Privacy policy

This site is a portfolio demo

Tripsmith is a working demonstration built for a developer’s portfolio, not a trading travel agency. Nobody will call you back, and no trip will be booked.

The owner dashboard has a public demo login so that anyone can try it. That means everything sent through this site can be read by anyone who signs in with it: enquiries (name, phone number, email and message), bookings, waitlist entries, and the traveller details asked for after booking — dates of birth, emergency contacts, food and medical notes. ID numbers are the exception: the demo shows them masked. Please do not submit real personal details; made-up ones show the flow just as well.

Emails are really sent: sign-in codes, booking confirmations and waitlist offers go to the address you type. An address ending in @example.com is never emailed — its sign-in code shows on screen instead — so use one of those if you would rather not receive anything. Because anyone can act as the owner here, emails the owner sends from the dashboard — inbox replies, and everything about a booking made at the counter — go to the demo owner’s own inbox, never to the address on the booking.

What we collect

When you enquire: your name, phone number and email, the trip you asked about, your travel month, party size and anything you write to us. We also keep a keyed hash of your internet address (it cannot be turned back into the address) and your browser’s name, to trace abuse of the form.

When you book: the lead traveller’s name, phone number and email; each traveller’s name, age and room sharing; any coupon used; and, if you ask for a GST invoice, your company name, GSTIN and billing State. The payment itself — card, UPI or bank details — is handled by Razorpay; we keep only Razorpay’s payment reference, the amount and the payment record it sends us.

After you book, for the trip itself: each traveller’s ID type and number (stored encrypted), date of birth, an emergency contact, food choice, allergies and medical notes.

When you sign in: your name and email for your account, the packages you save, any review you write, and — for each signed-in device — its internet address and browser name. When you join a waitlist: your name, email, party size and internet address.

AI trip planner

Chats are answered by Google Gemini and may be used by Google to improve its models. Don’t share your name, phone or other personal details here — we’ll ask for them in a form when needed. Tripsmith keeps chats to improve the service.

What we keep from a chat: what you wrote, the trip planner’s replies and the trips it looked up, and a keyed hash of your internet address, like the one kept with an enquiry. Phone numbers and email addresses typed into a chat are removed before the message is stored or sent to Google. A chat is not linked to your account, and on this demo anyone using the public owner login can read it. To count the 20 messages a day each connection may send, your internet address is held for a day by Upstash, our rate-limit service.

Chats stay until you ask us to delete them. Nothing you type in the chat books or pays for anything: bookings and enquiries happen in the same forms as the rest of the site.

What we do with it

We use it to respond to your enquiry and, if you book, to run your trip. We do not sell it, we do not add you to a newsletter, and we do not run advertising that follows you around the internet.

Who sees it

On this demo: anyone who signs in with the public demo login can see every enquiry and booking, as described above.

The services that run the site for us, each under its own privacy terms: Supabase stores the database (in Mumbai), Vercel hosts the site, Razorpay takes payments, Gmail sends our emails, and Google Gemini answers the AI trip planner (see above). Copies of the emails we send — including the note each enquiry sends us — stay in that Gmail mailbox; on this demo nothing clears them automatically.

In a real agency it would be the four of us at Tripsmith, and the hotels, transport partners and permit offices that need travellers’ names for a booking.

Cookies and analytics

The site sets no advertising cookies. It sets two of its own: when you sign in, a session cookie that keeps you signed in for 30 days; and, only if an enquiry sent without JavaScript fails, a 2-minute cookie holding what you typed so the form can be filled in again.

Your browser also keeps, for the life of the tab, the packages in your compare tray, the email you just booked with (to fill in the sign-in form), and which package pages you have already viewed, so a refresh is not counted twice. Trips you save with the heart are kept in your browser’s local storage: as a guest until you sign in (they then move to your account), and while signed in as a copy of your list, so the hearts show at once (signing out removes that copy). Clearing your browser’s site data removes both.

Vercel Web Analytics counts page visits without cookies and without identifying you. The map on our contact page is embedded from Google Maps and may set its own cookies when you interact with it.

How long we keep it

This is a portfolio demo with no scheduled clean-up jobs, so nothing is deleted on a timer. What happens to each kind of data:

• Enquiries, with our notes and replies, and traveller details — ID numbers, dates of birth, emergency contacts, food and medical notes — stay until you ask us to delete them.
• A signed-in device’s session, with its internet address, expires 30 days after sign-in, or at sign-out; expired sessions and old sign-in codes are cleared out whenever someone signs in.
• Booking records, payments and GST invoices are kept for at least 8 years, because tax law requires it. Your account, saved packages, reviews and waitlist entries stay until you ask us to delete them.

Your choices

Email hello@tripsmith.in to see, correct or delete what we hold about you. We answer within 7 days. WhatsApp conversations are on WhatsApp’s terms; delete them from your side any time.