Privacy Policy

1. Who We Are

Munal Digital Infrastructure Services (MDIS) is a technology company based in Gangtok, Sikkim, India. We operate Munal Desk — a B2B SaaS platform designed to help small travel agents manage bookings, itineraries, vendor coordination, and client communications.

For any privacy-related queries, contact us at: hello@munal.in

---

2. Information We Collect

We collect information in three ways: information you provide directly, information generated through use of the platform, and information from third-party services.

• Your full name and agency or business name
• Email address and phone number
• Password (stored in encrypted form — we never see your plain-text password)
• Optional: GST number, business address

• Client names, email addresses, and phone numbers
• Itinerary details including destinations, dates, and pricing
• Booking records including payment amounts and status
• Vendor names and contact information
• Internal notes you add to bookings

• Pages visited within the platform and actions taken
• Browser type, device type, and operating system
• IP address and approximate location (city/region level)
• Session timestamps and duration

---

3. How We Use Your Information

We use the information we collect solely to provide and improve the Munal Desk service. Specifically:

• To create and maintain your account on the platform
• To send transactional emails — booking confirmations, payment receipts, and itinerary PDFs — to your clients on your behalf
• To send platform notifications such as payment reminders and trip alerts to you as the travel agent
• To generate analytics and insights for your own business use within the platform
• To respond to support requests you send us
• To detect and prevent fraud, abuse, or unauthorised access
• To improve the platform based on aggregate, anonymised usage patterns

We do not sell your personal data or your clients' data to any third party. We do not use your data for advertising.

---

4. How We Share Your Information

We share data only with the following categories of trusted service providers who help us run the platform. All providers are bound by data processing agreements.

• Resend — Email delivery service used to send itinerary PDFs, booking confirmations, and payment receipts to your clients
• Supabase — Database hosting service where your account and business data is securely stored (Singapore region)
• Railway — Backend server hosting provider
• Vercel — Frontend hosting provider for the web application at desk.munal.in
• Razorpay (future) — Payment processing for online bookings. Razorpay processes payment data under their own Privacy Policy.
• Interakt / Meta WhatsApp Business API (future) — Used to send WhatsApp notifications to clients and vendors on your behalf

We may also disclose information where required by law, court order, or a legitimate government request in India.

---

5. Data Storage and Security

Your data is stored on Supabase's PostgreSQL servers in the Singapore region. We use the following security practices to protect it:

• All passwords are hashed using bcrypt — never stored in plain text
• Authentication uses JSON Web Tokens (JWT) with expiry
• All data is transmitted over HTTPS (TLS encryption)
• Access to your data within the platform is restricted to your account only — other travel agents cannot see your bookings, clients, or vendors
• Rate limiting is applied to prevent brute-force attacks
• Platform credentials and secrets are never stored in source code

While we take reasonable precautions, no system is 100% secure. We encourage you to use a strong, unique password for your Munal Desk account.

---

6. Data Retention

We retain your account and business data for as long as your account is active. If you request account deletion, we will delete your personal data within 30 days, except where we are required to retain it by law (for example, financial records).

Anonymised and aggregated data that cannot identify you may be retained for platform improvement purposes.

---

7. Cookies and Tracking

We use minimal cookies to keep you signed in to the platform. We do not use third-party tracking cookies or advertising cookies. The marketing site at munal.in may use Cloudflare's basic analytics (page views only, no personal data). We do not use Google Analytics or Facebook Pixel on this site.

---

8. Your Rights

As a user of Munal Desk, you have the following rights with respect to your personal data:

• Access — You can request a copy of the personal data we hold about you
• Correction — You can update your profile information directly within the platform at any time
• Deletion — You can request that we delete your account and associated data
• Portability — You can request an export of your data in a readable format
• Objection — You can object to certain types of data processing

To exercise any of these rights, email us at hello@munal.in. We will respond within 14 business days.

---

9. Children's Privacy

Munal Desk is a business platform intended for use by travel agents who are adults (18 years or older). We do not knowingly collect personal data from anyone under the age of 18. If we become aware that a minor has created an account, we will delete that account promptly.

---

10. Third-Party Links

Our platform and marketing site may contain links to third-party websites or services (for example, payment portals or WhatsApp). We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies before sharing any personal information with them.

---

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in the platform or applicable law. When we make material changes, we will notify registered users by email and update the "Last updated" date at the top of this page. Continued use of the platform after changes are posted constitutes your acceptance of the updated policy.

---

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your data, please reach out to us: