This policy explains how SimpleItinerary Travel Planning Services (“Starfish”, “we”, “us”), Gurugram, Haryana, handles your personal data when you use gostarfish.in, our Android app, WhatsApp, email or Instagram. We process personal data in line with India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000.
1. What we collect
- Details you give us — your name, mobile number, email (optional), and trip details such as destination, dates, number of travellers, budget, interests and any notes you write.
- Booking details — if you book with us: passport details, date of birth, photographs and documents needed for visas, tickets and hotels. We collect these only when a booking requires them.
- Data kept on your own device — the website and app save your last planner entries and document-checklist progress in your browser's local storage so you don't have to retype them. This stays on your device; you can clear it anytime from your browser settings.
- Technical data — our hosting provider (Netlify) records standard server logs such as IP address, browser type and pages requested, for security and reliability. We do not use advertising cookies or tracking pixels at present.
2. Why we use it
- To respond to your enquiry and send you the itinerary, quote or information you asked for.
- To plan and book your trip — flights, hotels, transfers, tours, insurance and visa assistance.
- To contact you on WhatsApp, phone or email about your trip.
- To meet legal obligations such as tax, GST/TCS and record-keeping.
We process your data on the basis of your consent, which you give by ticking the consent box when you submit a form, and for the legitimate purpose of completing a booking you request. We do not sell your personal data.
3. Who we share it with
- Service providers who help us run the service: Netlify (website hosting and form storage), Google (Google Sheets for managing enquiries; Google Gemini to generate AI itineraries), and Meta/WhatsApp when you message us. Your name, phone number and email are never sent to the AI — only trip preferences such as destination, dates and interests.
- Travel suppliers — airlines, hotels, transport and tour operators, insurers, and visa centres or embassies — only when needed to complete your booking.
- Authorities — when required by law.
Some of these providers store data outside India. We use reputable providers with appropriate safeguards and transfer data only as permitted under the DPDP Act.
4. How long we keep it
Enquiry data is kept for up to 24 months from your last interaction, then deleted. Booking and invoice records are kept for as long as the law requires (for example, under tax laws). Passport and visa documents are deleted once your trip is completed, unless you ask us to keep them for a future booking.
5. Your rights
Under the DPDP Act you can:
- ask for a summary of the personal data we hold about you and how we use it;
- ask us to correct, complete or update it;
- withdraw your consent and ask us to erase your data (unless we must keep it by law);
- nominate another person to exercise your rights in case of death or incapacity;
- raise a grievance with us, and if unresolved, with the Data Protection Board of India.
To use any of these rights, write to us at the address below. Withdrawing consent is as easy as giving it — just reply "STOP" on WhatsApp or email us.
6. Security
We use HTTPS across the site, restrict access to enquiry data to our team, and use providers with strong security practices. No system is perfectly secure, but we will notify you and the authorities as required if a breach affects your data.
7. Children
Our services are meant for adults. If you are under 18, please ask a parent or guardian to contact us on your behalf. We collect children's details (for example, for a family booking) only from their parent or guardian.
8. Grievance officer & contact
Grievance Officer, SimpleItinerary Travel Planning Services
Gurugram, Haryana 122002, India
Email: wearesimpleitinerary@gmail.com
WhatsApp / phone: +91 91931 24952
We aim to acknowledge requests within 48 hours and resolve them within 30 days.
9. Changes
We may update this policy from time to time. The "last updated" date at the top shows the latest version.