Privacy policy
How mynxtrip collects, uses, shares and protects personal data, and the rights you have over it.
Last updated: 4 November 2026
Summary: we collect very little personal data. We never take bookings or payments, so we never receive your card, bank, UPI, passport, ID or itinerary details. We store your email address only if you subscribe to our newsletter, and we record basic, non-identifying information about which partner links are clicked. We do not sell personal data. Bookings you make with a Provider are covered by that Provider's privacy policy.
1. Scope and who we are
1.1 This Privacy Policy explains how [MYKA STAYS] ("mynxtrip", "we", "us", "our"), with its address at [Shop No 23, First Floor,Karma Point,Vasco da Gama Goa, India – 403802], processes personal data when you use mynxtrip.com, search.mynxtrip.com, our newsletter and related services (the "Service").
1.2 For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"), mynxtrip is the Data Fiduciary for the personal data described in this policy. We also follow the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, to the extent they apply.
1.3 This policy does not cover the websites, apps or services of Providers or other third parties, even if you reach them through the Service. Their own privacy policies apply.
1.4 This policy should be read together with our Terms of use and Cookie Policy.
2. Key terms
- Personal data means any data about an individual who is identifiable by or in relation to that data.
- Data Principal means the individual to whom the personal data relates, that is, you.
- Data Processor means a company that processes personal data on our behalf, such as our hosting provider.
- Processing means any operation on personal data, including collection, storage, use, sharing and erasure.
- Provider means an airline, travel agent, hotel or accommodation platform, affiliate network or other third party whose services are shown on or linked from the Service.
3. Our privacy principles
- Data minimisation: we collect only what we need for a clear purpose.
- Purpose limitation: we use data only for the purposes described here.
- Transparency: we tell you what we collect and why, in plain language.
- No sale: we never sell, rent or trade your personal data.
- Security: we take reasonable steps to protect the data we hold.
- Control: you can access, correct and delete your data, and withdraw consent.
4. Personal data we collect
| Category | Data | When |
|---|---|---|
| Newsletter subscription | Email address; the page where you signed up; date and time of sign-up | When you enter your email and click Subscribe |
| Outbound click records | The partner and link clicked; the page you were on; date and time; browser user-agent; approximate country derived from your network connection. We do not store your IP address in our click records. | When you click a search button or a partner link, which passes through mynxtrip.com/go |
| Correspondence | Your name, email address, phone number (if you give it) and the content of your message, including attachments | When you email us, contact our Grievance Officer or make a privacy request |
| Technical and log data | IP address, browser and device type, operating system, referring page, pages requested, date and time, and error information | Automatically, by our hosting provider, every time a page loads |
| Cookie and similar data | Identifiers and preferences stored by third-party tools and partners, such as affiliate tracking IDs, recent searches, filters, currency and cookie consent | Set by Travelpayouts, our White Label search and Providers, as described in our Cookie Policy |
5. Data we do not collect
5.1 We do not collect, receive or store:
- payment card numbers, CVV, expiry dates, bank account details, UPI IDs or PINs, OTPs or net-banking credentials;
- passport, Aadhaar, PAN, visa, driving licence or other identity document details;
- traveller names, dates of birth, nationality, frequent flyer numbers or Booking references;
- passwords for your Provider accounts; or
- health, biometric, caste, religion, sexual orientation, political or other sensitive personal data.
5.2 This information is entered only on the Provider's website when you book, and is governed by the Provider's privacy policy.
6. How we collect it
- Directly from you: when you subscribe, email us or make a request.
- Automatically: through server logs and our click-recording endpoint when you use the Service.
- From partners: affiliate networks may send us aggregated reports of clicks, bookings and commissions. These reports do not normally identify you, and we do not use them to identify you.
