Back to Home
Document key: privacy-policy-v2 · Current version: 2.0.0 · Effective 2026-05-28

Privacy Policy

Document key: privacy_policy_v2 Version: 2.0.0 Effective date: 2026-05-28 Supersedes: privacy-policy-v1 (2025 revision)

This Privacy Policy explains how Simple AI Solutions Private Limited ("Prayana", "we", "us") collects, uses, shares, and protects personal data when you ("you", "Data Principal") use the Prayana platform. We are the Data Fiduciary for the personal data described here under the Digital Personal Data Protection Act, 2023 ("DPDP Act").

1. Personal data we collect

1.1 Account data

Name, mobile, email, password hash, federated-login identifiers, profile photo.

1.2 KYC and identity-vault data

PAN, Aadhaar (DigiLocker-verified for KYC), passport, driving licence — collected only for the verticals where law requires (eSIM, transport, overseas packages).

1.3 Traveller data

Names, ages, gender, nationality, passport number, dietary and medical notes, emergency contact — supplied by you for each traveller on a booking.

1.4 Transactional data

Bookings, payment method tokens (not the full card number — tokenised by Razorpay / Stripe), invoices, refunds, chargebacks, communication transcripts.

1.5 Device and usage data

IP address, device identifiers, browser type, OS, push-notification tokens, session logs, geolocation (only when you grant permission), in-app event analytics.

1.6 User-generated content

Reviews, photos, questions, answers, community posts.

1.7 Sensitive categories

We collect medical conditions and dietary restrictions only when you supply them on the booking form for safety reasons. We do not collect financial account credentials, biometric data, or sexual-orientation data.

2. Purposes (DPDP s.6 — specified, lawful purposes)

We use your personal data to:

  1. operate your account and process your bookings;
  2. share booking details with the relevant Partner so they can deliver the Service;
  3. process payments, refunds, and chargebacks;
  4. comply with KYC, GST, TCS, motor-vehicle, and other statutory obligations;
  5. provide AI-assisted itinerary planning;
  6. send transactional communication (booking confirmations, reminders, refund notices) over email, SMS, WhatsApp;
  7. send marketing communication where you have consented (you can withdraw at any time);
  8. detect, prevent, and investigate fraud, abuse, and security incidents;
  9. improve the Platform via aggregated analytics;
  10. enforce our terms and defend legal claims.

3. Lawful basis

3.1 For consent-based processing (marketing, optional features), we rely on your consent under s.6(1) of the DPDP Act. You can withdraw consent at any time in Settings → Privacy.

3.2 For legitimate uses (s.7 DPDP), we rely on:

  • s.7(a) voluntary provision (you sharing booking data to make a booking);
  • s.7(b) state-function exceptions (KYC handover where law requires);
  • s.7(g) compliance with judgments or orders.

4. Sharing

We share personal data with:

  • Partners — for the Services you book (name, contact, traveller details);
  • Payment processors — Razorpay (India), Stripe (international);
  • Communication processors — Twilio, MSG91, Resend, Gupshup (WhatsApp);
  • Infrastructure processors — AWS (Mumbai region for storage), Google Cloud (limited analytics), Cloudflare;
  • Tax, audit, and regulatory authorities — where law requires;
  • Successor entity — on merger, acquisition, or restructuring.

We do not sell your personal data.

5. Cross-border transfers

5.1 Most personal data is stored in AWS Mumbai (ap-south-1). Some processors (Stripe, Gupshup, Google Cloud) may process data outside India. We rely on contractual safeguards and the Central Government's notified list under s.16 of the DPDP Act.

5.2 KYC documents (PAN, Aadhaar, passport, driving licence) are stored in the Prayana Identity Vault in AWS Mumbai and never leave India.

6. Retention (DPDP s.8(7))

| Category | Retention | |---|---| | Account data | Lifetime of account + 24 months | | Booking & invoice data | 8 years (Income-tax Act + CGST Act) | | KYC documents | 5 years post account closure (PMLA / KYC Master Directions) | | Transport GPS logs | 90 days for chauffeur, 36 months for self-drive (insurance / accident) | | Marketing logs | Until consent withdrawn | | Analytics (de-identified) | Indefinite |

After the retention period, data is erased or irreversibly anonymised.

7. Your DPDP rights (s.11–14)

You have the right to:

  • Access — copy of your personal data we process;
  • Correction & erasure — fix inaccurate data; delete data beyond legal retention;
  • Withdraw consent — for any consent-based processing;
  • Grievance — first level is our Grievance Officer (Section 11 below);
  • Nominate — a person to exercise your rights in the event of incapacity or death.

Submit requests via Settings → Privacy → "Submit data request" or by email to the Grievance Officer. We respond within 30 days.

8. Children

8.1 The Platform is not for users under 18. We do not knowingly collect personal data of children other than as a traveller on a parent's booking.

8.2 Where a child is added as a traveller, the booking adult warrants they are the parent or lawful guardian and consents on the child's behalf as required by DPDP s.9. We do not track children, do not target advertising to children, and do not display behavioural ads to children.

REVIEW: counsel required before launch — DPDP s.9 verifiable parental consent mechanism for child traveller fields.

9. Security (DPDP s.8(5))

We implement reasonable security safeguards:

  • TLS 1.2+ in transit, AES-256 at rest;
  • AWS KMS-managed keys for the Identity Vault, audited via CloudTrail;
  • least-privilege role-based access;
  • WAF, rate-limiting, anomaly detection;
  • annual VAPT, quarterly access reviews;
  • mandatory MFA for all internal accounts handling personal data.

10. Breach notification (DPDP s.8(6))

In the event of a personal-data breach likely to result in harm, we notify the Data Protection Board of India and affected Data Principals as required by the DPDP Rules. We log every breach internally with root-cause analysis.

11. Grievance Officer / Data Protection Officer

  • Grievance Officer (DPDP s.10): simpleaisolutions@prayanaai.com
  • Acknowledgement: within 48 hours; resolution: within 30 days.
  • Escalation: Data Protection Board of India (once functional under DPDP).

REVIEW: counsel required before launch — name a natural-person DPO once hired; assess Significant Data Fiduciary status (s.10 DPDP) based on volume, sensitivity, and cross-border-transfer profile.

12. Cookies

See the Cookie Policy.

13. Changes

We will give at least 14 days' notice before any material change. The current version is always at /legal/privacy-policy-v2 (or its successor).

14. Contact

Simple AI Solutions Private Limited Email: simpleaisolutions@prayanaai.com

Last updated: 2026-05-28. DRAFT for internal legal review.