Privacy Policy

Last updated: 28 October 2026

IWIS Global ("we", "us") operates this website to sell private Agra and Taj Mahal tours. This policy explains what information we collect when you use it, and how it's used.

Information we collect

• Booking details: when you book a tour, we collect your name, email address, and phone number, along with your chosen tour, travel date, and traveler count.
• Payment: payments are processed by Razorpay. We never see or store your card, UPI, or bank details — Razorpay handles that directly, and we only receive confirmation that a payment succeeded.
• Account information (optional): if you sign in with Google, we receive your name, email address, and profile photo from Google, so you can view your booking history. If you create an account with an email and password instead, we store your email address and a one-way hash of your password — never the password itself. To block password guessing, we also record the IP address and number of failed attempts when someone signs in with an email and password, and, to stop accounts being created in bulk, the IP address and number of accounts created from it within an hour. When you create an account with an email and password, we email you a link to confirm the address; once it's confirmed (or you sign in with Google, which confirms it for us), bookings made with that email show in your account, including ones made before you signed up. If you ask to reset your password, we email you a one-time link and keep a scrambled (hashed) copy of it, with the time it was sent, to check it and to limit how often reset emails can be sent.
• Entry tickets: for tours that include monument entry tickets (or when you add them), we buy the tickets on the Archaeological Survey of India's (ASI) official website using the traveler names and nationalities its ticketing requires. We keep a copy of the e-ticket file with your booking and email it to you.
• Questions to our AI guide: questions you type into the "YourGuide" box on our homepage are sent to Anthropic's Claude AI to write the answer. We don't store your questions; to limit how often the box can be used, we keep a one-way hash of your IP address (not the address itself) and the time of each question.
• Reviews: after your tour we may email or WhatsApp you a private link to rate it. If you leave a review, we store your rating and comments with your booking. Once we've checked it, we publish it on our website with your first name and last initial, the tour, and the month you traveled. You can edit your review through the same link, or ask us to remove it.
• Preferences: your chosen language and currency are stored in cookies on your device so the site remembers them on your next visit. After you submit a form (for example, a booking), a technical cookie holds a database position marker for 5 minutes so the next pages you open show your change; it contains no personal information.
• Enquiries by WhatsApp, phone or email: if you contact us before booking, we may record your name, contact details, message and the tour you're interested in, so we can follow up. The messages themselves also travel through WhatsApp (Meta) or your email provider, under their own privacy practices.
• Analytics (cookies only if you accept): this site uses Google Analytics to understand how visitors use the site — for example, which pages are visited and general navigation patterns. If you tap Accept on our cookie banner, it collects standard usage data (pages viewed, approximate location, device/browser type) using analytics cookies. If you tap Reject, or haven't chosen yet, Google Analytics sets no cookies; Google may still receive basic signals without cookies or an identifier, such as that a page was viewed. When you book, we also send Google Analytics the tour, amount, currency, number of travelers and payment reference — linked to your browser's analytics ID only if you accepted cookies, and never with your name or contact details. It is not used to identify you personally.
• Advertising (only if you accept): if you tap Accept on our cookie banner, the Meta Pixel records which pages you visit and, when you book, the tour, amount paid, currency and payment reference, so we can show our tours to you on Instagram and Facebook and measure which ads lead to bookings. We never send Meta your name, email or phone number. If you tap Reject, the Meta Pixel doesn't load.
• WhatsApp messages: if you message our WhatsApp number, we store your phone number, the name WhatsApp shows for you, and your messages. An AI service (Anthropic's Claude) reads the message to prepare a reply. Routine questions may be answered automatically, always identified as IWIS Global's assistant; other replies are checked by our staff before they are sent, and a person can take over at any time. To answer questions about your own booking, we look it up by the phone number you are messaging us from.
• Email sign-ups: if you subscribe to travel ideas by email, or tick the box on one of our forms or on a Facebook or Instagram lead form, we record your email address, the wording you agreed to, the date, and your click on the confirmation link, so we can show that you agreed.
• Email statistics: when we send you an email, our email provider tells us whether it was delivered, bounced or marked as spam, and we count clicks on the links in our emails per link, not per person. We do not track whether you open an email.
• Ad measurement: if you accept cookies, we also tell Meta from our server when you book or send an enquiry, so we can measure our Facebook and Instagram ads. We send your email address and phone number only in scrambled (hashed) form, together with the booking value. If you reject cookies, nothing is sent to Meta.

How we use this information

• To process and confirm your booking, buy any entry tickets it includes, and contact you about it.
• To let you sign in and view your booking history, if you create an account.
• To respond to questions you send us, and follow up on enquiries.
• To send you travel ideas and offers by email, only if you signed up and confirmed your address. Every email has an unsubscribe link, and you can unsubscribe at any time.
• To ask for a review after your tour, and publish the reviews guests choose to leave.
• To meet legal and accounting obligations (e.g. retaining payment records).
• To understand overall site usage via Google Analytics, so we can improve the site.

We do not sell your personal information.