7. Why we use personal data, and on what basis
| Purpose | Data used | Basis under the DPDP Act |
|---|---|---|
| Sending newsletters, deal alerts and service updates you asked for | Email address, sign-up details | Your consent (section 6) |
| Replying to your messages, privacy requests and grievances | Correspondence | Data you have voluntarily provided for that purpose (section 7(a)), and compliance with law |
| Delivering, maintaining and securing the website; preventing fraud, abuse, bots and affiliate fraud | Technical and log data, click records | Legitimate uses permitted by law (section 7), and our reasonable security obligations |
| Understanding which pages and partners are useful, in aggregate, and reconciling commissions | Click records (non-identifying) | Processed in a form not used to identify you |
| Complying with legal obligations, court orders and requests from lawful authorities; establishing or defending legal claims | Any relevant data | Compliance with law and legitimate uses (section 7) |
We do not use personal data for profiling or automated decisions that produce legal or similarly significant effects for you, and we do not use it to target advertising at you.
8. Consent and how to withdraw it
8.1 Where we rely on consent, we ask for it through a clear, affirmative action, for example by entering your email and clicking Subscribe. We describe the purpose at the point of collection.
8.2 You may withdraw consent at any time, as easily as you gave it, by clicking "unsubscribe" in any email or by emailing grievance@mynxtrip.com. Once you withdraw consent, we will stop the processing and erase the related data within a reasonable time, unless we must keep it by law. Withdrawal does not affect processing carried out before it.
9. Emails and marketing
We send marketing emails only to people who have subscribed. Each email identifies mynxtrip as the sender and contains an unsubscribe link. We may record whether emails are delivered and opened, and which links are clicked, to improve our emails. We do not share your email address with Providers or advertisers.
10. Cookies and tracking
The main mynxtrip.com website does not set its own advertising or analytics cookies, and our fonts are hosted on our own servers. Third-party tools and partners, including Travelpayouts Drive, our White Label flight search and Providers, may set cookies or use similar technologies. Full details, and how to control them, are in our Cookie Policy.
11. Who we share personal data with
We share personal data only as described below, and only as much as is necessary:
- Data Processors (see section 12) who provide hosting, database, email and security services to us, under contracts that require them to protect the data and use it only on our instructions.
- Affiliate networks and Providers: when you click a partner link, your browser is sent to the partner with a tracking ID that identifies mynxtrip as the referrer. The partner may also receive technical data directly from your browser. The partner's use of that data is governed by its own privacy policy.
- Professional advisers, such as lawyers, accountants and auditors, under a duty of confidentiality.
- Government authorities, regulators and courts, where required by law, or where necessary to prevent fraud, protect our rights or protect the safety of any person.
- Business transfers: if mynxtrip is merged, acquired, restructured or sells its assets, personal data may be transferred to the successor, which will be bound by this policy or an equivalent one.
12. Our service providers
| Provider | Service | Data involved |
|---|---|---|
| Netlify, Inc. | Website hosting, content delivery and serverless functions | Technical and log data; processes click and subscription requests |
| Supabase, Inc. | Database | Newsletter subscribers; click records |
| Travelpayouts | Flight search technology (search.mynxtrip.com), affiliate tracking and Drive | Search queries, cookie data and technical data collected on its own systems |
| Email service provider | Sending newsletters | Email address; delivery and open data |
| Email hosting provider | Our mailboxes | Correspondence |
We may change or add service providers. Where a change materially affects how your data is handled, we will update this policy.
13. Where data is stored and transferred
Our service providers may store and process personal data in India and in other countries, including the United States, the European Union and Singapore. Where personal data is transferred outside India, we do so in accordance with section 16 of the DPDP Act and any restrictions notified by the Government of India, and we take reasonable steps to ensure the data receives an appropriate level of protection.
14. How long we keep data
| Data | Retention period |
|---|---|
| Newsletter email address | Until you unsubscribe or ask us to delete it. We then keep a minimal suppression record (your email address and opt-out date), so that we don't email you again. |
| Click records | Up to 24 months, then deleted or kept only in aggregated, non-identifying form |
| Correspondence, privacy requests and grievances | For as long as needed to deal with the matter, then up to 3 years, or longer if required by law or for a legal claim |
| Hosting logs | For the limited period set by our hosting provider |
When retention periods end, we securely delete or anonymise the data. Where the DPDP Rules require us to erase personal data after a specified period of inactivity, we will do so and give any notice the Rules require.
