1. Who we are

TripMiles is a flight booking platform operated by Innopay Technologies Pvt Ltd, a company incorporated in India with its registered office at #460, 17th cross, 4th Sector, CS Towers, 3rd Floor, HSR Layout, Bangalore, Karnataka - 560102, India. References to “we”, “us”, or “our” in this policy mean Innopay Technologies Pvt Ltd operating the TripMiles brand. References to “you” mean the individual using our website or apps.

2. Information we collect

To fulfil a flight booking and comply with civil-aviation and tax rules, we collect:

• Account information — your name, email address, and mobile number, verified via OTP.
• Passenger information — for each traveller you book: title, given and family names as printed on government ID, date of birth, gender, and (for international travel) passport number, expiry date, issuing country, and nationality.
• Contact information — the contact email and mobile number that receive booking confirmations, e-tickets, and reminders.
• GST information (optional, business travellers) — company name, GSTIN, address, and contact used to generate a B2B tax invoice.
• PAN and KYC information — required only when you top up your TripMiles wallet at or above the KYC threshold. Verified against government records through a third-party PAN verification service.
• Payment information — we do not store card numbers or UPI credentials ourselves; those are entered on the payment gateway’s hosted page. We do record the transaction id, method, amount, and settlement status returned by the gateway.
• Device and usage data — IP address, browser type, device model, pages visited, and interaction timestamps, collected via cookies and server logs for security, fraud prevention, and analytics.

3. How we use your information

• To search, price, book, and ticket flights on your behalf with airline and GDS partners.
• To issue tax invoices and comply with Indian GST reporting obligations.
• To verify identity for wallet top-ups above the KYC threshold, in line with RBI Rule 114B.
• To send you booking confirmations, e-tickets, itinerary changes, cancellation notices, and refund status updates via email and WhatsApp.
• To respond to your support requests, cancel or amend bookings, and process refunds.
• To detect and prevent fraud, chargeback abuse, and unauthorised access to your account.
• To improve our product — measure page performance, catch errors, and understand how features are used in aggregate.

We do not use your personal data for advertising outside our own platform, and we do not sell your data to third parties for marketing.

4. Sharing with third parties

We share only the minimum information necessary to complete your booking or comply with law:

• Airline and GDS partners (including Travel Boutique Online / TBO) — passenger name, DOB, gender, contact, and passport details required to issue the ticket.
• Payment gateways — order id, amount, and return URL. Card and UPI credentials are collected directly by the gateway, not by us.
• KYC verification providers — PAN number and full name, sent solely to match against government records for wallet KYC.
• Communication providers — email and WhatsApp providers to deliver transactional notifications.
• Regulators and law enforcement — where compelled by valid legal process (court orders, statutory demand, tax authority requests).

5. Data retention

Booking records, tax invoices, and payment ledgers are retained for at least eight financial years as required under the Indian Income Tax Act and GST rules. Account information is retained for as long as your account is active; if you request deletion we will anonymise or remove data not otherwise required by law. Communication logs (email, WhatsApp) are kept for up to 24 months for support and reconciliation.

6. Your rights

Under the Digital Personal Data Protection Act, 2023, you may:

• Access and review the personal data we hold about you.
• Correct information that is inaccurate or out of date.
• Withdraw a consent you previously gave (for example, opting out of promotional messages).
• Request deletion of your account, subject to statutory retention obligations.
• Nominate another individual to exercise these rights on your behalf in the event of your incapacity or death.

Write to us at support@tripmiles.com and we will respond within 30 days.

7. Cookies and tracking

We use session and preference cookies to keep you signed in, remember your last flight search, and preserve the state of a booking as you move through the passenger, add-ons, and payment steps. We also use error and performance tracking to catch issues before they impact you. You can clear or block cookies at any time in your browser settings, but essential cookies are required for the booking flow to work.

8. Security

Data is transmitted over TLS. Sensitive fields such as PAN are stored using encryption at rest and never exposed in logs. Payment gateway integrations are handled server-to-server; we never see your full card number or your UPI PIN. Access to production data is limited to authorised staff and logged. Despite our controls, no system is perfectly secure — if you suspect any compromise of your account, please contact us immediately.

9. Children

TripMiles accounts may only be created by individuals who are 18 years of age or older. Child and infant passengers can of course be booked under an adult’s account; details of minor travellers are collected only for the purpose of ticketing and are not used for any other purpose.

10. Changes to this policy

We may update this policy from time to time to reflect changes in law, new features, or improvements to how we handle data. When we do, we will update the “Last updated” date at the top of this page and, for material changes, notify you via email or an in-app banner.

11. Contact us

For any question, request, or grievance about this policy or your data, please write to us: