Privacy Policy

1. Introduction

TRIPPAL (operated by TRIPPAL LABS, New Delhi, India) helps customers create custom travel albums, memory books, gifts, and related printed products. To provide our services, we collect and process the personal information described in this policy.

By placing an order or using our website, you agree to the collection and use of information as described here. If you have questions, contact us at team@trippal.in.

2. Information We Collect

When you place an order or use TRIPPAL services, we may collect:

• Identity and contact: name, email address, phone number.
• Delivery information: shipping/billing address, pincode, city, state.
• Order details: trip title, trip dates, destination, captions, personalisation messages, and other order-specific information you provide.
• Uploaded files: photos, videos, files, and ZIP archives you upload for your album or order.
• Payment references: Razorpay transaction IDs and order references. We do not store card numbers; payments are processed by Razorpay.
• Google Drive files (optional): if you choose to use our Google Drive upload feature, we access only the specific files you explicitly select through the Google Drive Picker. See Section 4 for full details.
• Technical data: browser type, device type, IP address, pages visited, timestamps, and error logs for security, debugging, and analytics purposes.
• Saved carts: if you configure an album and leave before paying, we keep the cart — the album specification, any coupon you applied, and the name, email and phone you had entered — so you can return to it.
• Messaging and consent records: whether you opted in to WhatsApp marketing, the exact wording of the opt-in that was on your screen, the page you gave it on, when you gave it, your browser's user-agent string at that moment, any later opt-out, and the delivery status of each message we send you.

3. How We Use Your Information

• To create, manage, and fulfil your orders (design, print, and ship your album or gift).
• To upload, process, and preview photos for album design.
• To communicate with you about order status, preview approvals, revisions, and delivery — by email and on WhatsApp, and to send one-time passcodes when you sign in.
• To process payments and confirm advance and balance payments.
• To provide customer support and handle revision requests.
• To prevent fraud, abuse, and security incidents.
• To improve our website, products, and services through analytics.
• To send you marketing — by email, and on WhatsApp only where you have separately opted in to WhatsApp marketing. Section 5 sets out exactly what we send, on which permission, and how to stop it.

4. Google Drive Data

TRIPPAL offers an optional Google Drive upload feature that allows you to select photos from your Google Drive account for use in your album or order.

• Optional: Google Drive upload is entirely optional. You may use device upload or ZIP upload instead at any time.
• Scope: TRIPPAL uses only the https://www.googleapis.com/auth/drive.file scope. This scope grants access only to files that you explicitly select through the Google Drive Picker. TRIPPAL does not access, browse, scan, or read any other files in your Google Drive.
• What we access: Only the specific files you select through the Picker interface. We do not access your full Google Drive or any files you did not select.
• How we use selected files: Selected files are imported into TRIPPAL's secure storage solely for preview, captioning, order creation, album design, customer support, and fulfilment. File names and image content may be processed for these purposes only.
• No advertising use: TRIPPAL does not use Google Drive data for advertising, profiling, or any purpose unrelated to your order.
• No data sale: TRIPPAL does not sell Google user data or Google Drive data to any third party.
• No unrelated sharing: Google Drive data is not shared with unrelated third parties. It may be shared only with our internal design team, print/fulfilment partners, and cloud storage providers strictly as necessary for your order.
• Access tokens: OAuth access tokens are used only to import your selected files and are not stored longer than necessary for that operation.

5. Messages We Send You

We send two kinds of message and they rest on two different permissions. They are easy to confuse, so this section keeps them apart.

Messages about your order

By email and on WhatsApp, to the address and mobile number on the order: order confirmations, design previews and approval requests, revision updates, advance and balance payment requests, dispatch notifications with tracking, and delivery updates. We also send one-time passcodes on WhatsApp when you sign in.

These are how an order is fulfilled and how you prove a number is yours. They are not marketing, and there is no separate opt-in for them. If you would rather we did not use WhatsApp for these, email team@trippal.in and we will use email instead.

WhatsApp marketing, only if you asked for it

• Saved-cart reminders. If you build an album and leave before paying, we may send you WhatsApp reminders that your cart is saved, with a link back to it. This is the only marketing purpose the checkout tick covers, and there is a fixed, finite number of reminders per saved cart.
• Anything else — offers, launches, seasonal promotions — would need its own separate opt-in, asked for on its own terms. A saved-cart tick is not a licence for a promotional broadcast, and we do not treat it as one.

Giving us a number is not asking to be marketed to

We treat these as four separate permissions and never read one as another:

• Entering your phone number so we can deliver an order.
• Verifying a number with a one-time passcode so you can sign in. Proving you control a number is proof of identity, not a request for marketing.
• Accepting our Terms.
• Ticking the WhatsApp marketing box.

Only the last of those authorises a marketing message. The box is shown on a TRIPPAL page rather than inside a payment provider's checkout. Since 10 September 2026 it is ticked by default and says so beside it: untick it to decline, and we record what you submitted — including that you cleared it — the moment you do. If you have opted out before, the box is shown unticked, and a default tick can never override your opt-out; only ticking it yourself can. We record the exact wording that was on your screen. If we later change that wording in a way that changes what you agreed to, the old tick stops authorising and we ask again rather than reinterpreting it.

What a WhatsApp marketing message carries

• Your mobile number in international format — this is what the permission is recorded against.
• Your first name, where the cart has one, so we can address you.
• A link that returns you to your saved cart.
• The delivery status our messaging provider reports back to us — for example sent, delivered, or failed.

We do not send your photographs, your album contents, your captions, your delivery address or your email address to the WhatsApp messaging provider.

The saved-cart link

The link in a reminder opens one cart and nothing else. It is not a login: it does not open your account, your order history, or any other order. It expires, and it stops working as soon as that cart is bought or you ask us to stop.

Who handles these messages

• AiSensy: our WhatsApp Business messaging provider. It transmits our WhatsApp messages and reports back whether each one was delivered.
• Meta: WhatsApp is operated by Meta, which carries every WhatsApp message we send under its own terms.
• Resend: sends our emails, as described in Section 6.

How to stop WhatsApp marketing

• The unsubscribe link. Every WhatsApp marketing message we send carries one. Opening it and confirming stops WhatsApp marketing to that number straight away. It needs no account and no reply, and the link works only for the one number it was issued for.
• Email. Write to team@trippal.in with the number, and we will record the opt-out. This route always works.

Our WhatsApp messaging platform may additionally stop messages when you reply with a keyword such as Stop. That happens at the platform rather than at TRIPPAL — we are not told about it and cannot record it against your number — so if you want the opt-out held by us, please use one of the two routes above.

An opt-out is permanent, it applies to the number rather than to a single order, and a later tick does not override it. Stopping marketing does not stop messages about an order you have placed.

6. How We Share Your Information

We do not sell your personal data. We share data only when necessary:

• Internal team: our designers and production staff access your photos and order details to create your album.
• Print and fulfilment partners: your name and delivery address are shared with printing and shipping partners to fulfil your order.
• Razorpay: payment details are processed by Razorpay in accordance with their privacy policy.
• Supabase and Vercel: our cloud storage and hosting infrastructure providers store and serve your data. They are bound by their own data processing agreements.
• Resend: our email service provider sends transactional emails on our behalf.
• AiSensy: our WhatsApp Business messaging provider sends our WhatsApp messages — both order updates and, where you have opted in, saved-cart marketing. It receives your mobile number, your first name where we hold one, and the text of the message, and it reports the delivery status back to us.
• Meta (WhatsApp): WhatsApp is operated by Meta and carries every WhatsApp message we send, under Meta's own terms.
• Meta and Microsoft (advertising and analytics): analytics and advertising data as described in the Analytics section below.
• Legal compliance: we may disclose data when required by law, court order, or government authority.

7. Analytics and Advertising Tools

We use the following third-party tools:

• Meta Pixel (Facebook Pixel): to measure advertising effectiveness and reach relevant audiences. Meta may set cookies and collect browsing data. You can opt out via your Facebook Ad Preferences.
• Microsoft Clarity: for session analytics, heatmaps, and session recordings to understand how visitors use our website. Data is processed by Microsoft per their Privacy Statement.

8. Data Retention

• Order information, photos, and related data are retained as needed for production, customer support, accounting, and legal or business record-keeping obligations.
• Your uploaded photos are scheduled for deletion 10 days after your order is delivered. You may request earlier deletion at any time.
• Google Drive access tokens are not retained beyond the duration needed to complete the file import.
• A saved cart is kept for a short, fixed period so you can return to it, and the link that reopens it expires sooner than the cart does.
• Marketing consent and opt-out records are kept for as long as we run the messaging programme, and an opt-out is kept indefinitely. Deleting an opt-out is the one thing that would let us message you again, so we keep that record even when other data about you is removed.
• You may request deletion of your data at any time by contacting team@trippal.in. We will process requests where legally and operationally possible. Note that backup copies may take additional time to be fully removed.

9. Your Choices and Rights

• You may use device upload or ZIP upload instead of Google Drive at any time.
• You may request access to, correction of, or deletion of your personal data.
• You may opt out of marketing emails at any time via the unsubscribe link or by contacting us.
• You may stop WhatsApp marketing messages at any time — untick the box on any checkout page, use the unsubscribe link in one of those messages, or email team@trippal.in. See Section 5. The opt-out applies to the number rather than to a single order, and it stands until you tick the box again yourself.
• You never have to accept WhatsApp marketing to place an order. The box is optional — ticked by default and yours to untick — and declining it changes nothing about your order.
• You may disable cookies in your browser settings (this may affect site functionality).

To exercise any right, email team@trippal.in.

10. Security

We implement reasonable technical and organisational safeguards to protect your data, including encrypted transport (HTTPS), access controls, and limited staff access. No system is perfectly secure; we cannot guarantee absolute security. In the event of a breach affecting your data, we will notify you as required by applicable law.

11. Children's Privacy

TRIPPAL services are not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with data, please contact us for deletion.

12. International Data Transfers

TRIPPAL is based in India. Your data may be processed and stored by our service providers (Supabase, Vercel, Resend, Razorpay, Google, AiSensy, Meta) in India or other countries. By using our services, you consent to this transfer. We ensure our providers maintain appropriate data protection standards.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email if you have placed an order with us. The updated policy will be posted on this page with a new "Last updated" date.

14. Contact

Questions about this policy or requests regarding your data:

• Email: team@trippal.in
• Phone: +91 9183138118
• TRIPPAL LABS, New Delhi, India