15. Your rights
Subject to the DPDP Act, the DPDP Rules and other Applicable law, you have the right to:
- Access: obtain a summary of the personal data we process about you, the processing activities, and the identities of the Data Fiduciaries and Data Processors we have shared it with;
- Correction and completion: have inaccurate or incomplete personal data corrected, completed or updated;
- Erasure: have your personal data erased where it is no longer needed for the purpose it was collected for, or where you withdraw consent, unless we must keep it by law;
- Withdraw consent at any time, as described in section 8;
- Nominate another individual to exercise your rights in the event of your death or incapacity (section 17); and
- Grievance redressal: have your grievances addressed by our Grievance Officer and, if you are not satisfied, complain to the Data Protection Board of India.
You also have a duty, under section 15 of the DPDP Act, not to provide false information, impersonate another person or file frivolous complaints.
16. How to make a request
- Email grievance@mynxtrip.com with the subject line "Privacy request".
- Tell us which right you want to exercise and give the email address or other details we hold about you.
- We may ask for information to verify your identity before we act, so that we don't disclose or delete someone else's data. We will use this only for verification.
- We will acknowledge your request within 48 hours and respond within the period required by law, and in any case within 30 days.
We do not charge for reasonable requests. We may refuse or limit a request where the law allows, for example if it is manifestly unfounded or would affect the rights of others, and we will explain why.
17. Nominating another person
You may nominate an individual to exercise your rights under the DPDP Act if you die or become incapable. To do so, email us the nominee's name and contact details and your relationship to them. You can change or cancel the nomination at any time.
18. Children
The Service is intended for adults aged 18 and over and is not directed at children. We do not knowingly collect personal data from children, and we do not track, monitor behaviour or target advertising at children. If you believe a child has given us personal data, contact us and we will delete it promptly. Where the law requires verifiable parental consent for a child's data, we will not process that data without it.
19. How we protect data
19.1 We implement reasonable security practices and procedures appropriate to the nature of the data, including:
- encryption of data in transit using HTTPS/TLS on all pages;
- database row-level security, so that the public website can only read published content and cannot read subscribers or click records;
- secret server-side keys stored as protected environment variables and never exposed in web pages;
- restricted, authenticated access to administrative dashboards, limited to people who need it;
- validation of outbound links to prevent the Service being misused for redirects to unknown sites; and
- periodic review of the data we hold, with deletion when it's no longer needed.
19.2 No method of transmission over the internet or of electronic storage is completely secure. While we work to protect your data, we cannot guarantee its absolute security.
20. Data breaches
If we become aware of a personal data breach, we will take prompt steps to contain and investigate it. We will notify the Data Protection Board of India and each affected Data Principal, in the form, manner and time required by the DPDP Act and DPDP Rules. The notice will describe the breach, its likely consequences, the steps we are taking, and what you can do to protect yourself.
21. Providers and third-party sites
When you leave the Service for a Provider, such as an airline, travel agent, Booking.com, Agoda or an affiliate network, that Provider collects and processes your personal data as an independent Data Fiduciary under its own privacy policy. We are not responsible for Providers' privacy or security practices. Please read their policies before you share information or make a Booking.
22. Do Not Track
Some browsers send a "Do Not Track" signal. As there is no common standard for responding to these signals, the Service does not currently respond to them. You can control cookies as described in our Cookie Policy.
23. Changes to this policy
We may update this policy from time to time to reflect changes in the law, our Service or our partners. The updated policy takes effect when published on this page, with a new "Last updated" date. If we make a material change to how we use your personal data, we will notify subscribers by email and, where required, ask for fresh consent.
24. Grievance Officer, complaints and contact
For any question, request or complaint about this policy or our handling of personal data, contact our Grievance Officer:
- Name: [TBA]
- Designation: Grievance Officer
- Email: grievance@mynxtrip.com
- Phone:
- Address: [MYKA STAYS], [Shop No 23, First Floor,Karma Point,Vasco da Gama Goa, India – 403802]
We will acknowledge your grievance within 48 hours and respond within the time required by law. If you are not satisfied with our response, you may complain to the Data Protection Board of India, after first raising your grievance with us as required by the DPDP Act.