01. Operator Identity & Platform Scope
Harkle Digital Studio is an independent web architecture and software automation studio operated by Hari, based in Tamil Nadu, India (https://harkle.in). We design, develop, host, and manage custom business websites, edge APIs, and messaging automation pipelines for independent businesses.
Among these services, Harkle is the engineering developer and technical operator of CHOLA DESK, a purpose-built flight quotation generator, itinerary manager, and passenger communication system developed for Chola Air Travels (an established travel and ticketing agency based in Pattukkottai, Tamil Nadu).
This Privacy Policy governs the collection, processing, and handling of data when passengers, customers, or prospective travelers interact with Harkle or CHOLA DESK, including through the Meta WhatsApp Cloud API messaging channels.
02. CHOLA DESK & Meta WhatsApp Cloud API Integration
CHOLA DESK integrates with the Meta WhatsApp Cloud API (WhatsApp Business Platform) to facilitate real-time flight quotes, itinerary summaries, and passenger communications. Specifically, the integration operates as follows:
- Outbound Quotation Delivery: When a passenger requests flight options, the desk operator prepares an itinerary, and CHOLA DESK generates structured quotation messages and downloadable PDF itinerary documents that are dispatched to the passenger's verified WhatsApp number via the Meta Cloud API.
- Inbound Inquiries & Status Receipts: Incoming messages sent by passengers and webhook status events (
sent,delivered,read,failed) are ingested by our secure webhook endpoint (/api/whatsapp/webhook). - Deduplication & Operational Audit: Webhook events are cryptographically verified and deduplicated using a 24-hour sliding window cache to prevent repeated message delivery and ensure reliable operational records.
03. Customer Information We Process
We collect and process only the information strictly necessary to prepare flight quotations, answer passenger inquiries, and deliver requested travel services. This includes:
A. Contact & Passenger Identifiers
Customer full name, primary WhatsApp phone number (in E.164 or national format), optional alternate family or secondary contact number, and optional customer email address.
B. Itinerary & Quotation Details
Origin airport, destination airport, requested travel date(s), passenger count and passenger type breakdown (adults, children, infants), preferred operating airlines, cabin class, baggage allowance, and generated fare snapshots.
C. WhatsApp Communications
Inbound messages and voice note notes sent to the travel desk, message timestamps, unique WhatsApp Message IDs (WAMID), and delivery status receipts (sent, delivered, read, failed).
D. Booking Metadata (If Confirmed)
If an inquiry is confirmed into a ticketed booking, passenger names, passport numbers (where legally required for international flights), ticket numbers, and airline PNR locators are recorded.
04. How Information is Used
The information processed by Harkle and CHOLA DESK is used exclusively for legitimate business and operational purposes:
- Generating accurate commercial flight quotations and itinerary schedules requested by passengers.
- Delivering quotation summaries and PDF attachments directly to passenger WhatsApp accounts.
- Providing customer support, answering airline schedule questions, and providing flight updates.
- Verifying message delivery receipts and preventing duplicate message delivery via webhook deduplication.
- Maintaining commercial records and quotation snapshot history to honor stated fare validity periods.
- Complying with statutory accounting, taxation, and travel industry documentation obligations under Indian law.
05. Data Storage, Architecture & Service Providers
Harkle utilizes trusted, enterprise-grade cloud service providers to operate its infrastructure. Personal information may be processed or stored with the following third parties:
WhatsApp messages, media templates, and delivery receipts are routed through Meta's WhatsApp Business Platform in accordance with Meta's Commercial Terms and Data Policy.
Persistent customer directories, flight inquiries, quotation snapshots, and bookings are securely stored in managed PostgreSQL databases hosted by Supabase with Row Level Security (RLS) and encrypted database connections.
Our front-end application and serverless webhook receiver run on Cloudflare's secure global edge network with TLS 1.3 encryption, DDoS mitigation, and edge runtime security.
When a passenger explicitly confirms and pays for a booking, passenger names, birth dates, and passport details are transmitted to the operating airline or ticketing consolidator solely for ticket issuance.
06. Security Practices & Data Safeguards
We implement rigorous technical, architectural, and administrative safeguards to protect your personal information:
- Cryptographic Webhook Signature Verification: Every inbound webhook payload received from Meta is validated via Web Crypto HMAC-SHA256 against our private Meta App Secret (
X-Hub-Signature-256) before being accepted or parsed. - Personally Identifiable Information (PII) Masking: Passenger mobile numbers are masked in visual interface feeds and non-critical logs (
+91 94431 *****) to prevent visual data exposure. - Zero-Secret Client Exposure Gate: API tokens, database service keys, and webhook secrets are kept exclusively in server-side environment variables and are never bundled into client-side code.
- Transport Security: All communications between passengers, our servers, Meta, and Supabase are encrypted using HTTPS / TLS 1.3 in transit.
*Security Disclaimer: While we take comprehensive, industry-standard precautions, no electronic transmission over the internet or cloud storage architecture can be guaranteed 100% impenetrable. We commit to prompt investigation and notification in the event of any verified security incident.
07. Data Retention Policy
We retain personal information only for as long as is necessary to fulfill the purposes for which it was collected:
- Quotation Snapshots & Inquiries: Retained for the operational duration of customer interactions and commercial validity periods, typically up to 12 months, after which inactive inquiry drafts are eligible for archival or deletion.
- Confirmed Booking & Accounting Records: In accordance with Indian taxation, commercial, and airline agency record-keeping laws, confirmed booking records and invoices are maintained for the statutory retention period (up to 7 years).
- Temporary Webhook Cache: Event deduplication records and transient delivery logs are kept in a temporary 24-hour sliding window and purged continuously.
08. Your Privacy Rights & Data Deletion
Under applicable data protection principles, you possess the right to:
- Access: Request a summary of the personal information we hold regarding your inquiries and quotes.
- Correction: Request that outdated, incomplete, or inaccurate contact or passenger details be corrected.
- Deletion: Request the deletion of your personal contact records, quotation history, and WhatsApp interaction data.
To view detailed instructions on submitting a deletion request, please visit our dedicated page:
09. Children's Privacy
Our web services and WhatsApp channels are intended for adult travelers and individuals authorized to request travel quotations and book airline tickets. We do not knowingly collect personal data directly from minors without parental or guardian consent. Travel quotations involving child or infant passengers are handled strictly through the adult parent, guardian, or booking contact.
10. Updates to This Policy
We may periodically update this Privacy Policy to reflect technical changes in our software, updates to Meta WhatsApp Cloud API specifications, or modifications in legal regulations. When updates are published, the "Effective Date" at the top of this document will be revised. We encourage you to review this page periodically.
11. Contact & Responsible Operator
If you have questions, concerns, or requests regarding this Privacy Policy, your personal information, or the CHOLA DESK WhatsApp integration, please contact the responsible operator: