Privacy

• Account details: name, email, phone and password (stored only as a one-way hash).
• Booking details: traveller names, dates of birth, nationality, contact details, and passport details where the supplier requires them. Passport numbers are encrypted at rest and masked on screen.
• Payments: the amount, status and reference of each payment. Card numbers are entered with our payment provider and are not stored by DataUdaan.
• Travel-service applications: the details and documents you upload for a visa, labour permit, international driving licence, insurance policy, tour or charter request (for example passport copies, photos, employment or licence documents).
• Support: your support requests, the messages and the files you attach to them.
• Security records: sign-in attempts and the IP address and browser they came from, kept to protect accounts.

To search and book with suppliers, issue tickets, vouchers and invoices, process payments and refunds, answer support requests, send booking and support notifications, and protect accounts against misuse. Traveller details are sent to the airline, hotel or bus operator that provides your booking, because they need them to provide it.

• Usage events: a random installation identifier, the app version and a short list of actions (for example “search started”, “booking confirmed”) are sent to DataUdaan's own servers to understand how the app is used. No names, emails, passport or card details are included, and no third-party analytics or advertising SDK is used.
• Notifications: if you allow notifications, a push token for your device is stored with your account so we can tell you about bookings and support replies.
• Camera and photos: used only when you choose to photograph or attach a document. Nothing is read from your library otherwise.
• Biometric unlock: Face ID or fingerprint checks happen on your device; DataUdaan never receives biometric data.
• Crash reports: when crash reporting is switched on, technical details of a crash (device model, app version, the error) are sent to our crash-reporting provider without personal identifiers.

The airline, hotel, bus operator, tour partner, insurer, licensed charter operator or the authority (or its authorised partner) that provides or decides the service you ask for; our payment provider, which processes card payments; and the providers that deliver our email, notifications and hosting. We do not sell personal data and do not share it for advertising.

Your account data is kept while you have an account. Bookings, payments and invoices are kept as long as accounting and tax law requires. Flight search records are deleted after 30 days unless they led to a booking, and request logs after 90 days. Documents attached to a travel-service application stay with that application; you can ask us to delete them once it is finished.

Access is limited by role. Support staff see the booking information needed to answer a request; only authorised staff can process refunds. Internal notes on support requests are not shown to customers. Sensitive actions (refunds, credential access, account changes) are recorded in an audit log.

We keep your sign-in session, your language and your light / dark preference in your browser's storage, and a booking access code in this tab's session storage after you open a booking without an account. We do not use advertising trackers. All traffic to DataUdaan is encrypted in transit (HTTPS).

You can update your profile and saved travellers in your account, and delete your account yourself in the app or on the website (how account deletion works). To ask for a copy of your data, or for anything else about your privacy, contact us through the help centre. Records we must keep for bookings, payments and tax are kept as long as the law requires.