Privacy Policy

Maarga is owned and operated by ThriveForm Ventures LLP (LLPIN ACZ-4572), registered office E/84, North Bombay CHS Ltd, Juhu Road, Santacruz West, Juhu, Mumbai, Maharashtra 400049, India. This Privacy Policy explains how Maarga collects, uses, shares, protects, and retains personal information when you use the Maarga application, website, pilgrimage planning and booking services, customer support, or related features.

We may collect information you provide, including your name, email address, phone number, account credentials, nationality, emergency contact, traveller details, booking preferences, support messages, reviews, and information needed to arrange requested services. If you request accessibility, dietary, medical, or mobility assistance, we collect the details you choose to provide so we can evaluate and coordinate that request. For bookings, we may process identity-document details or files when required by a provider or authority.

We may collect device and application information, IP address, language, operating system, app version, crash and diagnostic data, security events, feature usage, and approximate interaction timestamps. With your permission, location may be used to select a pickup point, show relevant services, or support an active journey. You can withdraw device permissions through system settings. We do not use advertising analytics or sell personal information.

We rely on a defined set of processors and infrastructure providers, each receiving only the information reasonably needed for their function:

• Razorpay - payment processing (card, UPI, bank, and wallet transactions);
• Google - Sign-In (authentication), Firebase Cloud Messaging (push notifications), and Crashlytics (crash and diagnostic reporting);
• Resend - transactional email delivery;
• Twilio and MSG91 - SMS and messaging delivery;
• Cloudinary - secure media and document storage;
• Railway - application hosting;
• Neon (PostgreSQL) - primary database hosting;
• OpenAI - optional AI-assisted features, used only where you engage them.

Where a provider processes personal data on our behalf, it does so under contractual obligations to protect that data and use it only for the agreed purpose.

Some optional features use OpenAI to help plan or personalise journeys. Content sent to OpenAI is not used to train its models by default, and OpenAI may retain that content for up to 30 days for abuse monitoring before deletion, subject to its terms. You are not required to use AI-assisted features.

We use personal information to create and secure accounts; authenticate users; provide, personalise, and manage bookings; coordinate transport, accommodation, temple visits, meals, guides, accessibility, and support; process and reconcile payments; send confirmations and service messages; prevent fraud and abuse; maintain safety and audit records; improve reliability and user experience; comply with law; and respond to rights requests or disputes.

We send transactional and service communications needed for accounts and bookings, including verification, security, payment, itinerary, and service updates; these are essential and may be sent while an account or booking is active. Marketing communications are sent only on an opt-in basis and can be withdrawn at any time using the available controls. Security-essential messages are always sent. You may withdraw consent for optional processing, but withdrawal does not affect earlier lawful processing and may limit features that depend on that information.

We share only the information reasonably needed with the service providers listed in Section 4 and with the temple, transport, accommodation, guide, meal, and assistance providers involved in your booking. We may also share information with authorities or professional advisers when required by law, needed to protect safety or rights, or connected with a lawful business restructuring. We do not sell personal information.

Some service and infrastructure providers may process information in locations outside India, so cross-border transfers may occur. Where required, we use appropriate contractual or legal safeguards. Third-party services remain governed by their own privacy practices in addition to the obligations they owe Maarga.

We keep information only for as long as reasonably necessary for the purposes described here and to meet legal obligations. Retention periods vary by record type:

• Temporary processing artefacts: up to 24 hours;
• Uploaded booking-bound documents: deleted 30 days after the trip ends;
• Booking operational records: retained 7 years;
• Payment and refund records: retained 8 years;
• Support conversations: retained 2 years after resolution;
• Notification records: retained 24 months;
• Consent history: retained for the account lifetime plus 7 years;
• Audit and security logs: retained 7 years;
• Backups: retained on a rolling 35-day cycle, subject to external provider schedules and any legal holds.

When information is no longer required, we delete, anonymise, or securely restrict it. Operational and financial records may be anonymised rather than deleted where they must be retained.

You may request account deletion in the app. Deletion follows a 30-day grace period during which the request can be cancelled, after which personal identifiers are removed and finance-linked records are anonymised and retained only for the periods described in Section 10. Records that must lawfully be retained are not removed by account deletion.

We use administrative, technical, and organisational safeguards designed to protect information, including access controls, encryption in transit, secure credential storage, audit logging, and restricted document access. Crash and diagnostic data collected through Crashlytics is retained for 90 days. No system is completely secure. Protect your password and tell us at maarga010@gmail.com if you suspect unauthorised access.

Depending on applicable law, you may request access to or correction of personal information, ask for deletion, withdraw consent, manage communications and device permissions, or raise a grievance. Some requests may require identity verification, and lawful exceptions may apply. Account and profile controls are available in the app where supported; other requests can be sent to maarga010@gmail.com.

Maarga accounts and bookings are for adults aged 18 or over. A parent, guardian, or authorised adult may provide details for a minor travelling as part of a booking and must have authority to do so. Contact us if you believe a minor's information was submitted without appropriate permission.

Maarga may use automated rules to detect security risks, prevent duplicate or fraudulent activity, or prioritise support. We do not rely solely on automated processing to make decisions producing significant legal effects unless permitted by law and accompanied by appropriate safeguards.

We may update this Policy when Services, technology, or legal requirements change. The latest version and effective date will be available through the app. We will provide additional notice or request consent when required.

For privacy questions, rights requests, or complaints, contact our grievance officer: Sabaa Kashmiri, +91 9667803366, maarga010@gmail.com. Include enough detail for us to identify your account and understand the request, but do not send passwords or unnecessary sensitive documents by email.