Privacy Policy — Travel Agencies

Last updated: September 1, 2026

This Privacy Policy explains how Tirhali collects, uses and protects information when travel agencies and their staff use the Platform. It applies to agency accounts; a separate policy covers clients of agencies using the client portal.

1. Information we collect

Application and account data: agency name, subdomain, contact person, email, phone, country, and verification documents such as a commercial registration or licence and the contact person's ID.

Workspace content: client records, travel plans, itineraries, invoices, accounting entries, uploaded files and messages that your agency enters into the Platform.

Technical data: sign-in timestamps, device and browser information, IP addresses, and activity logs used for security auditing.

2. How we use information

To operate your workspace, authenticate users, provide support, process subscription billing, verify applications, send service notifications (email, push, WhatsApp where enabled), improve the Platform, and protect it against fraud and abuse.

AI features send the minimum necessary content to our AI processing partners solely to generate the requested output; this content is not used to train third-party models.

3. Your role as data controller

For the personal data of your clients that your agency stores in the Platform, your agency is the data controller and Tirhali acts as a processor on your instructions. We process such data only to provide the service and never sell it.

4. Sharing

We share data only with service providers necessary to run the Platform (hosting, database, email, messaging and payment providers), under contractual confidentiality obligations, or where required by law. We do not sell personal data to third parties.

5. Security

Passwords are stored using strong one-way hashing (Argon2). Data is encrypted in transit. Access to production systems is restricted and logged. Tenant data is isolated per agency workspace.

6. Retention

We keep account and workspace data while your subscription is active. After cancellation, data is retained for a limited grace period to allow export or reactivation, then deleted or anonymised. Some records may be kept longer where legally required (e.g. billing records).

7. Your rights

You may access, correct, export or delete your agency's data, subject to legal retention duties. Contact us at hello@tirhali.com to exercise these rights.

8. Changes

We may update this Policy from time to time. Material changes will be announced through the Platform or by email, and the “last updated” date above will be revised.