Your travel data, protected at every step
PepTrvl handles employee details, travel plans and company billing. Here is exactly how we collect, store and protect that information, written for the finance, HR and IT teams who need to sign off.
Data protection & privacy
We collect only what is needed to book and bill your company’s travel, and we handle it in line with India’s Digital Personal Data Protection (DPDP) Act, 2023.
- What we collect
Employee name, work email, phone number, travel preferences, and ID details only when an airline or hotel requires them. Company GSTIN and billing details for invoicing.
- Why we collect it
To search, book, approve and invoice trips on your behalf. We do not sell personal data or use it for advertising.
- Where it is stored
All data is stored on servers run by Contabo, our hosting provider.
- Your control
Your admin can export reports at any time, and request deletion when you leave PepTrvl. Employees can ask to see or correct their own data.
How your data is secured
Security controls built into the platform, not added on later.
- Encryption
All traffic uses HTTPS (TLS 1.2 or higher).
- Role-based access
Employees see only their own trips. Managers see their team. Finance sees billing and reports. Admins control who gets which role.
- Secure sign-in
Each person signs in with their own password or a one-time code sent to their work email. Idle sessions sign out automatically, and anyone can sign out their other devices.
- Audit trail
Every booking, approval, change and cancellation is logged with who did it and when.
- Staff access
Only PepTrvl team members who need it to support your bookings can access your data, and that access is logged. All staff sign confidentiality agreements.
WhatsApp & AI
How employee messages and the AI assistant handle your information.
- Official WhatsApp Business API
Messages go through Meta’s official WhatsApp Business API, never a personal phone number.
- Your data does not train AI models
Trip requests are processed only to prepare your booking. We do not use your company’s data to train AI models.
- A person always approves
The AI prepares options within your policy. Nothing is booked or charged until an authorised approver confirms.
- Only verified numbers can book
Bookings are accepted only from phone numbers your admin has added to your company account.
Payments
- We never store card details
Card numbers never touch PepTrvl’s servers.
- Company wallet and credit
Wallet top-ups and credit-line usage are recorded against each booking, with real-time balances visible to your finance team.
Reliability & incident response
- If the platform is down
Our travel team can still book for you over phone or WhatsApp.
- If something goes wrong
If we find a security incident affecting your data, we will inform your admin, explain what happened and what we are doing about it, and notify authorities where the law requires it.
Third parties we work with
We share only what each service needs to do its job.
| Service | Purpose | Provider |
|---|---|---|
| Cloud hosting | Runs the platform and stores data | Contabo |
| Flights & hotels | Receive traveller details needed to issue tickets and reservations | Airlines, hotels and our booking suppliers |
| AI processing | Understands trip requests | OpenAI |
For procurement & IT teams
Documents we can share during your evaluation.
Standard DPA covering DPDP Act obligations.
We complete your vendor security questionnaire.
A short document you can share with your IT team.
Questions or found a vulnerability?
Write to our security team.
security@peptrvl.comLast updated: 5 October 2026