Privacy Policy

Yaatra is built on a simple principle: people should know what is being shared about them, who is sharing it, and with whom. We collect the minimum information necessary to operate the Services and we are explicit about how that information is used. We are explicit about the limits of what we prove and store. We hold credentials in cryptographically protected form and we do not sell personal information.

2.1 Information you provide directly

• Account information such as name, email address, organisation, role, and password (stored as a salted hash).
• Verification case information including the names of an Applicant and an Issuer and the type of credential being verified.
• Credential content provided by an Issuer (such as employment details, dates, qualifications).
• Communications you send to us, including support requests and feedback.

2.2 Information collected automatically

• Usage data including pages visited, features used, and timestamps.
• Device and connection data including IP address, browser type, operating system, and approximate location derived from IP.
• Cookies and similar technologies used to keep you signed in and to remember preferences. You can control cookies through your browser settings.

2.3 Information from third parties

We may receive limited information from third parties that help us operate the Services, such as authentication providers, infrastructure providers, and analytics tools. We may also receive information from publicly available sources for the purpose of verifying domain ownership or organisational identity.

• To operate, maintain, and improve the Services.
• To create and verify cryptographic credentials and audit trails.
• To authenticate users and protect against fraud, abuse, and security incidents.
• To communicate with you about your account, support requests, and changes to the Services.
• To comply with legal obligations and enforce our Terms of Service.
• With your consent, to send you information about products or features we think will be relevant.

We do not sell personal information. We do not use personal information to train third-party machine learning models.

If you are located in the European Economic Area, the United Kingdom, or another jurisdiction with similar requirements, we rely on the following legal bases to process your personal data:

• Performance of a contract, where processing is necessary to provide the Services you have requested.
• Consent, where you have given us specific consent to process your data, such as for marketing communications. You may withdraw consent at any time.
• Legitimate interests, where processing is necessary for our legitimate interests in operating, securing, and improving the Services, provided your rights do not override those interests.
• Legal obligation, where processing is necessary to comply with applicable law.

We share information only in the following circumstances:

• Between the parties to a verification case.By design, a credential signed by an Issuer is shared with the Applicant for approval and, on the Applicant's consent, with the Verifier who initiated the case.
• With service providers that help us operate the Services (such as hosting, authentication, monitoring, and analytics). These providers act under written contracts that restrict use of personal data.
• For legal reasons, including to comply with a valid legal request, to enforce our Terms, or to protect the rights, property, or safety of Yaatra, our users, or others.
• In connection with a business transaction such as a merger, acquisition, or sale of assets, in which case we will notify affected users.
• With your consent, for any other purpose disclosed at the time of collection.

Yaatra is operated from the United States, and personal data may be transferred to, processed in, and stored in countries other than the country in which it was collected. Where we transfer personal data from the European Economic Area, the United Kingdom, or other jurisdictions with restrictions on international transfers, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses and equivalent mechanisms, as applicable.

We retain personal data for as long as necessary to provide the Services, to comply with our legal obligations, to resolve disputes, and to enforce our agreements. Credential and audit-trail data is retained for the period required to preserve the integrity of the verification record, which may extend beyond the duration of an active account. Where you ask us to delete your account, we will delete or anonymise personal data that is no longer required to be retained.

Depending on where you live, you may have the following rights in relation to your personal data:

• Access. The right to ask us for a copy of the personal data we hold about you.
• Correction. The right to ask us to correct inaccurate or incomplete personal data.
• Deletion. The right to ask us to delete your personal data, subject to certain exceptions.
• Restriction. The right to ask us to restrict the processing of your personal data.
• Portability. The right to receive your personal data in a portable format.
• Objection. The right to object to certain processing, including processing based on our legitimate interests.
• Withdrawal of consent. Where processing is based on consent, the right to withdraw that consent at any time.
• Complaint. The right to lodge a complaint with your local data protection authority.

To exercise any of these rights, contact us at info@yaatra.app. We may need to verify your identity before responding to your request.

We take security seriously. Credentials are stored in cryptographically protected form, communications with the Services use industry-standard encryption in transit, and access to personal data within Yaatra is restricted to personnel who need it to operate the Services. No system is perfectly secure, and we cannot guarantee absolute security, but we work continuously to reduce risk and we will notify affected users in the event of a personal data breach as required by law.

The Services are intended for business and professional users and are not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at info@yaatra.app and we will take steps to delete the information.

We use cookies and similar technologies to keep you signed in, remember preferences, and understand how the Services are used. You can control cookies through your browser settings. Disabling some cookies may affect the functionality of the Services.

The Services may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties, and we encourage you to review their privacy policies before providing them with personal data.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by reasonable means, such as posting an updated effective date on this page or sending a notice to the email address on your account. Your continued use of the Services after the effective date of any updated Privacy Policy constitutes your acceptance of that Policy.

Questions about this Privacy Policy or our privacy practices should be sent to info@yaatra.app, Yaatra Inc., Delaware, United States.

Yaatra Inc., Delaware, United States  |  info@yaatra.app