Privacy Policy

2 Definitions

3 Information we collect

We collect information in three ways: information you provide to us, information we collect automatically, and information we receive from third parties.

4 How we use your information

We use your information to operate the Platform and to make travel more meaningful, locally connected, and trustworthy. Specifically, we use it to:

• create and manage your account and preferences;
• process, confirm, and support your bookings, and share the necessary details with the relevant operator or provider;
• facilitate payments, refunds, and related financial operations through our payment partner;
• provide customer support before, during, and after your experience;
• provide AI-assisted travel guidance and personalised recommendations through Evan, Evynx’s digital travel companion, to help you discover experiences, answer travel-related questions, and improve your planning experience;
• send transactional communications (such as booking confirmations and service updates), and, with your consent, marketing communications you can opt out of at any time;
• operate trust and safety measures, verify operators, prevent fraud, and enforce our terms;
• improve the Platform through analytics and research;
• comply with legal, tax, and regulatory obligations.

We may use interactions with Evan to improve the quality, safety, and accuracy of our AI-powered features. Where appropriate, this information may be analysed in aggregated or de-identified form to improve the Platform.

5 Consent and lawful use

We process personal data on the basis of your consent, and for certain legitimate and lawful uses permitted under the Digital Personal Data Protection Act, 2023 - such as fulfilling a booking you have requested, providing support, meeting legal obligations, and ensuring the security of the Platform.

Where we rely on consent, you may withdraw it at any time (see Section 11). Withdrawing consent will not affect processing carried out before the withdrawal, and may limit our ability to provide certain services.

6 Cookies and similar technologies

Cookies are small files stored on your device that help the Platform function and improve your experience. We use:

• Strictly necessary cookies - required for the Platform to work (for example, sign-in and security).
• Performance and analytics cookies - to understand how the Platform is used, on an aggregated basis.
• Functional cookies - to remember your preferences.
• Marketing cookies - where permitted, to make communication more relevant.

You can manage or disable cookies through your browser settings. Disabling some cookies may affect how the Platform works.

7 How we share your information

We do not sell your personal data. We share it only as needed to provide the Platform and as described below:

• Operators and providers - we share the booking and traveller details necessary for the operator to deliver your experience.
• Payment partners (Razorpay) - to process payments and refunds securely.
• Service providers - hosting, analytics, communications, customer support, and similar vendors bound by confidentiality obligations and permitted to use the data only for the services they provide to us.
• Legal and regulatory - where required by law, court order, or to protect rights, safety, and the integrity of the Platform.
• Business transfers - in connection with a merger, acquisition, or reorganisation, subject to appropriate safeguards.
• With your consent - for any other purpose disclosed to you at the time.

8 Data retention

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, to provide the Platform, and to comply with legal, tax, accounting, and regulatory obligations. When data is no longer required, we delete or de-identify it.

In particular:

• Support requests - support tickets and the messages in them are retained for three years after the request is closed, so that we can deal with refunds, payment disputes, and service complaints raised after the fact.
• Search and discovery activity - the text you type into search or into Evan is removed from our analytics records after 180 days. Anonymous signals from that activity - such as which filters were applied, and which experiences were shown or opened - are kept for longer, and are not linked to your name or contact details.
• Conversations with Evan - we do not store your conversations with Evan on our servers. They exist in your browser for the duration of your visit and are not retained by us afterwards. Messages are processed by a third-party provider as described in Section 10.
• Anonymous discovery identifier - a random identifier stored in your browser, which lets us connect a search to the result you open, is renewed every 180 days.
• Bookings, payments, invoices, and tax records - retained for as long as required by applicable law, including tax and accounting obligations, which is generally longer than the periods above.

9 How we protect your information

We use appropriate technical and organisational measures - including access controls and encryption where appropriate - to protect personal data against unauthorised access, disclosure, alteration, and loss. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. In the event of a personal data breach, we will act in accordance with applicable law.

10 AI-assisted features

Evynx may use artificial intelligence to power certain Platform features, including Evan, our digital travel companion. AI-generated responses and recommendations are intended to assist your travel planning and discovery, but should not be considered professional, legal, medical, or financial advice. While we strive for accuracy, AI-generated content may occasionally be incomplete or incorrect, and travellers should exercise their own judgement before making decisions.

Evan relies on a third-party artificial intelligence provider (currently OpenAI). When you send Evan a message, the message and its response are processed by that provider on our behalf, under terms that do not permit your data to be used to train their models. The provider may retain the message for a short period - currently up to 30 days - for security and abuse-monitoring purposes, after which it is deleted. Please do not share payment details, identity document numbers, or other sensitive personal information in a conversation with Evan.

11 Your rights and choices

Subject to applicable law, you have the right to:

• access and obtain a summary of the personal data we hold about you;
• request correction, completion, or updating of inaccurate data;
• request erasure of your personal data, subject to legal retention requirements;
• withdraw consent previously given;
• nominate another individual to exercise your rights in the event of death or incapacity, as provided under the Digital Personal Data Protection Act, 2023;
• opt out of marketing communications at any time; and
• raise a grievance with our Grievance Officer (Section 15).

To exercise any of these rights, contact us at privacy@evynx.com. We may need to verify your identity before acting on a request.

12 Children’s data

The Platform is intended for users aged 18 and above. We do not knowingly collect personal data from children except in connection with a booking made by a parent or lawful guardian, and only with verifiable consent as required by law. If you believe a child has provided us data without appropriate consent, please contact us so we can take appropriate action.

13 Third-party links and services

The Platform may contain links to third-party websites, applications, or services (including operators and payment partners). This Policy does not apply to those third parties, and we are not responsible for their privacy practices. Please review their policies before sharing information with them.

14 Cross-border transfers

Evynx is based in India and primarily processes data in India. Where personal data is transferred to or accessed from outside India (for example, by a service provider), we do so in accordance with applicable law and take reasonable steps to ensure appropriate safeguards are in place.

One such transfer is worth naming: the artificial intelligence provider that powers Evan (see Section 10) processes messages on servers outside India, including in the United States. If you would prefer that your enquiry is not processed this way, you can contact us through the enquiry and support forms instead of using Evan.

15 Grievance Officer and contact

In accordance with the Information Technology Act, 2000 and the rules made under it, and the Digital Personal Data Protection Act, 2023, you may contact us at privacy@evynx.com for any questions, concerns, or complaints about this Policy or your personal data. For unresolved complaints, reach out to our Grievance Officer:

We will acknowledge and address grievances within the timelines prescribed under applicable law.

16 Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices or in the law. We will post the updated version on the Platform and revise the "Effective date" above. Where required, we will seek your consent to material changes. We encourage you to review this Policy periodically.