1. What we collect
- Account data — name, email, phone, password (stored only as a bcrypt hash), role.
- Booking data — routes, dates, passenger counts, baggage and service preferences you submit in enquiries and bookings.
- Partner data — organisation details and regulatory documents uploaded during partner onboarding (visible only to VFly reviewers and, once verified, relevant certificate details to the public).
- Transaction data — quotations, invoices, payments and refunds handled through our payment partners.
- Usage data — request logs and audit trails used for security and dispute resolution.
2. How we use it
- To operate the marketplace: matching enquiries to operators, issuing quotations, creating bookings and processing payments.
- To communicate: status updates, quotation links, booking notifications and support responses.
- To meet legal obligations: invoicing, tax record-keeping and regulatory disclosures where required by law.
- To protect the platform: fraud prevention, abuse detection and audit logging.
3. Who we share it with
Your enquiry and booking details are shared with the operators, schools, institutes or employers who must act on them. Payment details are handled by our RBI-regulated payment partners and never stored on VFly servers. We do not sell personal data.
4. Security
Access tokens live in memory only; sessions use HttpOnly rotating refresh cookies with CSRF protection; passwords are bcrypt-hashed; every privileged action is permission-checked server-side and audit-logged. No system is perfectly secure — report concerns via the contact page.
5. Your rights (DPDP Act, 2023)
You may access, correct and request deletion of your personal data, and withdraw consent for non-essential processing, from your account profile or by contacting us. We respond within the time frames prescribed by law.
6. Retention
We retain booking and transaction records as required by tax and aviation law; other data is deleted or anonymised when no longer needed for the purposes stated above.
