Privacy Policy

1. Personal Data We Collect

When you use Olubook to search, book, or manage intercity bus tickets, flights, hotels, or resale tickets, we collect only necessary and proportionate personal data:

• Contact Information: Full legal name, mobile phone number, email address.
• Passenger Manifest Details: Age, gender (required for female-adjacent seat allocation safety), and seat preferences as mandated by transport operators and state transport authorities.
• Geolocation & Navigation Data: With your permission, coarse/fine location is accessed strictly to show nearest bus boarding points, provide one-click Google Maps navigation, and facilitate live coach tracking.
• Financial & Payout Data (For Ticket Resellers): Verified UPI ID or bank account details collected securely to disburse Escrow sale proceeds upon trip completion.
• Device & Telemetry Data: IP address, device fingerprints, browser version, and transaction timestamps utilized strictly for fraud detection and rate-limiting.

2. How We Process Your Information

Your personal data is processed solely for legitimate purposes under the DPDP Act, 2023:

• Confirming bus seat reservations and delivering electronic M-Tickets via SMS, WhatsApp, and email.
• Transmitting mandatory passenger manifests to authorized bus transport operators and GDS providers (e.g. BDSD Travel API).
• Enforcing female passenger adjacent safety filters to protect women travelers.
• Executing automated Escrow payments, fraud monitoring, anti-scalping validations, and instant UPI disbursements.
• Customer service fulfillment and complaint redressal.

3. Payment Card & Financial Data Security

All payment transactions are handled through Reserve Bank of India (RBI) licensed payment gateways (Razorpay and PhonePe) using end-to-end 256-bit AES cryptographic encryption and tokenization.

4. Cookies, Tracking & Session Integrity

Olubook utilizes secure, encrypted HttpOnly and SameSite=Lax authentication cookies. We do not sell, rent, or trade your personal information, travel itineraries, or browsing behavior to third-party advertising exchanges or marketing brokers.

5. Data Subject Rights (DPDP Act, 2023)

Under Indian data protection jurisprudence, you hold the right to:

• Access and review personal information associated with your account;
• Request correction or updating of inaccurate personal data;
• Withdraw consent and request account deletion or data erasure, subject to mandatory statutory tax, auditing, and accounting retention rules under Indian law.

5a. Data Retention, Cross-Border Processing & Children

• Data Retention: Transactional and booking records are retained for 7 years as required under the GST Act, 2017. Account data is deleted within 30 days of a verified erasure request, subject to statutory obligations.
• Cross-Border Processing: Olubook uses Cloudflare for CDN and DDoS protection; your data may transit Cloudflare''s global network. Payment data is processed by Razorpay and PhonePe, both RBI-licensed Indian entities. No personal data is transferred outside India for marketing purposes.
• Children''s Data: Olubook''s services are not directed at persons under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor''s data has been submitted, contact us at [email protected] for immediate deletion.

6. Grievance Redressal Officer

In accordance with Section 5(9) of the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000, for privacy questions or data grievances, contact our designated Grievance Officer: