Privacy Policy

1. Introduction and Service Operator

Welcome to Gova AI (“we”, “our”, or “us”), accessible at https://govaai.xyz. Gova AI is an early-stage artificial intelligence-assisted travel planning and discovery platform. Currently, the project operates in an early pre-incorporation stage under its founding team.

Notice on Operator Identity: Formal corporate incorporation as a private limited entity and registered office registration are currently in progress. Prior to full public commercial launch, updated legal entity and statutory registration details will be published here.

2. Information We Collect

We collect information you provide directly, technical information generated during your visits, and operational logs necessary to generate tailored travel schedules and preserve account access.

3. Account Credentials and Authentication Data

• Sign Up Details: When you register directly, we collect your full name, email address, and a hashed version of your password. We use bcrypt with a salt cost factor of 10; plain-text passwords are never saved or stored.
• Email Verification: We generate cryptographically random, SHA-256 hashed one-time verification tokens sent via email to confirm ownership of your email address.
• Google OAuth Sign-In: If you sign in via Google OAuth 2.0, we receive your verified email, display name, and avatar URL as authorized by your Google profile settings. We do not receive or store your Google password.

4. Travel Prompts, Preferences, and Saved Trip Data

To generate personalized day-by-day itineraries, we process the trip criteria you provide: destination cities, travel dates, trip duration, estimated budget tier, companion type (solo, couple, family, friends), pace (relaxed, fast), and activity preferences (beaches, heritage, dining, adventure).

These inputs and the synthesized itineraries are stored in your account so you can view, edit, download as PDF, or delete them anytime from your dashboard.

5. Partner Business Information

For hotels, homestays, licensed tour guides, and travel providers registering as commercial partners:

• We collect business entity name, business type, contact person, verified business email, public WhatsApp / phone contact, operating state/city, description, and website URL.
• Where submitted, we store tourism registration references, operating licenses, and package photography uploaded to our secure asset storage for catalog presentation.

6. Technical Information, IP Addresses, Cookies, and Logs

• Essential Authentication Cookies: We set an HTTP-only, secure, SameSite=Lax cookie named gova_session containing an encrypted JSON Web Token (JWT) strictly to maintain your logged-in session. It cannot be accessed by client-side JavaScript.
• Guest Session Cookie: For unauthenticated travelers drafting a trip, a temporary cookie named gova_guest_id stores an anonymous identifier to preserve itinerary drafts.
• Currency Display Cookie: A local cookie named gova_currency records your display currency preference (INR or USD).
• Server Logs: Temporary server access logs record IP address, request method, endpoint path, response code, and approximate geographic region (via standard CDN headers) to detect malicious bot volume, enforce rate limiting, and route regional payment gateways.

7. Payment and Transaction Information

When purchasing a Pro subscription, Royal Expedition pass, or Booster Pack:

• No Card Storage on Gova AI: All payment transactions are handled directly through authorized PCI-DSS compliant payment gateways (Razorpay for domestic INR payments; Stripe for international USD checkout). Gova AI servers never receive, process, or store raw credit/debit card numbers, CVVs, or bank netbanking passwords.
• Transaction Audit Records: We store gateway-issued references (e.g., order ID, payment ID, subscription reference, currency, amount paid, and timestamp) in our database strictly for invoice tracking, subscription entitlement verification, and accounting compliance.
• Onboarding Status Notice: Payment gateway accounts are currently operating in sandbox and evaluation modes while merchant operational onboarding is being finalized.

8. Purposes and Legal Grounds for Processing

We process your personal information for the following legitimate purposes:

• Providing Service: Synthesizing custom travel itineraries and generating budget estimates requested by you.
• Account Administration: Authenticating logins, issuing password resets, verifying email ownership, and enforcing tier quotas.
• Communications: Sending transactional emails (verification links, booking notifications, payment receipts).
• System Integrity: Preventing fraud, brute-force attacks, API quota evasion, and illegal scraping.

9. AI Processing & Third-Party AI Disclosures

Gova AI uses artificial intelligence APIs to generate day-by-day travel schedules and contextual advice:

• Configured Providers: Our system interfaces with Google Gemini (@google/genai), OpenAI (gpt-4o-mini), and xAI Grok (grok-2-latest), backed by a deterministic local Heuristic Engine.
• What is Sent: Only travel destination queries, trip length, pace, companion details, and preference tags are transmitted to AI provider APIs.
• What is NEVER Sent: Your account passwords, session tokens, payment records, exact residential addresses, or billing details are strictly excluded from AI API payloads.
• Provider Storage Terms: While Gova AI does not use your private trip data to train foundation models, data sent to external AI provider endpoints is subject to each provider's commercial API data retention and abuse-monitoring policies.

10. Data Sharing and Subprocessors

We do not sell, rent, or monetize your personal information to third-party data brokers. We share data only with infrastructure subprocessors essential to operating the platform:

11. Data Retention and Deletion

We retain account information for as long as your account remains active. You can delete individual saved trips at any time directly from your dashboard.

When you initiate an account deletion via your dashboard or by emailing [email protected]:

• Your account record, email, hashed credentials, and saved itineraries are deleted from active application collections.
• Active subscriptions are cancelled to prevent subsequent billing.
• Financial transaction ID references are retained in anonymized format strictly as required for accounting and tax compliance under applicable Indian statutory laws.
• Encrypted database backups rotate and purge in accordance with our backup retention cycle.

12. Security Safeguards and Breach Notification (DPDP Act Sec 8)

In accordance with Section 8(5) of the Digital Personal Data Protection Act, 2023, we implement reasonable security safeguards to protect personal data in our possession or control:

• Encrypted communication in transit using Transport Layer Security (TLS / HTTPS).
• One-way salted password hashing via bcrypt (10 rounds).
• Strictly configured HTTP-only, SameSite cookies for JWT session tokens.
• Security HTTP defense response headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy).
• Server-side rate limiting and HMAC-SHA256 signature verification on billing webhooks.

Personal Data Breach Protocol (Sec 8(6)): In the unlikely event of an identified personal data breach, Gova AI will execute incident containment and provide timely notifications to the Data Protection Board of India (DPBI) and affected Data Principals in the form and manner prescribed under applicable rules.

Security Limitation: While we implement robust precautions, no digital transmission over the internet or cloud storage infrastructure can be guaranteed 100% impenetrable. Users are responsible for choosing strong passwords and safeguarding their device credentials.

13. Data Principal Rights & Grievance Redressal (DPDP Act Sec 11–14)

Under the Digital Personal Data Protection Act, 2023, Data Principals enjoy the following actionable statutory rights:

• Right to Access & Portability (Sec 11): Download a complete JSON export of your personal profile, trips, itineraries, and consent records directly from your User Dashboard or via /api/user/export.
• Right to Correction & Updating (Sec 12): Update your personal profile details, preferences, and partner listings at any time.
• Right to Erasure (Sec 12): Permanently delete your account and personal travel dossier directly via the dashboard erasure control or via /api/user/delete (subject to statutory financial retention mandates).
• Right to Nominate (Sec 14): Designate an individual (nominee) through your User Dashboard who may exercise your data rights in the event of death or incapacity.
• Right to Withdraw Consent (Sec 6): You may withdraw consent for optional processing or close your account at any time without punitive service penalties.

14. International Data Processing

Gova AI is operated from India. If you access the platform from outside India, your information will be transferred, processed, and stored on cloud servers that may be located in India, the United States, or other regions where our cloud subprocessors maintain facilities. By using the platform, you acknowledge this international transfer necessary to deliver the requested services.

15. Children's Privacy (DPDP Act Sec 9 Compliance)

In accordance with Section 9 of the Digital Personal Data Protection Act, 2023:

• Gova AI does not target its services to children (defined as individuals under 18 years of age).
• Registration requires an explicit affirmative declaration that the user is 18 years of age or older.
• Gova AI does not engage in behavioral monitoring, tracking, or targeted advertising directed at children.
• If we discover that personal data of an individual under 18 has been collected without verifiable parental consent, we will take immediate steps to permanently delete such data upon notification.

16. Third-Party Links & Partner Listings

Our itineraries and partner directory may contain outbound links to third-party hotel websites, transport carriers, or tourism service providers. Gova AI does not control and is not responsible for the privacy practices, content, or policies of external sites. We encourage you to review their policies directly.

17. Changes to this Policy

We may update this Privacy Policy as our business operations, features, and statutory corporate structures evolve. Any changes will be posted on this page with an updated “Last Updated” date. We encourage regular review of this policy.

18. Contact Details

For any questions regarding this Privacy Policy or your personal information, reach out to our team at: