Privacy policy

Last updated 15 September 2026

TripOps ("we", "us") is subscription software for travel agencies — a WhatsApp CRM, lead qualification, quotations, bookings and the tools around them — operated by Kataria Kreations. This policy explains what personal data we handle, why, who helps us handle it, and what you can do about it.

Two different roles, and the difference matters.

For the agency that subscribes to TripOps — its staff accounts, billing details and business information — we are the data fiduciary and this policy governs that relationship directly.

For the travellers an agency talks to through TripOps, the agency is the data fiduciary and we are its data processor. We handle traveller data only on that agency’s instructions. If you are a traveller asking about your own data, contact the travel agency you dealt with; we will support them in answering you.

1. What we collect

From an agency and its staff

Account details: name, work email address, password (stored only as a bcrypt hash).
Agency profile: trading name, address, contact details, GST and PAN identifiers.
Subscription details: your plan, the number of agents, any add-on you take, invoices and payment records.
WhatsApp connection details: the WhatsApp Business Account and phone number identifiers you provide or authorise, and the access credentials needed to act on that account.
Usage and security records: sign-in times, IP address, browser user agent, an audit log of changes made in the platform, and counts of the AI features used against your plan’s monthly allowances.

Traveller data, processed on an agency’s behalf

WhatsApp messages exchanged between the agency and the traveller, including media the traveller sends, and the WhatsApp profile name and phone number.
Enquiry details the traveller provides: destination, travel dates, number of travellers, budget, preferences and any notes.
Quotations, itineraries and bookings the agency prepares for the traveller.
Documents an agency uploads against a booking, which may include identity or travel documents.

2. Why we use it

To provide the service: deliver messages, build itineraries and quotations, maintain the agency’s pipeline, bookings and records.
To run the AI features the agency uses (section 4).
To secure accounts — authentication, rate limiting, and detecting abuse.
To run the subscription: count included usage against the plan, bill for it, and meet accounting and tax obligations.
To provide support, when an agency asks us to look at something.

We do not sell personal data, we do not use one agency’s data to serve another, and we do not use traveller conversations for advertising.

3. WhatsApp and Meta

TripOps connects to WhatsApp through the WhatsApp Business Platform provided by Meta. Where an agency authorises us, we send and receive messages and manage message templates on that agency’s own WhatsApp Business Account. Message delivery is performed by Meta, and Meta processes that traffic under its own terms and privacy policy. Your agency’s WhatsApp usage is billed to your agency by Meta directly.

4. The AI features

The Lead Qualifier, the Briefer and the Itinerary Generator use an AI model (Google’s Gemini API) to read the conversation or content in front of them and produce a reply, a summary, a suggestion or a draft. For each task we send only what that task needs — for example, the recent messages of one chat and the enquiry details already captured. An agency can switch the Lead Qualifier off in its settings.

5. Who else processes data for us

We use a small number of service providers (sub-processors). Each one receives only what it needs for the purpose shown.

Processor	Purpose
Meta Platforms (WhatsApp Cloud API)	WhatsApp message delivery and account management
Google (Gemini API)	The AI features: assisted replies, qualification, summaries and drafts
Our hosting provider	Servers, database storage and encrypted backups
Email provider	Transactional email: verification, password reset, notifications
Payment gateway	Subscription payments, once billing is enabled

Some of these providers operate outside India, so data may be processed abroad. We share only what a provider needs for its stated purpose.

6. How long we keep it

Agency and traveller records: for as long as the agency’s account is active.
After an account closes: deleted within 30 days of a deletion request, except where we are required to keep records — invoices and tax records are retained for the period Indian law requires.
Security and audit logs: up to 12 months.
Backups: encrypted, and overwritten on a rolling cycle. Data already deleted from the live system is removed from backups as that cycle turns.

How to ask for deletion, and what is removed, is set out on the data deletion page.

7. How we protect it

Traffic is encrypted in transit (HTTPS).
Passwords are stored only as bcrypt hashes; session tokens are stored only as hashes and can be revoked.
WhatsApp access credentials are held encrypted and are reachable only by platform administrators, never by other agencies.
Each agency’s records are scoped to that agency, and access is logged.

No system is perfectly secure. If a breach affects your data we will notify you and the relevant authority as required by law.

8. Your rights

Under India’s Digital Personal Data Protection Act, 2023 you may ask us to:

confirm what personal data we hold about you and obtain a copy;
correct or complete inaccurate data;
erase data we no longer need — see data deletion;
nominate someone to exercise these rights if you cannot;
withdraw consent where we relied on it, and complain if you are unhappy with our response.

Write to hello@tripops.in. We respond within 30 days.

9. Children

TripOps is a tool for businesses and is not directed at children. We do not knowingly create accounts for anyone under 18.

10. Changes

If we change this policy we will update the date above and, for material changes, tell account holders by email.

11. Contact

Kataria Kreations
Email: hello@tripops.in

Grievance officer
Email: hello@tripops.in