Privacy Policy

FareEagle ("we," "us," "our") operates the website www.fareeagle.com, the Aira AI travel assistant, the FareEagle Telegram bot, and related services (collectively, the "Services"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use any of our Services.

By using our Services, you consent to the practices described in this policy. If you do not agree, please discontinue use of our Services.

1. Information We Collect

1.1 Information You Provide Directly

Category	Details
Account Information	Full name, email address, phone number, hashed password
Booking Information	Passenger names, dates of birth, gender, nationality, passport number and expiry (for international flights), travel dates, route preferences
Payment Information	Transaction IDs, payment method type, billing address. We do not store full credit/debit card numbers, CVV, or bank account details on our servers. Payment processing is handled by third-party payment gateways.
Traveler Profiles	Saved traveler details (name, DOB, passport info) that you store in your account for faster booking
Communication	Support tickets, email correspondence, chat messages with Aira AI, Telegram bot conversations
Agency Information	Business name, GSTIN, PAN, bank details (for agency partners only), agency registration documents

1.2 Information Collected Automatically

Category	Details
Device & Browser Data	Browser type, operating system, screen resolution, device type, IP address
Usage Data	Pages visited, search queries, flights/hotels/buses viewed, booking activity, click patterns, session duration, referring URLs
Location Data	Approximate location derived from IP address (city-level). We do not access GPS or precise location.
Cookies & Tracking	Session cookies, preference cookies, analytics cookies. See Section 7 for details.

1.3 Information from Third-Party Services

• Firebase Authentication: If you use phone-based OTP login, Firebase provides us with your verified phone number.
• Airlines & Hotel Suppliers: Booking confirmation details, PNR status updates, cancellation charge information.
• Payment Gateways: Transaction status, payment confirmation, and refund status.

2. How We Use Your Information

2.1 Core Service Delivery

• Process and manage your flight, hotel, and bus bookings
• Send booking confirmations, e-tickets, hotel vouchers, and trip guide PDFs via email
• Send booking alerts and travel reminders via SMS and email
• Process cancellations, modifications, and refunds
• Generate and deliver Trip Guide PDFs with destination-specific travel information

2.2 Aira AI Travel Assistant

• Process your natural language travel queries to provide personalized destination recommendations and trip plans
• Your conversations with Aira are processed using a third-party AI service. Conversation content is sent to the provider's servers for processing. No personal booking data is included in AI prompts.
• We cache AI-generated travel content (destination descriptions, itineraries) to improve response speed. These caches do not contain personal information.
• Aira does not store personal data from conversations beyond the active session. Your queries are not used to train AI models.

2.3 Telegram & WhatsApp Bot

• If you interact with our Telegram bot, we receive your Telegram user ID, display name, and message content to process your travel queries
• Bot conversation data is stored temporarily (30 minutes) to maintain session context, then automatically deleted
• We do not access your Telegram contacts, groups, or any data beyond what you directly send to our bot

2.4 Communication & Marketing

• Send promotional offers, fare alerts, price drop notifications, and newsletters (you can opt out at any time)
• Respond to customer support inquiries
• Send check-in reminders before your travel date

2.5 Analytics & Improvement

• Analyze booking patterns, search trends, and user behavior to improve our platform
• Conduct fare data analysis to offer competitive pricing
• Monitor platform performance and fix technical issues
• We use analytics tools for website performance monitoring. These collect anonymized usage data such as pages visited, session duration, and device info.

2.6 Security & Fraud Prevention

• Detect and prevent fraudulent bookings, unauthorized access, and abuse
• IP-based rate limiting and fraud scoring
• Verify identity through OTP-based authentication
• Monitor for suspicious booking patterns

3. Information Sharing & Disclosure

We share your information only when necessary to provide our Services or as required by law:

Recipient	What We Share	Purpose
Airlines & Travel Suppliers	Passenger names, DOB, passport details, contact info	Issue tickets and manage bookings
Hotels	Guest names, contact info, check-in/check-out dates	Confirm hotel reservations
Bus Operators	Passenger names, contact info, boarding point	Issue bus tickets
Payment Processors	Transaction amount, order ID	Process payments and refunds
AI Service Providers	Conversation text (no personal booking data included)	Power AI travel assistant features
Analytics Providers	Anonymized usage data, device info	Website performance monitoring
Communication Providers	Email address, phone number	Deliver booking confirmations and notifications

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

3.1 Legal Disclosure

We may disclose your information if required by law, regulation, legal process, or governmental request, including to comply with the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023 (DPDP Act), or any court order.

