Privacy Policy

1. Who we are and our role

Travora Hub (SMC-Private) Limited (Registered in Pakistan · SECP Inc. No. 0350231 · NTN J651584 · Islamabad, Pakistan) builds and operates a white-label travel technology platform. Agencies use it to run their own branded websites and portals for hotels, flights, tours, activities and Hajj & Umrah packages, with B2B agent portals, supplier connections and a WhatsApp AI assistant.

We act in two roles:

• As the controller of the data we collect for our own business: visitors to travorahub.com, people who apply or contact us, our clients' account holders, and invoice and billing contacts.
• As a processor (service provider) for travel agencies. When a traveller searches or books on an agency's website, that agency decides why and how the traveller's data is used, and it is responsible for its own privacy notice. We process that data only on the agency's instructions, to provide the platform.

2. The data we collect

When you visit travorahub.com:

• Usage and device data through Google Analytics 4: the pages you view, the approximate location derived from your IP address, your device and browser type, and how you arrived at the site.
• Technical data our servers record for security and reliability: IP address, browser user agent, the page requested and the time of the request.

When you apply to become a client or contact us:

• Your agency name, your full name, email address, phone number, country, type of agency, expected monthly bookings, website, how you heard about us, and anything you write in your message.
• Anything you send us by email or WhatsApp.

When you are a client or an invoice contact:

• Account and contact details, the Google account you sign in with (name, email address and profile picture), your website settings, content and branding, and the supplier and payment-gateway credentials you connect to your site.
• Invoice and billing records, and the payment status we receive from the payment provider. We never receive or store full card numbers.

Traveller data we process for agencies (when you book on an agency's website):

• Names and contact details, guest and passenger details the booking requires (for flights, this can include date of birth, nationality and passport details), stay or travel dates, the party's make-up, special requests, booking and payment status, and messages exchanged with the agency, including through its WhatsApp assistant.
• Card payments are taken by the agency's payment provider (for example Stripe, MyFatoorah or Safepay) in the provider's own secure form. Card details never pass through or rest on our servers.

3. How we use data and our legal bases

• To answer your enquiry, assess your application, and set up and support your platform. Legal basis: taking steps at your request before a contract, and performing that contract.
• To provide, secure and improve travorahub.com and the platform, including preventing fraud and abuse and fixing faults. Legal basis: our legitimate interests in running a safe, reliable service.
• To understand how visitors use travorahub.com (analytics). Legal basis: our legitimate interests or, where the law requires it, your consent.
• To invoice clients and keep financial records. Legal basis: performing our contract and meeting our legal obligations.
• To process traveller bookings, notifications and support for the agency that runs the website. Legal basis: the agency's instructions under our agreement with it.
• To send you service messages about your account. We only send marketing emails if you have agreed to receive them, and you can opt out at any time.

We do not sell personal data. We do not use it for advertising profiling. Advertising storage, ad user data and ad personalisation are all switched off in our Google Analytics setup.

4. Who we share data with

We share personal data only with the service providers we need to run the business and the platform, and only as much as each one needs:

• Hosting, databases and file storage: our web hosting provider, our cloud database provider (Turso) and our image hosting provider (Cloudinary).
• Email delivery (for example SendGrid or the agency's own SMTP server), and messaging (Meta's WhatsApp platform, and Telegram for internal team alerts).
• Analytics: Google Analytics.
• Sign-in: Google, when you choose to sign in with your Google account.
• Payment providers: Stripe, MyFatoorah and Safepay, and your bank for transfers.
• AI providers (for example Groq and Google Gemini), to generate replies in the WhatsApp and website assistants and to translate content. Only the text needed for each request is sent.
• Travel suppliers the agency has connected, such as hotel, flight and activity providers (for example RateHawk, Hotelbeds, WebBeds, TBO, Duffel, Viator, PKFARE and Billbed). They receive the traveller details needed to price, book and service a reservation.
• Professional advisers, and authorities when the law requires it or to protect our rights, our users or the public.
• A buyer or successor if our business is sold or restructured, who would remain bound by this policy.

5. International transfers

We are based in Pakistan and our providers operate in several countries, so personal data may be stored and processed outside your own country. Where the law requires it, we rely on appropriate safeguards for these transfers, such as standard contractual clauses or our providers' own transfer mechanisms.

6. How long we keep data

• Applications and enquiries: for as long as needed to follow up, and normally no more than 24 months after our last contact if you do not become a client.
• Client account data: for as long as the account is active, then as long as needed to close it down properly.
• Invoices and financial records: for the period tax and accounting law requires.
• Traveller booking data: according to the agency's instructions and our agreement with it, and deleted or returned when that agreement ends, unless the law requires us to keep it.
• Server logs: for a short period, for security and troubleshooting.

7. How we protect data

We use encryption in transit (HTTPS), access controls and admin sign-in through Google accounts, and tenant separation so that each agency's data stays separate. We also rate-limit and monitor our services, and card payments are handled only by certified payment providers. No online service can be guaranteed completely secure. If a breach affects your personal data, we will notify you and the relevant authorities where the law requires it.

8. Cookies and similar technologies

travorahub.com uses Google Analytics cookies to measure visits, and your browser's local storage to remember small preferences. We do not set advertising cookies. You can block or delete cookies in your browser settings, and you can opt out of Google Analytics with Google's browser add-on.

Agency websites on our platform show their own cookie notice, and each agency controls its own analytics and marketing tags.

9. Your rights

Depending on where you live, you may have the right to:

• ask for access to your personal data;
• correct it;
• delete it;
• restrict or object to how we use it;
• ask for a portable copy;
• withdraw consent at any time;
• complain to your data-protection authority.

To use any of these rights for data we control, email support@travorahub.com. We may need to confirm your identity first. If your request is about a booking you made on a travel agency's website, please contact that agency, which controls that data. We will help the agency respond.

10. Children

travorahub.com and our client services are meant for businesses and adults. Agencies may process children's details as travellers when a parent or guardian includes them in a booking. We do not knowingly collect children's data for our own purposes.

11. Changes to this policy

We may update this policy as our services or the law change. The date at the top shows when it last changed. If we make a significant change, we will tell our clients directly.

12. Contact us

Travora Hub (SMC-Private) Limited, Islamabad, Pakistan. Email: support@travorahub.com.