Privacy Policy

• Operators (tour, trek and homestay businesses): BookMingo decides how your account data is used, so we are responsible for it.
• Travellers: when you book, you share your details with the operator you’re booking with. The operator decides what to collect and is responsible for it; BookMingo stores and processes it on the operator’s behalf, to run the booking. For questions about how an operator uses your details, contact them - or us, and we’ll pass it on.

BookMingo is a sole proprietorship. Contact: contact@bookmingo.com.

From travellers, when you book or fill in an operator’s form:

• name, mobile number and email;
• details of the people in your booking and your dates, room or departure;
• answers to questions the operator asks - which may include ID or permit details, emergency contacts, dietary or medical notes if the operator needs them for your safety;
• waivers you sign: your typed name, the time, and your IP address and browser, as a record of the signature;
• booking and payment status, and the messages we send you about the booking.

From operators, when you sign up and use the app:

• name, email, mobile number and a password (stored only as a secure hash);
• business details, and for verification: legal name, PAN, GSTIN if you have one, and bank account details;
• your listings, photos, prices, calendar, team members and the calendar links you connect (for example from Airbnb or Booking.com);
• notification settings, including a device token if you turn on push notifications.

Automatically: a sign-in cookie to keep you logged in, and standard server logs (IP address, browser, pages requested) kept for security and troubleshooting. We don’t use advertising or third-party tracking cookies.

• to create, confirm, change and cancel bookings, and show them to the operator;
• to send booking confirmations, payment receipts, reminders and updates by email and WhatsApp;
• to let travellers find their bookings with a one-time code;
• to run operators' accounts, verify businesses, bill subscriptions and provide support;
• to keep BookMingo secure, prevent fraud and fix problems;
• to meet legal, tax and accounting obligations.

We rely on your consent (given when you book or sign up) and on legitimate uses allowed by the DPDP Act, such as providing a service you asked for and complying with the law.

When you book, we send updates about that booking - confirmation, payment, reminders, cancellation - to the mobile number and email you gave, from BookMingo’s WhatsApp Business number in the operator’s name. These are service messages, not marketing. If you’d rather not get WhatsApp messages, write to us and we’ll stop them for your number; you’ll still get essential booking emails.

Only as needed to run the service:

• The operator you book with, and their team members.
• Service providers who process data for us under contract: our cloud server host; Razorpay (online payments); Meta Platforms (WhatsApp Business messaging); Resend (email delivery); and browser push services from Google, Apple or Mozilla (notifications to operators who turn them on).
• Authorities, when the law requires it or to protect someone’s safety.

Some of these providers may process data outside India. Where they do, it’s under their own security commitments and as the DPDP Act allows.

• Booking and payment records: as long as the operator's account is active, and afterwards for up to 8 years where tax and accounting law requires.
• Operator account data: until the account is closed, then deleted or anonymised within 90 days, except records we must keep by law.
• One-time codes and sign-in sessions: until they expire.
• Server logs: up to 90 days.

Data is sent over HTTPS and stored in a database where each operator can only see their own records. Passwords and sign-in tokens are stored only as hashes, and access to production systems is restricted. No system is perfectly secure; if a breach affects your data, we’ll notify you and the Data Protection Board of India as the law requires.

Under the DPDP Act you can:

• ask what personal data we hold about you and who it's been shared with;
• ask us to correct, complete or update it;
• ask us to delete it, where we don't need to keep it by law;
• withdraw consent you've given (this may mean we can't continue a booking or account);
• nominate someone to exercise these rights on your behalf;
• complain to us, and then to the Data Protection Board of India if you're not satisfied.

Write to contact@bookmingo.com from the email or number on your booking or account. We reply within 30 days. Travellers’ requests about a booking may be passed to the operator, who holds that booking.

BookMingo is for adults. A traveller under 18 can be included in a booking made by a parent or guardian, who gives consent for them. Operators must not use a child’s data for anything other than the booking.

Grievance Officer, BookMingo
Email: contact@bookmingo.com · Phone / WhatsApp: +91 78920 35457

We acknowledge complaints within 48 hours and aim to resolve them within one month.

We’ll update this policy when our practices change and change the date at the top. For significant changes we’ll tell operators by email or in the app.