1. Information we collect
We collect data in five categories, only as far as needed to run a secure and reliable documentation service.
1. Account data
- Data points: your full name, business email address, mobile/WhatsApp number, business name, login credentials (passwords are stored only as a salted one-way hash, using bcrypt), and your plan and payment records.
- Purpose: signing you in, keeping your account secure, managing your subscription and giving support.
2. Business profile data
- Data points: agency trade (brand) name, legal business name, business type, company logo and stamp, registered address, GSTIN, IATA number, landline, document-numbering settings, and — only if you add them — bank account and UPI details that you choose to print on your invoices.
- Purpose: setting up your workspace, printing your branding on the PDFs you generate, and issuing GST invoices for your subscription under SAC code 998314.
3. Customer directory (workspace data)
- Data points: your clients' and travellers' names, phone numbers, email addresses, billing addresses and tax identifiers (such as GSTIN, PAN or VAT number) that you save in your private customer list.
- Purpose: filling documents in quickly and keeping your agency's private client records.
4. Document data
- Data points: guest and passenger names, flight segments, hotel stay dates, room categories, meal plans, pickup locations, driver details, line-item amounts, payment status, reference numbers, and details of the PDFs and images generated.
- Purpose: creating, previewing, storing and delivering your hotel vouchers, air tickets, pickup vouchers, welcome placards, itineraries, proforma invoices, tax invoices and receipts.
5. Technical, log and security data
- Data points: IP address, browser and device type, operating system, session tokens, sign-in times and security logs.
- Purpose: preventing unauthorised access, stopping brute-force attacks, fixing technical problems and keeping the service available.
We also keep what you send us through the Contact page, support tickets, bug reports and callback requests, to answer you. For online plan payments we receive the Razorpay order and payment IDs, amount, method type and status; for UPI payments, the transaction ID and the screenshot you upload.
2. How we use information
We process personal and business data only for lawful, contractual and service purposes:
- To provide the service: signing you in, turning your entries into downloadable PDFs and images, storing drafts and documents, and keeping your customer directory.
- Service communications: password-reset links, profile and plan-renewal reminders, in-app notifications about your profile, plan, payments and support requests, security alerts and important service updates.
- Security and compliance: preventing fraud and misuse, protecting the platform, meeting tax and accounting obligations and complying with the law.
Our roles and legal basis. For your own account and profile we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act"). For your customers' data that you enter, you are the Data Fiduciary and we act as your Data Processor, using it only to provide the service to you. We rely on the consent you give when you create an account, and on the legitimate uses allowed under Section 7 of the DPDP Act, such as providing a service you asked for and complying with the law.
Non-solicitation and anti-poaching guarantee. Your customer directory, booking values and traveller lists are your most valuable business assets. Vouchlio and its parent entity, Frozen Highway, commit that subscriber client data is never used for travel marketing, and is never solicited, cross-sold, leased, shared for marketing or contacted by us under any circumstances.
3. Storage, retention and security
- Encryption: data is stored with our cloud database provider, encrypted at rest (AES-256), and all traffic is encrypted in transit with TLS (HTTPS).
- Workspace isolation: every record is tied to the agency account that created it, and every request is limited on our server to the signed-in account's own data, so other subscribers cannot access your workspace.
- Account security: passwords are hashed with bcrypt; password-reset links are stored hashed, expire after one hour and work once; repeated sign-in attempts are rate-limited; changing your password signs out your other devices.
- Retention: drafts, customer directories and documents are kept for as long as your account is open. On the free Silver plan, documents become locked (not deleted) 30 days after creation, and upgrading reopens them. When you close your account or ask for erasure, we permanently delete or anonymise your workspace records within 30 days, except records we must keep by law (for example, subscription payment and invoice records under Indian tax laws). Security counters expire automatically after a short time.
- Accuracy: you are responsible for the accuracy of guest details, room details, amounts and tax numbers you enter into documents.
4. Your choices and rights (DPDP Act and GDPR)
You stay in control of the data in your workspace:
- Access and review: view your documents and customer records in your dashboard, download your documents as PDFs, export your invoice records (CSV or Excel), and ask us for a summary of the personal data we hold about you and how we use it.
- Correction: update your business profile, logo, tax details and customer records at any time, or ask us to correct anything you cannot change yourself.
- Erasure and account closure: delete documents and customers yourself, or ask us to delete specific records or close your whole workspace, subject to what the law requires us to keep.
- Withdraw consent: at any time; this does not affect processing done before, but we may no longer be able to provide the service.
- Nominate someone to exercise these rights for you in case of death or incapacity.
- Complain to our Grievance Officer, and then to the Data Protection Board of India. If you are in the European Union or United Kingdom, you also have the rights given by the GDPR, including data portability and the right to object, and may complain to your local data protection authority.
To use any of these rights, email support@vouchlio.com. We respond within 30 days. If your request is about a traveller's data inside a travel agent's documents, we pass it to that agent, who controls that data.
6. Children
The service is for businesses and is not intended for anyone under 18. We do not knowingly create accounts for children. Travel agents entering details of travelling minors must have the consent of the child's parent or guardian.
7. Policy updates
We may update this policy to reflect changes to the service or the law. We will change the "Last updated" date above and, for significant changes, tell you by email or in the app before they take effect. Continuing to use the service after the new effective date means you accept the updated policy.
8. Contact and Grievance Officer
For privacy questions, data requests or compliance matters, and in line with the Information Technology Act, 2000, the rules made under it, and the DPDP Act, contact our Grievance and Data Protection Officer:
Shiny Johnson, Grievance & Data Protection Officer
Email: support@vouchlio.com
Vouchlio (parent entity: Frozen Highway), Bengaluru, Karnataka – 560100
Website: vouchlio.com
We acknowledge complaints within 48 hours and aim to resolve them within 30 days.