Privacy Policy

Last updated: June 10, 2026

This Privacy Policy explains how KOVANS VENTURES PRIVATE LIMITED (“we”, “us”, or “bucketlistt”) collects, uses, shares, retains, and protects personal information when you use https://bucketlistt.com (the “Platform”), our booking and checkout flows, and connected services such as our Model Context Protocol (MCP) integration that lets you discover and book experiences through supported AI assistants (e.g. ChatGPT).

By using the Platform or completing a booking, you acknowledge this Policy. If you do not agree, please do not use our services.

1. Information we collect

Depending on how you use bucketlistt, we may collect the following categories of information:

1.1 Account and identity

• Phone number — for OTP login, booking contact, and service messages
• Name — when you create an account, complete checkout, or verify OTP as a new user
• Email address — if you provide it at signup or checkout
• Authentication data — session tokens (e.g. JWT) issued after successful OTP verification; we do not store your OTP after it is used or expires

1.2 Booking and cart data

• Contact details at checkout — contact person name, phone number, and optional email
• Activity selections — destination, experience/provider, activity, date, time slot, participant count, and optional add-ons
• Cart contents — items you add, update, or remove before payment
• Booking records — booking numbers, status, amounts (MRP, selling price, advance paid), and related metadata after confirmation
• How you found us — optional source selection at checkout (e.g. Meta ads, Instagram, WhatsApp, reference) where you choose to provide it

1.3 Payment information

Payments are processed by Razorpay and other authorised payment partners. We receive payment status, order/receipt identifiers, and amounts — not your full card or UPI credentials. Card and banking details are handled directly by the payment processor under their privacy terms.

1.4 Communications

• SMS — OTP codes for login (via our messaging provider)
• WhatsApp — booking confirmations, reminders, tickets, and related service messages where applicable
• Email — booking updates and support correspondence if you provide an email address

1.5 Browse and usage data

• Pages, activities, and destinations you view on the Platform
• Search and filter inputs (e.g. city, activity name, tags such as “bungee” or “rafting”)
• Device type, browser, IP address, approximate location derived from IP, referrer, and timestamps
• Cookies and similar technologies used for session management, security, and analytics (see Section 8)

1.6 Data when you use bucketlistt through an AI assistant (MCP)

If you connect to bucketlistt via a supported AI assistant using our MCP server, the assistant may send us tool inputs on your behalf, including:

• Phone numbers for send_otp and verify_otp
• Destination, activity, date, and slot preferences for catalogue and availability tools
• Authentication tokens returned after OTP verification, used for cart and checkout tools
• Contact name, phone, email, and cart/booking line items for payment and order tools

We return tool outputs such as catalogue listings, slot availability, cart summaries, payment links, order details, and booking lists. The AI platform you use (e.g. OpenAI) also processes your conversation and may store prompts and responses under its own privacy policy. We do not control how third-party AI clients retain or use chat content outside what is sent to bucketlistt tools.

2. How we use your information

We use personal information to:

• Create and manage your account and authenticate you (including OTP login)
• Display activities, prices, slots, and add-ons; maintain your cart
• Process bookings and payments and confirm reservations with experience operators
• Send transactional messages (OTP, booking confirmation, reminders, tickets via SMS/WhatsApp/email)
• Provide customer support and respond to enquiries
• Prevent fraud, enforce rate limits, and protect the security of our systems
• Operate and improve the Platform, including MCP tool performance and reliability
• Comply with law, respond to lawful requests, and resolve disputes
• Analyse aggregated or de-identified usage trends to improve our catalogue and UX

We do not use your phone number or booking data to send unrelated third-party marketing without your consent where consent is required by law.

2.1 Legal bases (where applicable)

Where required by applicable law, we rely on: performance of a contract (to complete your booking); legitimate interests (security, fraud prevention, service improvement); and consent (e.g. optional marketing or non-essential cookies where applicable).

3. Who we share information with

We do not sell your personal information. We share data only as needed to operate the Platform:

• Experience operators / vendors — name, contact number, booking date, activity, participant count, and amounts needed to deliver your booking
• Razorpay — payment processing, fraud checks, and settlement
• MSG91 and similar messaging providers — OTP SMS and WhatsApp delivery
• Cloud and infrastructure providers — hosting, databases, CDN, and backups (data stored primarily in India or as configured for our stack)
• Analytics and monitoring tools — limited technical and usage data to keep the Platform reliable
• AI assistant platforms — when you use bucketlistt through MCP, data you submit in chat may be processed by that platform before and after it calls our tools; review that platform’s privacy policy
• Professional advisers and authorities — lawyers, auditors, insurers, courts, or regulators when required by law or to protect rights and safety

Operators are independent parties; their handling of your data during the activity is also governed by their policies and applicable law.

4. How long we keep information

• OTP records — deleted after successful verification or expiry (typically within 10 minutes of issuance)
• Account data — retained while your account is active and for a reasonable period after closure for legal, tax, and dispute resolution needs
• Booking and payment records — retained as required for accounting, consumer protection, and Operator settlement (typically several years unless a longer period is required by law)
• Cart data — retained until checkout, removal, or account deletion, subject to backup cycles
• MCP server logs — session, tool-call, and error logs retained for a limited period for security and debugging, then deleted or aggregated
• Marketing preferences — until you withdraw consent or we no longer need them

We may retain anonymised or aggregated data that does not identify you for analytics and product improvement.

5. Your choices and rights

Depending on applicable law, you may have the right to:

• Access — request a copy of personal information we hold about you
• Correction — ask us to update inaccurate account or contact details
• Deletion — request deletion of your account and associated data, subject to legal retention obligations (e.g. completed bookings)
• Withdraw consent — where processing is based on consent (e.g. optional marketing)
• Object or restrict — certain processing where provided by law

To exercise these rights, email support@bucketlistt.com. We may need to verify your identity before fulfilling a request.

AI assistant users: To limit data sent through MCP, avoid sharing unnecessary personal details in chat and use the Platform directly at bucketlistt.com if you prefer not to route requests through a third-party AI client.

OTP and checkout: Rate limits apply to OTP and payment tools to prevent abuse; if you are blocked by limits, wait for the indicated period or contact support.

6. Security

We use reasonable technical and organisational measures (encryption in transit, access controls, monitoring) to protect your information. No online system is completely secure; please use a strong device lock and do not share OTP codes or auth tokens with others.

7. Children

The Platform is not directed at children under 18 for account creation. Bookings for minors should be made by a parent or legal guardian who accepts our Terms and this Policy on their behalf.

8. Cookies and similar technologies

We use cookies and local storage for login sessions, cart state, security, and analytics. You can control cookies through your browser settings; disabling essential cookies may affect checkout and login.

9. International transfers

Our primary operations and data storage are in India. Some service providers (e.g. payment, messaging, or AI platforms) may process data in other countries with safeguards as required by applicable law.

10. Changes to this Policy

We may update this Privacy Policy to reflect new features (including MCP tools), legal requirements, or business practices. The “Last updated” date will change when we do. Material changes may be communicated via the Platform or email where appropriate.

11. Contact us

Email: support@bucketlistt.com
Website: bucketlistt.com/contact

For privacy-related complaints, contact us at the email above. If you are not satisfied with our response, you may have the right to lodge a complaint with your local data protection authority where applicable.