Privacy Policy for Thrivia

Last Updated: 14 October 2026

1. Interpretation and Definitions

Interpretation

Words with initial capital letters have meanings defined in this section. The definitions apply whether the terms appear in singular or plural.

Definitions

  • Account: A unique account created for You to access our Service or parts of our Service.
  • Affiliate: Any entity that controls, is controlled by, or is under common control with the Company.
  • AI Assistant: The automated assistant that reads and replies to customer messages on a Creator's connected Messaging Channel.
  • Company / Firm: Thrivia, operated by Thrivia Private Limited.
  • Cookies: Small data files stored on your device to enhance your browsing experience.
  • Country: India (with principal jurisdiction in Uttar Pradesh).
  • Creator: A host or organiser who lists Experiences on the Platform and who may connect a Messaging Channel to it.
  • Device: Any device that can access the Platform, including mobile, tablet, and desktop.
  • Messaging Channel: A WhatsApp Business number or an Instagram professional account that a Creator connects to the Platform so that customer messages reach the Platform.
  • Personal Data: Any information relating to an identified or identifiable individual.
  • Sensitive Personal Data: Information classified as sensitive under applicable laws (e.g., financial data, government IDs, health info), collected only as permitted by law.
  • Service: The Platform and related features offered by Thrivia.
  • Service Provider: Any entity that processes data on behalf of the Company. This includes cloud hosting, payment gateways, analytics services, and communication tools.
  • Usage Data: Automatically collected data related to your interaction with the Platform.
  • Website: https://www.thrivia.io
  • You / User: Any natural person or legal entity lawfully accessing or using the Platform.

2. Applicability & Legal Basis

This Privacy Policy applies to:

  • Visitors to the Platform
  • Registered Users
  • Users who browse, save, plan trips, or book experiences
  • Users interacting with Experiences hosted by third-party Partners
  • Customers who message a Creator on a connected Messaging Channel, whether or not they hold a Thrivia Account

Thrivia complies with:

  • Digital Personal Data Protection Act, 2023 (DPDP Act, India)
  • Information Technology Act, 2000
  • SPDI Rules, 2011
  • Industry best practices for data privacy and security

3. Categories of Data We Collect

We collect several types of information to operate, improve, secure, and personalise the Platform.

A. Personal Data (Directly Provided by You)

We may collect:

  • Full name
  • Email address
  • Mobile number
  • Username
  • Profile information & preferences
  • Demographic information voluntarily shared
  • Information provided during account setup
  • Information provided during support requests
  • Information submitted during bookings, reviews, testimonials, or interactions
  • Identity verification documents (only when required under law or for fraud prevention, and only with your explicit consent)

B. Sensitive Personal Data

Collected only:

  • When explicitly required for verification, fraud prevention, or compliance
  • After obtaining explicit consent
  • Stored securely and processed strictly for limited purposes

Sensitive data may include:

  • Government-issued IDs
  • Payment instrument details (processed by third-party PCI-DSS compliant gateways, not stored by Thrivia)
  • Travel-related personal preferences where required for bookings

C. Usage Data (Automatically Collected)

Includes:

  • IP address
  • Device identifiers
  • Browser type, OS, screen size
  • App version and diagnostics
  • Pages visited, time spent, click events
  • Location approximation (if allowed by device)
  • Crash logs, performance metrics

This helps improve Platform performance and user experience.

D. Information from Third-Party Login Services

If you log in using Google, Facebook, Instagram, Twitter, or LinkedIn, we may receive:

  • Name
  • Email address
  • Profile photo
  • Contact lists (optional, only if shared by you)
  • Social media activity relevant to login permissions

We use only what is necessary to operate the Service.

E. Information from Partners, Payment Providers & Analytics Tools

To enable your bookings and improve services, we receive limited data from:

  • Partners hosting Experiences (booking status, fulfillment data)
  • Payment gateways (payment confirmation, transaction IDs)
  • Analytics tools (Mixpanel, Axiom)
  • Cloud hosting services (AWS)

All such providers act under strict confidentiality and data processing agreements.

