ad settings.

6. AI features

Tratwo uses AI services to read what you save and to write itineraries and suggestions. AI output can be wrong, so check opening hours, visa rules, prices and safety before you rely on it.

We do not use your saved content, trip details or documents to train AI models. We send them to our AI providers only to produce your response, under their business terms. In future we may offer a setting called "Teach Tratwo your travel style". It will be off unless you turn it on, and you can turn it off at any time.

We may compute anonymous, combined insights about places (for example, how many travellers save a particular cafe) that cannot identify you.

7. Children

Tratwo is for adults. We do not knowingly create accounts for anyone under 18. If you think a child has made an account, write to us and we will close it.

A parent or legal guardian may add a child profile to plan a family trip. By doing so you confirm that you are the child's parent or legal guardian and you consent, on the child's behalf, to our handling the details you add. We use child details only to plan trips for your family. We do not track or monitor children's behaviour, do not profile children for advertising, and do not send marketing to children. You can view, correct or remove a child's profile at any time in Me, then Members.

8. Passports and documents

Passport and booking documents are sensitive. We collect them only if you add them, and only for the purposes in section 2. They are kept in private storage behind access controls and sent over encrypted connections. They are visible only to you and to the people you choose to share them with. Share links need a one time code and stop working after repeated wrong tries. You can delete any document at any time. We do not use documents for advertising.

9. Your consent and choices

You can withdraw consent at any time, as easily as you gave it, by deleting the data, switching a feature off, deleting your account, or writing to us. Withdrawing may stop some features from working. Data already used before you withdrew stays lawful.

If you give us your WhatsApp number or message us on WhatsApp, you agree that we may reply and send you alerts about your saves and trips there. You can stop WhatsApp alerts in the app or by telling us, and you can unsubscribe from marketing emails using the link in them.

10. Your rights

You can:

• see and export your data, in the app under Me, then Export my data;
• correct it, in the app or by writing to us;
• delete your account and data, in the app under Me, then Delete account;
• ask for a summary of what we hold and who we share it with;
• nominate someone to exercise these rights for you if you die or cannot act;
• complain to our Grievance Officer, and if we do not resolve it, to the Data Protection Board of India.

We reply to requests within 30 days. We may ask you to confirm who you are first.

11. How long we keep data

We keep your data while your account is active. When you delete your account we remove your personal data from our live systems promptly, and from backups as they expire in their normal cycle. We keep what the law requires us to keep, such as payment and tax records, for as long as tax and company law require, which can be up to 8 years. Security and error logs are kept for at least one year, as the data protection rules require, and analytics data only as long as it is useful, after which it is deleted or made anonymous. Anonymous combined insights are kept.

12. Security

We use encrypted connections, access controls, rate limits and regular security checks. No system is perfectly secure, so we cannot promise absolute security. If a breach affects your data we will tell you and the authorities as the law requires.

13. Grievance Officer and contact

Grievance Officer: Naveen Patkar, J M Mehta Travel & Tour Co Pvt Ltd, No. 44, 2nd Floor, Oasis Industrial Complex, Nehru Road, Vakola, Santacruz East, Mumbai 400055. Email naveen@jmmtravel.net. For privacy requests you can also write to hello@tratwo.com. We acknowledge complaints within 48 hours and resolve them within 30 days.

14. Transfers outside India

Some services in section 4, for example Anthropic, Google, Meta, PostHog and Sentry, process data outside India. We use our own service providers only for the purposes above and only with providers that protect the data under their own terms. Airlines, hotels and transport providers outside India also receive your traveller details when your trip needs them, and they handle those details under their own policies. We will follow any restriction on transfers to particular countries that the Indian government notifies.

15. Changes to this policy

If we change this policy in a way that matters, we will tell you in the app or by email before it applies, and we will update the date at the top.