1. Introduction & Scope
This Privacy Policy explains how Layovered AI Systems Private Limited ("Layovered," "we," "us," or "our") collects, uses, shares and protects your personal data when you use our mobile application, our website at layovered.com, and all related services (together, the "Services").
This policy is intended to comply with India's Digital Personal Data Protection Act, 2023 and the rules made under it. By using the Services, you consent to the practices described here, except where we separately ask for your consent.
2. Who We Are & How to Reach Us
Layovered AI Systems Private Limited, No. 102, Sri Sai Residency, 5th Cross, Mangammanapalya, Bommanahalli, Bangalore South, Bangalore – 560068, Karnataka, India. General contact: info@layovered.com. For privacy questions or to exercise your rights, contact our Grievance Officer (see Section 13).
3. Information We Collect
- Account & authentication: When you sign up we collect authentication data via your chosen method — Google Sign-In (name, email, profile identifier), Sign in with Apple (name and, where you allow it, email or a private relay email), and/or phone number for OTP verification. We use this only to create and manage your account.
- Passport information: Your passport-issuing country, which you select from a list. This is required to use core features.
- Visa information: Optionally, visas you hold, to refine which countries you can access.
- Booking & payment information: When you book a flight in the app, we and our payment processor collect the details needed to complete the transaction — traveller name(s), contact details, itinerary, and payment information. Card/UPI/banking details are processed by our payment gateway Razorpay and are not stored on Layovered's own servers.
- Referral information: If you invite others, we generate a share link and use device and attribution identifiers to credit a successful referral. We do not access your phone contacts.
- Waitlist / marketing email: If you join our waitlist on the website, we collect your email address to send launch and product updates. This is managed through our email provider, Brevo (Sendinblue).
- Usage data & analytics: We automatically collect usage information — device type, OS, unique device identifiers, IP address, features used, time in app, and crash reports. In the mobile app this is via Firebase Analytics; on the website via Google Analytics 4 and cookies (see Section 4). We use this mainly in aggregated form to understand usage and improve the Services.
- Communications: Records of your correspondence with us.
4. Cookies & Website Analytics
Our website uses cookies and similar technologies, including Google Analytics 4, to understand traffic and improve our pages. Non-essential analytics run only where you have given consent via our cookie banner, and you can withdraw or change that consent at any time. Essential cookies needed to operate the site do not require consent.
5. How We Use Your Information
To create and operate your account; to check visa eligibility from your passport and visa inputs; to show personalised routing and destination recommendations; to run automated processing that matches your passport/visa data against our database to determine country access; to process and fulfil flight bookings and payments; to operate the referral programme; to send account and (with consent) marketing communications; to improve the Services; and to maintain security and prevent fraud, including referral abuse.
Consent basis (DPDP). Where we rely on your consent, that consent is free, specific, informed, unconditional and given by clear affirmative action, and you may withdraw it as easily as you gave it (see Section 7).
6. How We Share Your Information
We do not sell your personal data. We share it only as follows:
- Cloud hosting — our secure backend infrastructure stores account, passport, visa and booking data.
- Firebase (Google) — app authentication and analytics.
- Google Analytics 4 — website analytics (consent-based).
- Brevo — waitlist / marketing email delivery.
- Payment gateway Razorpay — to process your payment securely.
- Flight supplier TBO — to search fares and complete your booking; the traveller and itinerary details needed to issue your ticket are shared with TBO and the relevant airline.
- Legal requirements — where required by law or valid requests from authorities.
- Business transfers — in a merger, acquisition or asset sale, with notice.
These providers are permitted to use your data only to provide services to us.
7. Consent & Your Choices
You can withdraw consent at any time — for marketing email via the unsubscribe link or by contacting us; for website analytics via the cookie banner; and for account data by deleting your account (Section 9). Withdrawing consent does not affect processing already carried out, and may limit features that depend on that data.
8. Data Storage and Security
We store data on secure cloud servers and apply industry-standard safeguards — encryption in transit (HTTPS), encryption of sensitive data at rest, and access controls. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security.
9. Data Retention and Deletion
We retain your data while your account is active or as needed to provide the Services and meet legal obligations. You can delete your account and associated data from within the app. On deletion we remove your data from active systems, typically within 30 days, except where retention is legally required (e.g. transaction records, fraud prevention); residual copies in backups are overwritten on our normal backup cycle.
10. Your Rights
Subject to applicable law, you have the right to access and correct your data; to request erasure; to data portability; to withdraw consent; and to grievance redressal. Access and correction of your passport and visa data are available in-app. To exercise any right, use the in-app tools or contact our Grievance Officer (Section 13). We respond in accordance with the DPDP Act and its timelines.
11. International Data Transfers
Your data may be processed on servers located outside India by our providers. We take steps to ensure it remains protected, and we comply with any DPDP restrictions on cross-border transfers.
12. Children's Privacy
The Services are intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we learn we have done so, we will delete it.
13. Grievance Officer
In accordance with the DPDP Act, you may contact our Grievance Officer with any privacy concern or to exercise your rights, and we will respond within the timelines required by law:
Ajitesh Sakaray, Grievance Officer, info@layovered.com, Layovered AI Systems Private Limited, No. 102, Sri Sai Residency, 5th Cross, Mangammanapalya, Bommanahalli, Bangalore South, Bangalore – 560068, Karnataka, India.
14. Changes to This Policy
We may update this policy and will post the new version with an updated Effective Date, and notify you of material changes in-app or by email.
15. Contact Us
Email: info@layovered.com