Privacy notice

What we hold about you, and why

Version 2026-11-03

Who we are

Nivaanzo (nivaanzo.com) is run by SpecShield Software Private Limited. We decide how your personal data is used, which makes us its "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023. You can reach us at [email protected].

What we collect, and why

Your email address

To sign you in with a one-time code or link and to tell you about your own case, for example when an airline's reply is due. If you ask us to email you your complaint letter and result, we send them to that address. That email contains your full booking reference, because the airline needs it to find your booking, so keep it to yourself.

Your name and Google account ID

Only if you choose "Sign in with Google". We ask Google for your name and email address only, and nothing from your mailbox.

Your flight details

Airline, flight number, date and route, to look up what happened to the flight and which rules apply.

Your booking reference (PNR)

Airlines need it to find your booking. Once you confirm it, we store it encrypted and show only its last four characters, unless you choose to reveal it.

Your answers about what happened

For example when you were told about a cancellation, and what the airline offered. The rules depend on these answers.

Documents you upload

Tickets, boarding passes and messages from the airline. They are evidence for your complaint, and we keep each file exactly as you send it. Airline documents usually show only the last four digits of a card. If yours shows the full number, cover it before uploading, or write to [email protected] and we will delete the file. When we read a document, we leave any card number out of what we take from it.

Your complaint and your approvals

The exact words you approved, who they were for and when, so there is a record of what was sent.

Your permissions

Each permission you give, the version of the wording you saw, and when. You can see them all on your privacy page.

Technical details

Cookies that keep you signed in and protect your account (listed below), and your IP address, which we use to stop abuse such as repeated sign-in attempts. Our servers record each request with its IP address for security and to fix faults.

How the product is used

Which steps people reach, so we can see where they get stuck. These records carry a case number and an airline code, never your name, email, booking reference or documents. If you arrived by one of our adverts or links, they also note which one and the search words it was for, taken from the link itself, without a cookie. Separately, Cloudflare Web Analytics counts page views, which pages are visited, the site you came from, your country and type of device, and how fast pages load. It sets no cookies and doesn't identify you or follow you to other sites.

How we read your documents

When you upload a ticket, our own servers read the text in it and suggest details such as the flight number and date. You check every suggestion before we use it. No outside AI service reads your documents. If that ever changes, we will update this notice and ask for your permission again.

Whether you may be owed anything is decided by fixed rules based on the DGCA's passenger-rights regulations, never by an AI.

Who we share it with

Amazon Web Services

Hosts the service and stores your data and backups in Mumbai, and sends our emails to you. Amazon processes it only on our instructions.

Cloudflare

Protects and delivers the site: every visit passes through Cloudflare, which sees your IP address and browser details and filters out attacks. It also counts visits without cookies (above), and forwards emails you send to [email protected] to us. Cloudflare processes this only on our instructions.

aviationstack (APILayer)

Our flight-records provider. It receives only a flight number and a date, never your name, email, booking reference or documents.

Google

Only if you sign in with Google. Google tells us your name and email address.

The airline

Only the complaint and documents you approve, sent by you to the airline's published grievance address.

AirSewa

We never send anything to AirSewa. If you file there, you do it yourself, with the pack we help you prepare.

Authorities

Only when the law requires it, for example a valid order from a court or regulator.

Where it is stored

Your data is stored in India, in Amazon Web Services' Mumbai region. Cloudflare handles each visit at its nearest location, which may be outside India. Flight look-ups go to aviationstack and sign-in with Google goes to Google, whose servers may be outside India. None of them receives your documents.

How long we keep it

• While your account is open, we keep your cases so you can come back to them.
• A check you never save to an account is removed after 7 days.
• You stay signed in for up to 30 days, then sign in again.
• When you ask us to delete a case or your account, we stop using it at once and remove it, with its documents, 7 days later. The wait is there in case you change your mind.
• Backups that still contain deleted data expire within 35 days.
• Server records of requests, with their IP address, are kept for up to 30 days.
• We keep a record of actions taken on a case, such as "complaint approved" or "deletion requested", so we can show what happened. It holds no documents and no complaint wording.

Your rights

Under the Digital Personal Data Protection Act, 2023, you can:

• see what we hold, and download your case;
• correct anything that is wrong;
• ask us to delete a case or your whole account;
• withdraw a permission you gave (withdrawing a required one means closing your account);
• name someone to act for you if you die or cannot act yourself;
• complain to us, and then to the Data Protection Board of India.

Most of this is on your privacy page. For anything else, write to [email protected].

How we protect it

The site only works over an encrypted connection. Confirmed booking references and any mailbox access are encrypted in our database, backups are encrypted, and access to our servers is restricted to the people who run the service. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.

Children

Nivaanzo is for adults. If a child was on the flight, a parent or guardian can include them in their own case.

Cookies

We use only the cookies the service needs. None are for advertising or tracking.

Cloudflare may also set a short-lived security cookie, such as __cf_bm or cf_clearance, if it needs to check that a visitor is a person and not an automated attack.

sr_session

Keeps you signed in, for up to 30 days.

sr_check

Remembers a flight check you started without an account, for up to 7 days, so you can come back to it.

XSRF-TOKEN

Protects your account from forged requests made by other websites.

sr_oauth_state

Used for about 10 minutes while you sign in with Google, to confirm the sign-in really started here.

Changes to this notice

Each version is dated. If we change it in a way that matters to you, we will ask you to read and agree to the new version the next time you sign in.