Privacy Policy

1 Who We Are

TRAVLA is a shared intercity trip booking platform operating in Ghana. We connect travellers with verified transport operators for routes between major cities and towns across the country. TRAVLA is owned and operated by PLUTOSAT Enterprise, a registered business in Ghana.

This Privacy Policy explains what personal data we collect when you use travlagh.com or our mobile application, why we collect it, how we use it, and the rights you have over it. It is governed by Ghana's Data Protection Act, 2012 (Act 843).

2 Information We Collect

Information you provide directly:

• Account registration — full name, email address, phone number, and a hashed password.
• Bookings — origin, destination, travel date, seat preferences, and passenger details.
• Payment — mobile money number or card details entered on Paystack's secure checkout. TRAVLA never stores raw card numbers or mobile money PINs.
• Profile updates — any changes you make to your name, phone, or notification preferences.

Information collected automatically:

• Device push token (FCM) — collected when you grant notification permission, used only to send you booking and trip updates.
• Login timestamps — we record when you last signed in to help detect suspicious access.
• OAuth identifiers — if you sign in with Google or Yahoo, we store only the unique ID and email returned by that provider. We do not receive your social media passwords.

3 How We Use Your Information

• Process and confirm trip bookings and generate your QR e-ticket.
• Send SMS and push notification reminders about upcoming trips.
• Calculate and award loyalty points and tier status (Bronze, Silver, Gold).
• Process refunds and wallet credits.
• Verify your phone number via one-time passwords (OTP).
• Detect and prevent fraudulent bookings and account abuse.
• Improve the platform based on aggregated, anonymised usage patterns.
• Respond to support requests and complaints.

We do not use your data for targeted advertising or sell it to marketing companies.

4 Third-Party Services

TRAVLA integrates with the following third-party services to operate. Each has its own privacy policy.

These processors act on our instructions and are contractually required to keep your data confidential and secure.

5 Data Sharing

We share your personal data only in these limited circumstances:

• Transport operators — your name and seat number are shared with the operator of your booked trip to verify boarding. No contact details are shared.
• Payment processors — your payment details are passed directly to Paystack. We receive only a transaction reference and status.
• Legal obligations — if required by Ghanaian law, court order, or regulatory authority.
• Business transfers — in the unlikely event of a merger or acquisition, your data may transfer to a successor entity under the same protections.

We never sell your personal data to any third party.

6 Data Security

We implement industry-standard measures to protect your data:

• Passwords are stored as bcrypt hashes — we cannot read your password.
• All data in transit is encrypted over HTTPS/TLS.
• Database access is restricted to authorised application processes only.
• JWT tokens expire after 24 hours.
• OTP codes expire after 10 minutes and are single-use.

No method of transmission over the internet is 100% secure. If you suspect unauthorised access to your account, please contact us immediately.

7 Your Rights

Under Ghana's Data Protection Act, 2012 (Act 843), you have the right to:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to correct inaccurate or incomplete data.
• Deletion — request deletion of your account and associated data, subject to our legal retention obligations.
• Objection — object to how we process your data in certain circumstances.
• Portability — request your data in a machine-readable format.

To exercise any of these rights, email us at support@travlagh.com. We will respond within 30 days.

8 Data Retention

We retain your data for as long as your account is active or as needed to provide services:

• Account data — retained until you delete your account.
• Booking records — retained for 7 years for financial and legal compliance.
• OTP codes — deleted automatically after 10 minutes.
• Push tokens (FCM) — removed when you revoke notification permission or delete your account.
• Payment references — retained for 7 years in line with Ghanaian financial regulations.

9 Cookies & Local Storage

TRAVLA uses browser localStorage to store your JWT authentication token so you remain signed in between sessions. We do not use third-party tracking cookies or advertising cookies.

Google Fonts and Firebase scripts loaded on our pages may set their own cookies subject to Google's privacy policy. You can block these via your browser settings without affecting core booking functionality.

10 Children's Privacy

TRAVLA is not directed at children under 16 years of age. We do not knowingly collect personal data from anyone under 16. If you believe a child has registered without parental consent, please contact us and we will promptly delete the account.

11 Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. For material changes, we will notify registered users by email or in-app notification at least 14 days before the changes take effect.

Continued use of TRAVLA after the effective date constitutes acceptance of the updated policy.

12 Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy:

• Email: support@travlagh.com
• Phone: +233 591 213 600
• Phone: +233 591 233 788
• Website: travlagh.com

You also have the right to lodge a complaint with Ghana's Data Protection Commission at dataprotection.org.gh.