Privacy policy

Who we are and the law that applies

Nepgram is a bilingual travel marketplace connecting people in Nepal, the Nepali diaspora, and international visitors to verified local experiences. The platform is operated by Nepgram Technologies Pvt. Ltd., a single-shareholder private limited company incorporated under the Companies Act, 2063 (2006) of Nepal, operating as an intermediary e-commerce platform under the Electronic Commerce Act, 2081 (2025), and Nepgram Technologies Pvt. Ltd. is the controller of your personal data. Registered office: Bharatpur-7, Krishnapur, Chitwan, Nepal. We handle personal data in line with the Individual Privacy Act, 2075 (2018) and the Privacy Regulation, 2077 (2020) of Nepal, the Electronic Transactions Act, 2063 (2008), and the Electronic Commerce Act, 2081 (2025). Privacy contact: privacy@nepgram.com. Our grievance officer, Saraswati Ghimire (phone: +977-97676132XX), also receives privacy complaints.

What we collect

• Account data: name, email, phone, language preference, and profile photo.
• Booking data: reservations, traveller names, payment method choice, billing address (for card payments), and support context.
• Messaging data: conversation metadata, safety reports, and block relationships.
• Operational telemetry: product analytics events, crash logs, and basic usage metrics to keep the service reliable.

We collect this data directly from you with your consent — when you create an account, make a booking, or contact support — and we collect only what is needed for the purposes below.

How we use data

• To provide bookings, confirmations, messaging, notifications, and customer support.
• To connect you with the local partner operating your chosen service.
• To prevent fraud, enforce trust and safety policies, and meet legal obligations (including tax, invoicing, and e-commerce record-keeping duties in Nepal).
• To improve product reliability, search quality, and bilingual content.

We do not use your personal data for purposes unrelated to these without asking you first, and we do not sell personal data.

Payments and cross-border processing

Most bookings in Nepal are paid through local wallets (eSewa, Khalti) or cash at the provider. When you pay by international card, your payment is processed by Stripe, our US-based payment partner. Stripe collects card and billing details directly; we receive payment status, limited billing metadata, and a transaction reference. Stripe's handling of card data is governed by Stripe's privacy policy. Our hosting and some infrastructure providers process data on servers outside Nepal; by using Nepgram you consent to this cross-border processing, which is always subject to contractual safeguards.

Sharing with partners and providers

We share the minimum booking details needed with the verified partner fulfilling your service (name, contact phone, party size, dates, and special requests). We use vetted infrastructure providers (hosting, SMS, email, analytics) under contractual safeguards. We disclose personal data to authorities only where a law of Nepal requires it or a competent authority lawfully orders it. We do not sell personal data.

Messaging us on social media (Messenger, Instagram)

If you message Nepgram's official pages on Facebook Messenger or Instagram, we receive your public profile name, profile photo, and the content of your messages through Meta Platforms, Inc. We use this only to answer your inquiry and provide customer support — never for advertising, profiling, or training AI models. Our support team may use AI-assisted draft replies, but a human always reviews and sends every response. These conversations are retained like other support records and are also subject to Meta's privacy policy. To request deletion of your social messaging data, see our data deletion instructions.

Security and retention

We protect personal data with encryption in transit, access controls, and audit logging, and we limit staff access to what their role requires. We keep personal data only as long as needed for the purposes above or as Nepali law requires (for example tax and booking records). If we become aware of a data breach that creates real risk to you, we will notify you and the relevant authorities as the law requires.

Cookies and similar technologies

We use essential cookies and local storage for sign-in sessions, language and currency preferences, and saved listings. If we enable optional analytics (for example Google Analytics), we will ask for consent before non-essential cookies are set. You can clear site data from your browser at any time; signing in again may be required.

Children

Nepgram accounts are for adults (18+). Bookings for minors must be made by a parent or guardian, and we do not knowingly collect personal data directly from children. If you believe a child has created an account, contact us and we will remove it.

Your rights

Under the Individual Privacy Act, 2075 you may ask what personal data we hold about you, request correction of inaccurate data, withdraw consent, and request deletion. Users in the European Economic Area and UK can additionally lodge complaints with their local data protection authority; California residents may have rights under the CCPA/CPRA; India users may have rights under the DPDP Act as it comes into force. Send verified requests to privacy@nepgram.com — we respond within the timelines required by applicable law, and you may escalate to our grievance officer if you are unsatisfied.

Retention and deletion

Account deletion can be requested from profile settings or the dedicated deletion page. Deletion runs in two phases: immediate deactivation and delayed hard-delete after the retention window required for abuse prevention, tax, and booking dispute handling.

Changes and related policies

We will announce material changes to this policy on the platform before they take effect and update the effective date above.