Who we share it with

• Razorpay — to process payments.
• Google — only if you choose to sign in with it.
• Cloudflare — our hosting and database provider; your requests pass through their infrastructure to reach our servers.
• Google — via Google Analytics, for the site-usage and booking analytics described above.
• Meta (Facebook, Instagram) — via the Meta Pixel, only if you accept advertising cookies, for the advertising described above.
• OpenAI — via the OpenAI Ads pixel, only if you accept advertising cookies, to measure how our ads on OpenAI's products perform: it records which pages you visit and how you arrived. If you book or send an enquiry, we also tell OpenAI from our server, with your email address only in scrambled (hashed) form, your IP address and browser details, and the booking value. If you reject cookies, nothing is sent to OpenAI.
• Metricool — a marketing analytics service; only if you accept cookies, it records which pages you visit and how you arrived (for example from one of our social media posts), so we can see which posts and campaigns bring visitors.
• Ahrefs — Ahrefs Web Analytics counts page views on our public pages (which page, and approximate location, device and browser) without cookies, whether or not you accept the cookie banner. Private pages such as sign-in and your account are not counted.
• Resend — the email service that sends your booking confirmation, e-tickets and review requests (it receives your name, email address, and booking details). If you subscribe, it also sends our travel-ideas emails. Resend stores its data in the United States.
• Archaeological Survey of India (ASI) — traveler names and nationalities, only when we buy monument entry tickets for your tour.
• Anthropic — the text of questions you type into the YourGuide box, to generate the answer.
• Open-Meteo and Google — some pages load content directly from them in your browser (the Agra weather card from Open-Meteo; the "Add to Preferred Sources" button on our blog from Google), which means they see your IP address like any website you visit.
• Meta (WhatsApp) — carries the messages you exchange with us on WhatsApp. Anthropic — also reads the WhatsApp messages you send us, to prepare replies. Meta (Facebook and Instagram) — also delivers to us the lead-ad forms and the Messenger and Instagram messages you send us.

We don't sell your information, and we don't give it to anyone else for their own marketing.

Cookies

This site uses a small number of cookies. Most make the site work. The Google Analytics cookies, which measure site usage, and the Meta advertising cookies are listed below. Whether they are set depends on where you visit from (see the note after the list):

• currency and lang — remember your preferred currency and language.
• customer_session — keeps you signed in, if you have an account.
• admin_session — staff-only, used to access the booking management system.
• oauth_state — a short-lived cookie used only during Google sign-in, deleted immediately after.
• _ga, _ga_* — set by Google Analytics, only if you accept, to distinguish visitors and measure site usage.
• cookie_consent — remembers whether you accepted or rejected analytics and advertising cookies, for 180 days.
• _fbp, _fbc — set by the Meta Pixel, only if you accept, to recognise your browser for Instagram and Facebook ads.
• Metricool's tracker — loads only if you accept, and may set its own cookies or local storage to count your visits.
• OpenAI's ads pixel — loads only if you accept, and may set its own cookies or local storage to measure our ads.
• Ahrefs Web Analytics sets no cookies.

Where you are matters. If you visit from the European Union, the wider European Economic Area (Iceland, Liechtenstein, Norway), the United Kingdom or Switzerland, the analytics and advertising cookies and tools described in this policy are used only if you tap Accept on our cookie banner. From all other countries they are on by default, and you can switch them off at any time with “Cookie settings” at the bottom of every page; your choice is then remembered and applies here exactly as described for Reject. Where this policy says “only if you accept”, read it this way. We tell where you are visiting from by your internet connection's country, which we do not store.

Countdown offers: when a tour page shows an offer for booking within a set time (for example 20% off if you book within 30 minutes), we store one small cookie (offer_timer) recording when your time started, so the offer ends when it says and does not restart on your next visit. It holds only that time, signed so it cannot be changed, and is kept for 90 days. In the regions above it is set only if you accept cookies; without it you simply see our normal prices.

You can change your choice at any time with “Cookie settings” at the bottom of every page. Rejecting removes the Google Analytics and Meta cookies from this site.

Data retention

We keep booking records for as long as needed for accounting, legal, and customer-support purposes. You can ask us to delete your account and associated personal data by contacting us — see below. WhatsApp message text is kept for 12 months and then deleted. If you subscribe to our emails, we keep your consent record for as long as we rely on it and for the legal limitation period afterwards. If you unsubscribe or ask us to delete your data, we keep only a scrambled (hashed) copy of your email address, so that we never email you again.

Your choices

You can book a tour as a guest without creating an account. If you do sign in, you can stop using that account at any time, and can ask us to delete your data by contacting us. You can accept or reject analytics and advertising cookies, and change that choice later, with “Cookie settings” at the bottom of every page. You can withdraw your consent to marketing emails at any time with the unsubscribe link in every email, or by writing to us. Booking and payment emails about your trips are not marketing and continue.

Contact us

Questions about this policy or your data can be sent to info@iwisglobal.com or via WhatsApp.