Privacy Policy

Last updated: July 14, 2026

This Privacy Policy explains how KOVANS VENTURES PRIVATE LIMITED (“we”, “us”, or “bucketlistt”) collects, uses, shares, retains, and protects personal information when you use https://bucketlistt.com (the “Platform”), our booking and checkout flows, and connected services such as our Model Context Protocol (MCP) integration that lets you discover and book experiences through supported AI assistants (e.g. ChatGPT).

By creating an account, submitting information through the Platform, or completing a booking, you consent to the collection, use, disclosure, and processing of your personal data for the purposes described in this Privacy Policy. If you do not agree, please do not use our services.

1. Information we collect

Depending on how you use bucketlistt, we may collect the following categories of information:

1.1 Account and identity

• Phone number — for OTP login, booking contact, and service messages
• Name — when you create an account, complete checkout, or verify OTP as a new user
• Email address — if you provide it at signup or checkout
• Authentication data — session tokens (e.g. JWT) issued after successful OTP verification; we do not store your OTP after it is used or expires

1.2 Booking and cart data

• Contact details at checkout — contact person name, phone number, and optional email
• Activity selections — destination, experience/provider, activity, date, time slot, participant count, and optional add-ons
• Cart contents — items you add, update, or remove before payment
• Booking records — booking numbers, status, amounts (MRP, selling price, advance paid), and related metadata after confirmation
• How you found us — optional source selection at checkout (e.g. Meta ads, Instagram, WhatsApp, reference) where you choose to provide it

1.3 Payment information

Payments are processed by Razorpay and other authorised payment partners. We receive payment status, order/receipt identifiers, and amounts — not your full card or UPI credentials. Card and banking details are handled directly by the payment processor under their privacy terms.

1.4 Communications

• SMS — OTP codes for login (via our messaging provider)
• WhatsApp — booking confirmations, reminders, tickets, and related service messages where applicable
• Email — booking updates and support correspondence if you provide an email address

1.5 Browse and usage data

• Pages, activities, and destinations you view on the Platform
• Search and filter inputs (e.g. city, activity name, tags such as “bungee” or “rafting”)
• Device type, browser, IP address, approximate location derived from IP, referrer, and timestamps
• Cookies and similar technologies used for session management, security, and analytics (see Section 8)

1.6 Data when you use bucketlistt through an AI assistant (MCP)

If you connect to bucketlistt via a supported AI assistant using our MCP server, the assistant may send us tool inputs on your behalf, including:

• Phone numbers for send_otp and verify_otp
• Destination, activity, date, and slot preferences for catalogue and availability tools
• Authentication tokens returned after OTP verification, used for cart and checkout tools
• Contact name, phone, email, and cart/booking line items for payment and order tools

We return tool outputs such as catalogue listings, slot availability, cart summaries, payment links, order details, and booking lists. The AI platform you use (e.g. OpenAI) also processes your conversation and may store prompts and responses under its own privacy policy. We do not control how third-party AI clients retain or use chat content outside what is sent to bucketlistt tools. AI providers operate independently under their own privacy policies and bucketlistt is not responsible for their independent processing activities.

2. How we use your information

We use personal information to:

• Create and manage your account and authenticate you (including OTP login)
• Display activities, prices, slots, and add-ons; maintain your cart
• Process bookings and payments and confirm reservations with experience operators
• Send transactional messages (OTP, booking confirmation, reminders, tickets via SMS/WhatsApp/email)
• Provide customer support and respond to enquiries
• Prevent fraud, enforce rate limits, and protect the security of our systems
• Operate and improve the Platform, including MCP tool performance and reliability
• Comply with law, respond to lawful requests, and resolve disputes
• Analyse aggregated or de-identified usage trends to improve our catalogue and UX

We do not use your phone number or booking data to send unrelated third-party marketing without your consent where consent is required by law.

Personal information is processed only for the purposes described in this Privacy Policy unless required by law or with your additional consent.

2.1 Legal bases (where applicable)

Where required by applicable law, we rely on: performance of a contract (to complete your booking); legitimate interests (security, fraud prevention, service improvement); and consent (e.g. optional marketing or non-essential cookies where applicable).

2.2 Data minimisation

bucketlistt collects only personal information that is reasonably necessary for the purposes described in this Privacy Policy. We do not collect unnecessary personal information. Information is collected only for specified business purposes, including account management, booking fulfilment, payment processing, customer support, security, and legal compliance.

3. Who we share information with

We do not sell your personal information. We share data only as needed to operate the Platform:

• Experience operators / vendors — we share only the minimum personal information reasonably necessary to fulfil your booking (such as name, contact number, booking date, activity, participant count, and amounts). Such sharing is solely for the purpose of enabling the Operator to deliver the booked experience. Operators may not use your information for unrelated marketing, may not sell your information, and may not retain it longer than necessary for booking fulfilment and their legal obligations. Operators must comply with applicable privacy laws, including the Digital Personal Data Protection Act, 2023 where applicable
• Razorpay — payment processing, fraud checks, and settlement
• MSG91 and similar messaging providers — OTP SMS and WhatsApp delivery
• Cloud and infrastructure providers — hosting, databases, CDN, and backups (data stored primarily in India or as configured for our stack)
• Analytics and monitoring tools — limited technical and usage data to keep the Platform reliable
• AI assistant platforms — when you use bucketlistt through MCP, data you submit in chat may be processed by that platform before and after it calls our tools; review that platform’s privacy policy
• Professional advisers and authorities — lawyers, auditors, insurers, courts, or regulators when required by law or to protect rights and safety

This sharing reflects purpose limitation and accountability: Operators are independent parties who receive personal information only as needed to fulfil your booking, and their handling of your data remains subject to applicable law and their own obligations. bucketlistt expects Operators to process shared personal information only for booking fulfilment and related legal requirements.

4. How long we keep information

• OTP records — deleted after successful verification or expiry (typically within 10 minutes of issuance)
• Account information — retained while your account is active and until you request deletion, plus any period required to meet legal, tax, dispute resolution, or accounting obligations
• Booking and payment records — retained for up to eight (8) years from the relevant booking or transaction, unless a longer period is required by applicable law, accounting, consumer protection, or Operator settlement obligations
• Cart data — retained until checkout, removal, or account deletion, subject to backup cycles
• Logs (including MCP server logs) — session, tool-call, error, and similar logs retained only for a limited period as reasonably necessary for security, monitoring, and debugging, then deleted or aggregated
• Marketing preferences — retained until you withdraw consent or we no longer need them for the stated purpose

We may retain anonymised or aggregated data that does not identify you for analytics and product improvement.

5. Your choices and rights

Depending on applicable law, you may have the right to:

• Access — request a copy of personal information we hold about you
• Correction / update — ask us to correct or update inaccurate or incomplete account, contact, or booking-related details
• Deletion — request deletion of your account and associated data, subject to legal retention obligations (e.g. completed bookings)
• Withdrawal of consent — withdraw consent where processing is based on consent (e.g. optional marketing). Please note that withdrawing consent may affect our ability to complete bookings or provide certain services that depend on the relevant personal information
• Grievance redressal — raise privacy-related complaints with our Grievance Officer as described in Section 11
• Object or restrict — certain processing where provided by law

To exercise these rights, email support@bucketlistt.com. We may need to verify your identity before fulfilling a request.

AI assistant users: To limit data sent through MCP, avoid sharing unnecessary personal details in chat and use the Platform directly at bucketlistt.com if you prefer not to route requests through a third-party AI client.

OTP and checkout: Rate limits apply to OTP and payment tools to prevent abuse; if you are blocked by limits, wait for the indicated period or contact support.

6. Security

We implement reasonable technical and organisational measures designed to protect personal information, having regard to the nature of the data and the risks involved. These measures may include HTTPS encryption in transit, authentication controls, role-based access controls, limited employee access on a need-to-know basis, monitoring, backups, and hosting on secure cloud infrastructure. We periodically review our security practices. No online system is completely secure; please use a strong device lock and do not share OTP codes or auth tokens with others.

If bucketlistt becomes aware of a personal data breach affecting personal information, we will take reasonable steps to investigate, mitigate the impact, and comply with applicable legal notification requirements.

7. Children

The Platform is not directed at children under 18 for account creation. Bookings for minors should be made by a parent or legal guardian who accepts our Terms and this Policy on their behalf.

8. Cookies and similar technologies

We use cookies and similar technologies, which generally fall into the following categories:

• Essential — required for login sessions, cart state, security, and core Platform functionality. Disabling these may affect checkout and login
• Analytics — help us understand how the Platform is used so we can improve performance and user experience
• Marketing — measure our advertising and show you relevant experiences on other platforms
• Functional — support enhanced features and remember preferences where applicable

On your first visit we ask for your consent before setting any analytics or marketing cookies, and no such cookies (including Google Analytics and Meta Pixel) are loaded until you accept them. You can change or withdraw your choice at any time using the Cookie preferences link in the site footer, or through your browser settings. Disabling essential cookies may affect checkout and login.

9. International transfers

Our primary operations and data storage are in India. Some service providers (e.g. payment, messaging, cloud, analytics, or AI platforms) may process information outside India. Where required by applicable law, we use appropriate contractual or technical safeguards in connection with such processing.

10. Changes to this Policy

We may update this Privacy Policy to reflect new features (including MCP tools), legal requirements, or business practices. The “Last updated” date will change when we do. Material changes may be communicated via the Platform or email where appropriate.

11. Contact us / Grievance Officer

Email: support@bucketlistt.com
Website: bucketlistt.com/contact

Grievance Officer
Name: Divyam Shah
Email: divyam.shah@bucketlistt.com

Privacy complaints may be addressed to the Grievance Officer at the email above. If you are not satisfied with our response, you may have the right to lodge a complaint with your local data protection authority where applicable.