Your Privacy, Explained Plainly

By visiting our website, using our app or sharing information with us — for example when you make a booking or a payment — you agree to the practices described in this Privacy Policy.

You can withdraw your consent at any time by emailing mufazzel@ibos.io or writing to us at . Withdrawing consent may limit our ability to provide some services to you.

We may collect personal information and other information directly from you, from your devices, or from third parties, as described below.

Personal information is anything that identifies you as an individual or relates to an identifiable person. Depending on how you use our services, this may include:

• Contact details: name, email address, phone number, postal address.
• Travel details: passport and visa numbers, government-issued ID details, bookings, travel history and preferences such as meal requests.
• Transaction details: we do not store card numbers, CVV codes or expiry dates. Payments are handled by third-party gateways; we keep only the transaction reference, amount, your email and the gateway code for reconciliation.
• Location data: your device's location while the app is in use, and an approximate location derived from your IP address.
• Device and app data: device model, operating system, app usage logs, crash reports and device identifiers.
• Documents you upload: photos or files shared for booking or visa verification.
• Biometric sign-in: only if you switch on fingerprint or face unlock in the app; the biometric itself stays on your device.
• Social sign-in: your social account ID and anything you share through social features.

• Directly from you — when you fill in a booking or registration form, pay, enter a promotion or contact customer service.
• Through device permissions — when you grant access to location, camera, gallery, storage or biometrics.
• Automatically — through cookies, pixel tags, server logs and analytics tools such as Firebase Analytics.
• Through our mobile app — including usage logs, push-notification tokens and crash diagnostics.
• From third parties — social platforms, public databases, marketing partners and the airlines, hotels and suppliers who fulfil your booking.

• Fulfilling bookings: processing reservations, payments, tickets, vouchers and travel documents.
• Personalisation: tailoring fares, offers and destination content to your preferences.
• Customer service: answering enquiries and resolving issues with bookings or your account.
• Communication: sending booking confirmations, reminders, administrative notices and — with your consent — newsletters and promotions.
• Running the business: analytics, fraud prevention, auditing, security monitoring and product improvement.
• Legal compliance: meeting our obligations under applicable law and responding to lawful requests.

We share personal information only where it is needed to serve you or required by law, with:

• Travel partners — airlines, hotels, consolidators, visa processors, insurers and car-rental providers who fulfil your booking.
• Service providers — hosting, analytics, payment processing, customer-support and marketing vendors acting on our instructions.
• Our group companies — parent, subsidiary and affiliated companies, for the purposes described in this policy.
• Social and marketing platforms — subject to your settings and consent, for social sharing or personalised advertising.
• Regulators and authorities — where the law requires it or to protect rights, safety and property.
• A successor business — in the event of a merger, sale or reorganisation, under the same protections.

Information that does not identify you on its own — browser and device configuration, app usage patterns, cookies and local storage, and aggregated demographic data — helps us understand how our services are used. We use it to improve reliability, run internal analysis and personalise content.

We do not collect or process sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, trade-union membership, health information or sexual orientation.

To arrange travel we may, when strictly necessary, collect government-issued ID (passport, national ID), visa copies and other documents an airline, consulate or embassy requires. These are used only for the booking, visa submission, verification or regulatory compliance in question — never for profiling or marketing.

App permissions and consent

Permissions are requested in the app at the moment they are needed, with a clear explanation of why — never in bulk at first launch.

Google Play data safety

Our collection, sharing and retention practices match the disclosures in the Google Play Data Safety section: what data is collected, why, whether it is shared, and whether providing it is optional.

This policy does not cover, and we are not responsible for, the privacy practices of third parties, including:

• Suppliers, intermediaries and platforms linked from our services.
• Widgets and plug-ins embedded in our site or app, such as social sharing buttons.
• Social networks, device manufacturers, operating-system vendors and mobile carriers.

Please review their privacy policies before sharing data with them.

We do not sell user data — personal or sensitive — to any third party.

Our services are not designed for children. We comply with the Google Play Families Policy and do not knowingly collect personal data from children; if you believe a child has provided us information, contact us and we will delete it.

We apply reasonable organisational, technical and administrative safeguards to protect personal information from unauthorised access, disclosure, alteration or destruction. No method of transmission or storage is completely secure, but our practices include:

• Token-based authentication so only authorised sessions reach protected resources.
• Encrypted storage for sensitive data, using industry-standard protocols.
• Role-based access control that separates guest, signed-in and staff access.
• Continuous monitoring — regular audits, secure coding practices and system monitoring.

If you believe your account has been compromised, notify us immediately using the contact details at the end of this page.

• Biometrics — sign in with fingerprint or face recognition.
• Camera and gallery — upload travel documents or images.
• Storage — save booking confirmations and invoices.
• Location — pre-fill your departure city and show nearby options.
• Notifications — booking alerts, reminders and, if you opt in, offers.

Every permission is optional and requested only when the feature needs it.

You can opt out of marketing emails at any time using the unsubscribe link in each email or by contacting us. Push notifications can be switched off in your device settings.

We act on opt-outs as soon as reasonably practicable. Even after opting out you will still receive essential administrative and transactional messages about your bookings and account.

You may ask us to review, correct, update, suppress or delete the personal information you have given us by contacting us using the details at the end of this page. Tell us clearly what you would like changed or removed.

For your protection we act only on requests relating to the email address you write from, and we may need to verify your identity first. Some information must be kept for record-keeping or to complete a transaction you started, and residual copies may remain in backups for a limited time.

We keep personal information for as long as needed to fulfil the purposes described in this policy, unless a longer period is required or permitted by law — for example for tax, accounting or dispute-resolution obligations.

Our services are intended for adults. Anyone under eighteen should not provide personal information through the website or app; bookings for minors must be made by a parent or guardian.

We may update this Privacy Policy from time to time. The date at the top of this page shows when it was last revised, and changes take effect when the revised policy is published on our website and app. Continuing to use our services after that date means you accept the revised policy.

The current version is always available on our website and inside the app under Account → Privacy Policy.