Privacy

Takeotrip.com does not load a third-party analytics script. A flight search stays in your browser until you ask the server for fares. The Travelpayouts token never reaches the browser. India’s Digital Personal Data Protection Act, 2023 can apply to personal data handled for people in India. This page is the owner’s working policy. It is not a lawyer’s opinion, and the owner should have it reviewed before relying on it.

Visa applications

If you apply for visa assistance, Takeotrip collects only the fields on the form: name, nationality, passport number, passport expiry, travel dates, trip purpose, email, an optional WhatsApp number, a passport scan, and a photo. We use them only to prepare and file that visa with the official channel, and to tell you the status. We do not sell them and we do not use them for advertising.

The passport number is encrypted before it is stored (AES-256-GCM). Scans and photos go to a private store. They are not published on a public URL. Only the site owner, signed in to the visa desk, can open them, and those links expire in about a minute. Photo files have EXIF metadata removed before storage.

Who can see them: the owner account on the allowlist, and the email or WhatsApp provider only when a status message is sent (the message does not include the passport number or the files). A hosting database (Supabase, if configured) stores the encrypted record and the private files. Netlify Forms are not used for these documents.

After a request is marked completed or rejected, the files and the personal fields are deleted automatically after 30 days (the owner can set VISA_RETENTION_DAYS). A short audit row can remain: the reference, the country, the status history, and that the data was deleted. It does not keep the passport number, the files, the name, the email, or the phone. You can delete sooner with “Delete my data” on the tracking page.

The tracking link contains a secret. Anyone with that link can see the status and can delete the application. Do not forward it.

Forms

If you join fare alerts, the newsletter, or an enquiry, the fields you type are stored by Netlify Forms on the free plan. Those forms are for questions, not for passport scans. Do not put a passport number in them. We do not sell that list.

When you book

The Book button opens Aviasales. Their site sets its own cookies and processes the payment. Read their policy before you pay. The affiliate marker in the link tells Travelpayouts which partner sent you.

Contact and deletion

No contact inbox is published yet. Set CONTACT_EMAIL to show one. Visa applicants can still use Delete my data on the tracking link.