F. Messaging Channel Data (WhatsApp and Instagram)

A Creator on an eligible plan may connect a WhatsApp Business number or an Instagram professional account so that an AI Assistant can answer customer messages on their behalf. Where a Creator has connected a Messaging Channel, we receive and store, for messages exchanged on that channel:

  • Message content, both the messages a customer sends and the messages sent back by the AI Assistant, the Creator, or the Creator's team
  • The customer's WhatsApp phone number, or their Instagram account identifier and handle
  • The customer's profile name as supplied by WhatsApp or Instagram
  • Message timestamps, message direction, message type, and the messaging platform's own message identifiers
  • Where the customer reached the Creator by tapping an advertisement, the headline and text of that advertisement
  • Delivery and status information returned by the messaging platform

Media files sent in a chat (images, audio, video, documents) are not stored by us. We record only that a message of that type was exchanged.

If a Creator uses WhatsApp Coexistence and switches on history import, WhatsApp also sends us earlier chat history for that number, up to a limit set per conversation. That history can include messages exchanged before the Creator connected the number to Thrivia, and with people who never contacted the AI Assistant. History import is off by default and happens only if the Creator turns it on.

If you are a customer messaging a Creator: you are a data subject under this Policy. The Creator controls the business account you are messaging and decides what to ask you; Thrivia provides the software that receives, stores, and answers those messages. The rights and request routes in sections 9 and 14 apply to you in the same way as to registered Users, even if you have never created a Thrivia Account.

G. Instagram Comment Replies

A Creator who has connected an Instagram professional account can set up keyword rules on their own posts and reels. Thrivia asks the Creator for the instagram_business_basic, instagram_business_manage_messages and instagram_business_manage_comments permissions through Instagram Login. We use them to read the list of the Creator's own posts and reels so they can choose which ones a rule applies to, to receive comments made on those posts, and to reply to them.

When someone comments on a post a rule covers and the comment contains one of the rule's keywords, Thrivia posts one public reply under that comment and sends the commenter one private message through Instagram's Private Replies feature. For this we receive and store:

  • The comment's identifier and its text
  • The commenter's Instagram-scoped identifier and username
  • The identifier of the post or reel that was commented on
  • What Thrivia did with the comment (for example replied, messaged, skipped or failed), and the text of the replies we sent

We use this data only to run the Creator's automation and to show the resulting enquiry as a lead and conversation in the Creator's Thrivia inbox and CRM, labelled as coming from an Instagram comment. We do not use it for advertising, we do not sell it, and we do not share it with other Creators. Comments that do not match a rule are not stored.

A Creator can switch this off at any time by deleting a rule, or by disconnecting Instagram under Settings > Channels & AI. Disconnecting Instagram deletes the Creator's comment rules and all stored comment records (comment text, commenter identifier and username). A lead or conversation already created from a comment stays in the Creator's CRM and inbox until the Creator or the commenter asks for it to be erased, as described in section 9. Deleting a Thrivia Account deletes the rules and comment records as well. A commenter who wants their comment data removed can email support@thrivia.io quoting their Instagram handle.

H. Facebook Login for Business: Lead Ads and WhatsApp Setup

Thrivia uses Facebook Login for Business, on the same Meta app, in two places. A Creator can connect a Facebook Page so that people who fill in that Page's Meta Lead Ads forms arrive as leads in the Creator's CRM. We then receive the details the person entered on the form (typically name, phone number, email address and the answers to the form's questions), together with the identifier and name of the form and, where Meta provides them, the identifiers and names of the campaign, ad set and advertisement. We keep Meta's original form answers alongside, so that no question is lost. A Creator can also connect a WhatsApp Business number through Meta's Embedded Signup, which gives us the identifiers of the Creator's WhatsApp Business account and phone number, the display phone number and business name, and an access token used to send and receive messages for that number. We use this data only to provide those features to the Creator who connected the Page or number. We do not use it for advertising and we do not sell it. A Creator can disconnect either at any time under Settings > Channels & AI.

