Privacy Policy
Last updated: September 2026
1. What we collect
- Account data: agency name, owner email/phone, branding settings.
- Booking data you enter/scan: passengers, segments, fares, PNRs. Stored tenant-scoped, never shared across tenants.
- Payment proofs: bKash/Nagad/bank screenshots you upload for manual review.
- Scan logs: success/failure + SHA-256 hash of ticket text only — never raw ticket text.
- Technical: session cookies (tenant vs staff isolated), rate-limit counters, mail send log.
2. How we use it
- Run your account: AI scan (Groq, server-side only), branded receipts, QR verify links, credit billing.
- Manual payment review and support emails (PHPMailer SMTP, logged to
logs/mail.log).
- Prevent abuse: rate limiting, audit log, auto-suspend expired trials/subscriptions via cron.
3. Sharing
We do not sell your data. Processors: hosting (Hostinger), AI parse (Groq — ticket text sent server-to-server for extraction), email delivery (SMTP). Public QR verify.php shows booking status/itinerary/names only.
4. Retention
- Generated PDFs auto-purge after ~48 hours (
pdf_purge_at).
- Rate-limit rows pruned daily; scan/credit rows kept for billing audit.
- Cancel your account anytime (dashboard) — data removed per deletion flow.