Privacy

TripSetu is software that a travel company runs its own business on. That means personal information reaches us by three routes, and your rights differ by which one you are.

• A visitor to this website. You may send us your name and number to ask for a demo. That is the whole of it.
• An operator: a travel company with an account, and the staff it gives logins to. Your account details are ours to look after.
• Someone whose details sit inside an operator’s console: a passenger, a driver, a corporate contact. We have never met you and did not collect your details. The operator did, and it decides what happens to them. We hold them on that operator’s instructions and nothing more. If you want your details corrected or removed, ask the travel company, not us. We will help them do it.

From a website visitor, only what you type into the demo form: your name, phone number, and optionally your company, email, fleet size and a message. The form can hand off to WhatsApp or to email. If you use the WhatsApp button, the message goes through WhatsApp and their terms apply to it.

When a company signs up, we collect the company name, the city, and the name, email address and phone number of the person creating the account. Your password is handled by our authentication provider and is stored as a hash. We cannot see it, and neither can anyone at TripSetu.

Once an account is running, the console holds whatever that operator enters to run its business: customers and passengers, drivers and their licence and document details, vehicles and their papers, bookings, trip sheets, invoices, payments and expenses. We do not mine it, sell it, share it between tenants, or use it to train anything. One company can never see another’s rows: separation is enforced by the database, not by the screen.

Technically, our hosting provider keeps ordinary server logs (IP address, the page requested, timestamp, browser) for a short period, which is how any website is kept secure and debuggable.

The console sets one cookie, the one that keeps you signed in. It is necessary for the console to work at all; sign out and it goes. Nothing inside the console is sent to an analytics service.

On this website we use Google Analytics to learn which pages are read and how visitors found us, Google Analytics sets its own cookies (named _ga) and receives the page you viewed, how you arrived, your device and browser, and an approximate location. It never receives your name, number or anything you type into a form. There is no advertising pixel, and Google’s advertising features are switched off.

To opt out, you can use your browser’s settings to block cookies or the script, or Google’s opt-out browser add-on at tools.google.com/dlpage/gaoptout. Doing so changes nothing else about the site.

Three small things are stored in your own browser and never sent to us: your light or dark theme choice and, on the signup page, whatever Cloudflare’s bot check needs to tell a person from a script.

• To provide the service you have asked for, which is the whole of what the console data is used for.
• To reply to you, if you asked us to.
• To send the mail the product must send: the welcome and confirmation mail at signup, and anything about your account or billing. There is no marketing mail, because we do not send any.
• To keep the service secure and working: spotting abuse, keeping backups, fixing faults.
• To learn which pages of this website are useful, through Google Analytics.
• To meet legal and tax obligations on our own invoices to you.

We use a small number of well-known services to run TripSetu, and no others. We do not sell data, and we do not share it with advertisers or data brokers. There is no arrangement of that kind and there will not be one.

We will also disclose information if the law genuinely requires it: a valid order from a court or an authority entitled to make one. If that ever happens and we are permitted to tell you, we will.

Your data is stored in Singapore (AWS ap-southeast-1). We are an Indian product built for Indian operators and we would rather say that plainly than leave you to guess: the database region is Singapore, not India. It is encrypted in transit, and access is restricted to the small number of people who maintain the service.

Inside the database, the console’s tables have row-level security switched on with no policies and no direct client access at all. Every read and write goes through a named function that checks who is asking and which company they belong to. That is a deliberate design choice and it is the main reason one operator cannot reach another’s data.

• Console data: for as long as the account is open. Close your account and ask us to delete it, and we will, within 30 days, except anything we must keep for tax or legal reasons, such as our own invoices to you.
• Demo enquiries: kept while we are in contact and for a reasonable period after, so we know we have already spoken.
• Backups: rolled off on the provider’s ordinary cycle. A deleted record can survive in a backup briefly before it ages out.
• Server logs: a short retention period, as set by our hosting provider.
• Analytics: Google Analytics keeps website visit data for 2 months, the shortest period it offers.

Under India’s Digital Personal Data Protection Act, 2023, you can ask us what personal data of yours we hold, ask us to correct it if it is wrong, ask us to erase it where we are not required to keep it, and complain if you are unhappy with how we have handled it. You can also nominate someone to exercise these rights if you are unable to.

Write to hello@buildframe.tech and we will answer. If your details are inside a travel company’s console rather than held by us directly, we will pass your request to that company and help them action it. They decide, because it is their record.

You can also export your own console data to a spreadsheet at any time, without asking anyone.

TripSetu is business software and is not intended for anyone under 18. We do not knowingly collect a child’s personal data, and we would not have a reason to.

If we change this policy in a way that matters, we will say so on this page and, for anything significant, email account holders. The date at the top of the page is when it was last reviewed.

Questions, requests and complaints all go to the same place: hello@buildframe.tech. A person reads it.