4. Data Security

We implement multiple layers of security to protect your data:

• Encryption in transit: All data transmission is encrypted using SSL/TLS (HTTPS). Our website enforces HTTPS across all pages.
• Password security: User passwords are hashed using bcrypt (one-way encryption). We cannot see or retrieve your password.
• OTP authentication: Phone-bound, single-use OTPs with 5-minute expiry and cryptographic verification.
• CSRF protection: All forms and state-changing requests are protected against cross-site request forgery.
• XSS prevention: User inputs are sanitized and escaped to prevent cross-site scripting attacks.
• Server firewall: CSF (ConfigServer Security & Firewall) protects our dedicated server infrastructure.
• Access control: Personal data access is restricted to authorized personnel on a need-to-know basis.
• Fraud detection: Automated fraud scoring system monitors bookings for suspicious patterns.

While we implement industry-standard security measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security but are committed to protecting your data to the best of our ability.

5. Data Retention

Data Type	Retention Period	Reason
Account information	Until you delete your account	Service delivery
Booking records	7 years after travel date	Legal, tax, and accounting compliance
Payment transaction records	7 years	Financial audit and regulatory compliance
Support tickets	3 years after resolution	Service quality and dispute resolution
Aira AI conversation data	Active session only (not persisted)	Provide contextual AI responses
Telegram bot session data	30 minutes after last interaction	Maintain conversation context
Analytics data	14 months	Usage analysis and improvement
Server logs	90 days	Security monitoring and debugging
AI content cache	7 days	Performance optimization (no personal data)

You may request deletion of your account and personal data at any time (see Section 8). Booking records required for legal compliance will be retained in anonymized form after account deletion.

6. International Data Transfers

Your data may be processed outside India in the following cases:

• AI processing: Aira AI queries are processed by our AI provider's servers.
• Analytics: Analytics data is processed on our provider's global infrastructure.
• International bookings: Passenger data is shared with international airlines and hotels as required to complete your booking.

When your data is transferred internationally, we ensure that appropriate safeguards are in place in accordance with the Digital Personal Data Protection Act, 2023.

7. Cookies & Tracking Technologies

7.1 Cookies We Use

Cookie Type	Purpose	Duration
Essential / Session	Login session management, CSRF tokens, booking session data	Session (cleared on browser close)
Functional	Remember your search preferences, recent searches, currency settings	30 days
Analytics	Understand user behavior — pages visited, session duration, traffic sources. Data is anonymized.	Up to 14 months

7.2 Managing Cookies

You can control cookies through your browser settings. Most browsers allow you to block or delete cookies. However, disabling essential cookies will prevent you from logging in or completing bookings.

We do not use advertising cookies or retargeting pixels. FareEagle does not display third-party advertisements.

8. Your Rights Under the DPDP Act, 2023

Under India's Digital Personal Data Protection Act, 2023, you have the following rights as a Data Principal:

• Right to Access: Request a summary of your personal data processed by us and the processing activities undertaken.
• Right to Correction: Request correction of inaccurate or incomplete personal data. You can update most information directly in your profile settings.
• Right to Erasure: Request deletion of your personal data when it is no longer needed for the purpose it was collected, subject to legal retention requirements.
• Right to Grievance Redressal: Lodge a complaint with our Grievance Officer (see Section 13) or with the Data Protection Board of India.
• Right to Nominate: Nominate another individual to exercise your rights in the event of your death or incapacity.

To exercise any of these rights, contact us at support@fareeagle.com. We will respond within 30 days.

9. Children's Privacy

FareEagle services are not directed at children under the age of 18. We do not knowingly collect personal data from children without verifiable parental or guardian consent. When booking flights for minor passengers (children aged 2–11, infants under 2), the booking must be made by a parent or legal guardian who provides the child's details.

If we learn that we have collected personal data from a child under 18 without parental consent, we will take steps to delete that information promptly.

10. Agency Partners

If you register as a travel agency partner on FareEagle, we additionally collect and process:

• Business registration documents, GSTIN, PAN
• Bank account details for wallet withdrawals
• Agent booking history and commission records

This information is used solely for agency account management, commission processing, and regulatory compliance. Agency data is subject to the same security protections as individual user data.

11. Price Alerts & Fare Monitoring

If you set up price alerts, we store your route preferences, target prices, and email/phone to send notifications when fares match your criteria. You can deactivate price alerts at any time from your account dashboard or by clicking the unsubscribe link in any alert email.

Fare monitoring data (search patterns, historical prices) is aggregated and anonymized for our internal analytics. Individual search behavior is not shared with airlines or any third party.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Notify registered users via email for significant changes
• Post a notice on our homepage for at least 7 days

Continued use of our Services after changes are posted constitutes your acceptance of the revised policy.

13. Grievance Officer & Contact

In accordance with the Information Technology Act, 2000 and the DPDP Act, 2023, the details of our Grievance Officer are:

Grievance Officer: Lohit Tummalapenta
Email: support@fareeagle.com
Phone: +91 85329 28532
Address: Guntur Vari Thota 2nd Lane, Guntur, Andhra Pradesh 522001, India
Response time: Within 30 days of receiving your complaint

If you are not satisfied with our response, you may lodge a complaint with the Data Protection Board of India once it is constituted under the DPDP Act, 2023.