Privacy Policy

This Privacy Policy explains how Onto (“Onto”, “we”, “us”, or “our”), operator of onto.travel, collects, uses, and protects your information when you use our website and services (the “Service”). By using the Service, you agree to the practices described here.

Information we collect

We collect the following categories of information:

• Account information. When you sign in — including through Sign in with Google — we receive your name, email address, and profile details you choose to share. Authentication is handled by our provider, Stytch.
• Booking information. Details you provide to search for and book stays, such as travel dates, destinations, guest information, and contact details.
• Payment information. Payments are processed by our payment provider (Razorpay). We do not store your full card or bank details on our servers.
• Usage information. Technical data such as device type, browser, IP address, and how you interact with the Service, collected to keep it secure and improve it.

How we use your information

We use your information to:

• Provide, operate, and maintain the Service;
• Authenticate you and keep your account secure;
• Process bookings and payments;
• Communicate with you about your bookings and account;
• Improve, personalise, and develop the Service;
• Comply with legal obligations and prevent fraud or abuse.

How we share your information

We do not sell your personal data. We share information only as needed to run the Service, including with:

• Service providers who process data on our behalf, such as Stytch (authentication) and Razorpay (payments);
• Accommodation and travel partners to fulfil the bookings you make;
• Authorities where required by law or to protect our rights and users.

Google user data

When you sign in with Google, we access only your basic profile information (name, email address, and profile picture) to create and secure your account. Onto’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use this data for advertising and do not share it except as described in this policy.

Data retention

We retain your information for as long as your account is active or as needed to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. You may request deletion of your account and associated data at any time.

Your rights

Depending on your location, you may have the right to access, correct, or delete your personal data, or to object to or restrict certain processing. To exercise these rights, contact us at the address below.

Security

We use reasonable technical and organisational measures to protect your information. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

Children’s privacy

The Service is not directed to children under 18, and we do not knowingly collect personal data from them.

Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the “Last updated” date above.

Contact us

If you have questions about this Privacy Policy or your data, contact us at akash@onto.travel.