4. Cookies, Tracking & Similar Technologies

We use:

  • Essential Cookies
  • Functional Cookies
  • Analytics Cookies
  • Web Beacons
  • Pixel tags
  • Session storage and local storage

You may control Cookies via your browser settings. Rejecting cookies may reduce Platform functionality.

5. How We Use Your Personal Data

A. Providing and Maintaining the Service

  • Account creation
  • Booking experiences
  • Search, discovery, and trip planning
  • Content personalization

B. Platform Functionality

  • User authentication
  • Booking confirmations
  • Communication and support
  • Synchronizing your preferences across devices

C. Contract Performance

  • Managing Experiences you book
  • Sharing data with Partners where necessary
  • Processing payments and refunds

D. Safety, Fraud Prevention & Compliance

We use your data to:

  • Detect, investigate, and prevent fraud
  • Enforce Terms & Conditions
  • Prevent misuse or abuse of the Platform
  • Comply with legal and regulatory requirements
  • Verify identity where required

E. Improvement & Analytics

  • Analysing usage trends
  • Performance optimization
  • Debugging issues
  • Enhancing user experience

F. Communication

We may contact you for:

  • Account notifications
  • Bookings, changes, or cancellations
  • Support responses
  • Feature updates
  • Marketing (only if you have not opted out)

You can opt out anytime.

G. Operating the AI Assistant on Messaging Channels

Where a Creator has connected a Messaging Channel, we use the data described in section 3(F) to:

  • Generate and send replies to customer messages on the Creator's behalf
  • Create and update a lead record in the Creator's CRM, including the customer's name, phone number or Instagram handle, and what they asked about, so the Creator can follow up
  • Hand a conversation over to the Creator or their team, together with a short summary of what the customer wants
  • Show the Creator and their authorised team the conversation in their Thrivia inbox
  • Send follow-up messages permitted by the messaging platform's rules
  • Measure usage against the Creator's plan limits, and detect and prevent abuse

H. Automated Processing by an AI Model

Replies on a connected Messaging Channel are generated automatically by an AI language model rather than typed by a person. This means:

  • To produce a reply, we send the recent messages in that conversation, together with details of the Creator's Experience and the answers the Creator has configured, to a third-party AI model provider, which acts as a Service Provider to us.
  • We send that content to the provider for the sole purpose of generating the reply. Thrivia does not use message content to train any AI model, and we do not sell message content.
  • The AI Assistant tells customers that it is an AI assistant. We require every Creator to set a greeting that says so before their assistant can go live.
  • A conversation is passed to a human when the AI Assistant cannot answer, when the customer asks for a person, or when the Creator takes over or pauses the assistant.
  • The AI Assistant answers questions and can share booking and payment links. Bookings and payments are completed through Thrivia's normal checkout, not by the AI Assistant.

If you would rather not deal with an automated assistant, you can ask for a person at any point in the chat, or contact the Creator through the other channels they publish.

6. Sharing Your Personal Data

A. Service Providers

Including:

  • Cloud hosting (AWS)
  • Analytics (Mixpanel, Axiom)
  • Email/SMS push providers
  • Payment gateways
  • Messaging platforms (Meta Platforms, for WhatsApp Business and Instagram), which carry messages to and from a Creator's connected Messaging Channel
  • Third-party AI model providers, which receive conversation content only to generate a reply as described in section 5(H)

Messages sent on WhatsApp or Instagram necessarily pass through Meta's systems, and Meta handles them under its own privacy policy in addition to this one. We share message content with our AI model provider only to generate a reply, and we do not share it with other Creators or with advertisers. A current list of our subprocessors is available on request.

B. Experience Partners

Only when necessary for:

  • Booking confirmations
  • Experience fulfillment
  • Guest verification
  • Customer support

Partners are contractually required to protect your data.

C. Affiliates

For operations consistent with this Policy.

D. Business Transfers

If Thrivia undergoes:

  • Merger
  • Acquisition
  • Investment
  • Reorganization

Your data may be securely transferred.

E. Law Enforcement

Only when legally required.

F. With Your Consent

In cases where you explicitly authorize sharing.

We DO NOT:

  • Sell your personal data
  • Share your data for advertising without consent
  • Allow unauthorized third parties to access it

7. Data Retention

We retain your Personal Data:

  • Only as long as necessary for legitimate business purposes
  • To comply with legal, regulatory, tax, and audit requirements
  • As long as your account remains active

After this period, your data is:

  • Deleted, or
  • Irreversibly anonymized

Backups may retain data for a limited time due to technical constraints but are not used for processing.

Messaging Channel Data

Conversations and messages received on a connected Messaging Channel are kept for as long as the Creator's Account and that connection remain in place, because the Creator relies on the history to serve the customer and to meet their own record-keeping obligations. We do not delete this data automatically on a fixed schedule.

Disconnecting a Messaging Channel stops us receiving new messages on it, but does not by itself delete the messages already received. To have conversation data erased, use the request routes in section 9 or in our Data Deletion Policy.

8. Cross-Border Data Transfer

Your data may be processed outside India. We ensure that:

  • Transfers comply with DPDP Act requirements
  • Appropriate safeguards (contracts, encryption) are in place

9. Deleting Your Personal Data

You may request:

  • Account deletion
  • Correction of inaccurate data
  • Restriction of processing (where applicable)

Email: support@thrivia.io

We will process requests as per law.

Certain data may be retained if required for:

  • Legal obligations
  • Fraud prevention
  • Dispute resolution

Messaging Channel Data

If you messaged a Creator on WhatsApp or Instagram and want that conversation erased, email support@thrivia.io quoting the phone number or Instagram handle you used. You do not need a Thrivia Account to make this request, and we will verify it before acting on it.

A Creator may also request erasure of the conversations held on their connected Messaging Channel.

Instagram comment data is covered by the same route: email support@thrivia.io with your Instagram handle and we will remove the stored copy of your comments and any lead or conversation created from them.

Erasing data from Thrivia does not erase the copy held on your own device or within WhatsApp or Instagram. To remove those, delete the chat in the app and refer to Meta's own policies.

Our Data Deletion Policy sets out the full process and the timelines we work to.

10. Security Measures

We use industry-standard measures:

  • Encryption in transit and at rest
  • Secure cloud infrastructure (AWS)
  • Strict access controls
  • Multi-factor authentication
  • Regular audits and monitoring
  • Firewalls and intrusion detection systems

However, no method is 100% secure.

11. Children's Privacy

Our Platform is not intended for individuals below the minimum age required under applicable Indian laws to enter into binding contracts.

We do not knowingly collect data from such individuals. If discovered, we will delete the data promptly.

12. Links to Other Websites

We are not responsible for:

  • Privacy practices
  • Content
  • Data handling policies

of third-party websites. Please review their policies before providing information.

13. Changes to This Privacy Policy

We may update this Privacy Policy periodically.

We will:

  • Update the "Last Updated" date
  • Notify users through the Platform or email when appropriate

Continued use of the Platform constitutes acceptance.

14. Contact Us

If you have questions, requests, or complaints:

Email: support@thrivia.io

SUBSCRIPTION & PAYMENT DATA

When you subscribe to a creator plan, we process billing data (plan, term, GSTIN if provided, invoice records) and payment-mandate identifiers via our payment partner to enable recurring billing. For manual (off-platform) payments between attendees and creators, we may store the payment reference (UTR) and any screenshot you submit solely to help the creator verify your booking; Thrivia does not process those funds.