TRIPFLOW CRM
Terms of Service Terms Return to Portal Portal
ZERO-INSPECTION DATA COMMITMENT

Privacy & Data Protection Policy

Transparent principles defining tenant data ownership, cryptographic isolation, and our binding pledge that we never view, inspect, or monetize your business records.

Effective Date: November 1, 2026 • Version: 3.2 (Production Release)
100% Tenant Owned

Your client and quote data belongs solely to you

Zero-Inspection

We do not view, mine, or share your agency records

Partition Isolation

Strict multi-tenant database boundary enforcement

256-Bit Encryption

TLS in transit & Bcrypt one-way password hashing

Principle 01

Absolute Tenant Data Ownership

At TripFlow CRM, we believe that an enterprise SaaS provider must never claim proprietary rights or commercial leverage over the data generated by its customers.

Permanent Data Ownership Guarantee

The Tenant (your travel agency or company) retains exclusive, unconditional ownership, legal title, and intellectual property rights in all business records uploaded to, processed by, or created in your CRM tenant instance. This encompasses all customer directories, traveler names, mobile numbers, email addresses, passport/visa details, private supplier pricing contracts, custom day-wise tour itineraries, margin markups, booking records, and employee notes.

TripFlow CRM holds no claim of copyright, trademark, or commercial ownership over your data. You may export or purge your records at your sole discretion.

Principle 02

The "Zero-Inspection" Covenant: We Do Not View Your Data

To provide absolute legal certainty and professional peace of mind, TripFlow CRM formally makes the following binding non-inspection commitments:

Binding Non-Inspection Undertakings
  • No Human Inspection: Platform staff, developers, founders, and system operators are strictly forbidden from viewing, browsing, reading, or auditing the contents of your customer lists, itinerary proposals, booking records, or quoted pricing.
  • No Data Reselling or Brokerage: We do not sell, rent, monetize, license, or exchange Tenant customer data, contact directories, or traveler details with any third party, advertising network, or data aggregator.
  • No Direct Traveler Engagement: We will never contact, solicit, market, or advertise to your agency's clients, travelers, or inquiries. Your clients remain exclusively yours.
  • No Competitive Use of Supplier Rates: We do not extract, aggregate, or use your private hotel, cab, or tour operator rates for our own or any other party's commercial negotiations.
Principle 03

Multi-Tenant Logical Separation & Architectural Isolation

TripFlow CRM is architectured on a hardened multi-tenant software model designed to ensure that each agency operates within a completely private, isolated digital workspace:

  • Database Boundary Enforcement: Every database table containing customer leads, itineraries, quotations, bookings, employees, and settings is partition-keyed by an immutable tenant_id. All SQL queries execute through automated multi-tenant scope filters, rendering it technically impossible for one agency to query or view records belonging to another agency.
  • Role-Based Access Control (RBAC): Within your agency's workspace, granular permissions control which employees can view customer leads, edit itineraries, manage bookings, or view overall profit margins.
  • Session Boundary Protection: Cross-tenant session hijacking is blocked via cryptographically randomized session tokens and automatic session invalidation upon authentication state changes.
Principle 04

Scope of Information Handled

To clarify the boundary between platform operational records and your private business data:

Data Category Specific Examples Usage & Access Policy
Tenant Business Records 100% Private Client names, passport numbers, travel dates, itinerary details, booking confirmations, quoted margins, agency supplier costs. Zero inspection. Processed and stored exclusively for your agency's operations. Never accessed by platform staff.
Account Administration Agency legal business name, admin contact name, billing email, contact phone number, subscription tier. Used strictly for CRM billing, subscription renewal notices, and official system announcements.
Security Telemetry & Audit Logs Login timestamps, IP addresses for rate limiting, failed login counters, system exception stack traces. Automated security telemetry used exclusively to detect brute-force attacks and prevent malicious network flooding.
Principle 05

Technical Support & Infrastructure Access Controls

Platform infrastructure engineers and support personnel are governed by strict protocols restricting database access:

  • Automated Operations: Scheduled backups, database indexing, and server maintenance run unattended via automated system daemons without manual human intervention.
  • Support by Written Request Only: In the event the Tenant requests technical assistance (e.g. troubleshooting a specific quotation calculation issue or booking record error), technical engineers will access the specific tenant partition only after receiving explicit written confirmation and authorized ticket verification from the Tenant's primary administrator.
  • Confidentiality Obligations: All technical staff operate under executed Non-Disclosure Agreements (NDAs) subject to severe civil and contractual liability.
Principle 06

Cryptographic & Server Security Safeguards

TripFlow CRM incorporates multi-layered technical controls to guard your workspace against unauthorized access:

  • Data in Transit: All HTTP communications are forced to HTTPS using 256-bit TLS/SSL encryption. Plaintext HTTP traffic is rejected at the server gateway.
  • Password Hashing: User passwords are never stored in plaintext or reversible formats; they are cryptographically hashed using standard Bcrypt algorithms with salt.
  • Brute-Force & Attack Rate Limiting: Authentication endpoints enforce dual-layer rate limiting (account-level and IP-level) with progressive cooldown lockouts to prevent automated credential-stuffing and dictionary attacks.
  • Server-Level Direct Access Restrictions: Hardened Apache .htaccess directives forbid public access to configuration files (.env), internal source code, databases, and logs.
  • Upload Script Execution Prevention: Storage directories (uploads, galleries, documents) strictly disable PHP and CGI script engines, neutralizing webshell and arbitrary code execution vectors.
Principle 07

Data Retention, Portability & Secure Purging

We ensure complete transparency throughout your subscription lifecycle:

  • Active Subscription: Your data remains continuously accessible and preserved in active production partitions throughout the duration of your active subscription.
  • 14-Day Export Grace Window: Should you choose not to renew your subscription, your tenant database remains preserved for 14 calendar days, during which you can download complete exports of your customer contacts and quotation histories.
  • Permanent Cryptographic Purging: Following the grace window or upon verified written request from the Tenant Administrator for account termination, all tenant records, uploaded files, and customer assets are permanently purged from active production databases in accordance with standard data sanitization procedures.
Principle 08

Incident Response & Security Inquiries

In the unlikely event of an identified security breach or unauthorized access attempt impacting your workspace, the Platform Provider maintains an emergency incident response protocol:

  • Timely Notice: The Platform Provider will notify the Tenant's primary account administrator via email within 48 hours of verified identification of a material security compromise.
  • Mitigation & Remediation: Immediate containment measures (credential revocation, IP blocking, patch deployment) will be executed without delay.

For technical security disclosures, data compliance inquiries, or custom Data Processing Agreements (DPA), please contact:

privacy@tripflowcrm.in • support@tripflowcrm.in

Review Terms of Service