Privacy Policy

This policy explains how Shuvmarg handles information when people use its passenger website and app, booking and support systems, and related operator, agent and crew services. Other providers, including payment providers and operators, may have their own privacy notices for information they process independently.

• Account details such as phone number, name, email, address, profile information, authentication and account-security records. Some profile details can be added after a phone-based booking.
• Passenger and trip details such as traveler name, contact, age or gender where collected, route, date, boarding and dropping points, seat, operator, ticket, QR and boarding status. A booker may provide details about other travelers.
• Booking and payment records: the fare and offer, booking fee, payment sources and references, accepted terms and cancellation rules, payment checks, refund allocations, return references and status. Receipts and supporting documents supplied for a payment or refund may be retained with the review. Payment providers handle sensitive payment credentials; staff do not need your PIN, CVV, banking password or payment OTP.
• SM Money and reward records: refund-credit and reward balances, credit origin, reservations, spending, returns and expiry. Referral records include the referral code, qualifying account relationship and journey milestones. Scratch-card records include the associated booking, reveal or claim time, journey completion and claim or reward expiry.
• Support messages, complaints, device and technical information, security logs, and optional location or notification information when a feature uses them. Related operator, agent and crew services may also process contact, identity, verification and settlement records required for their role.

We use information to create and protect accounts, complete and verify bookings, issue tickets, manage boarding, process payments and refunds, communicate journey updates and support passengers. Payment and credit records let us prevent duplicate spending, apply the accepted cancellation rules, verify a return and explain an account balance. Referral and scratch-card records let us check eligibility, release rewards after completed travel and manage expiry. We also use relevant records to prevent fraud, investigate incidents, manage operator and agent relationships and meet lawful record-keeping requirements. Optional marketing or location features require their own applicable choice or permission.

If you withdraw a device permission, features that genuinely require it may stop working. Transactional messages about an active booking or account security may still be sent even if you opt out of marketing.

The operator and authorized crew receive the passenger and booking information needed to run the trip, verify boarding and handle service issues. An authorized agent may access bookings they made or support. Shuvmarg administrators with the relevant access can review bookings, payment issues, refunds and finance evidence. This does not give an operator access to a passenger’s whole SM Money account. Payment providers receive relevant details to take, verify or refund payment. Technology providers may help host services, deliver codes and notifications, provide maps, security or support.

We may provide information to a court, regulator or authority when legally required. A business transfer may involve relevant records subject to applicable safeguards. We do not sell passenger information as a data-broker business. A ticket you choose to share or download can contain personal and QR details; share it only with people who need it.

Where a location feature is enabled, we use the location needed for that feature and the permission you grant. If an authorized crew device supplies a bus location, that information may be used for the active trip, passenger updates and operational or safety review. Passenger-facing tracking should identify the journey without revealing unnecessary private crew information.

Browser and app storage may keep sign-in state, recent searches, traveller details entered in checkout, seat-reservation state and payment references used to recover an interrupted checkout. Clearing storage may sign you out or remove a local checkout shortcut; it does not cancel a booking, prove a failed payment or erase the server’s financial records. A downloaded or locally saved ticket may remain on your device until you remove it. Use device settings to manage optional permissions.

We keep personal information only as long as needed for the purpose collected and any applicable transport, tax, accounting, payment, fraud, complaint or legal requirement. An account closure does not necessarily erase booking and payment records that must be kept. Retention periods for location history, support records and technical logs are reviewed according to their purpose and applicable requirements.

We use access controls and other technical and organizational measures appropriate to the data. Payment and refund evidence is available to authorized staff for the relevant review. Uploaded finance documents may be checked for harmful content and converted or compressed for storage; do not include unrelated personal information. No electronic service can eliminate every security risk. We investigate suspected unauthorized access and make notifications required by law.

You may contact us to ask about information associated with you, correct inaccurate account details, request account closure or deletion of information no longer needed, withdraw an optional permission or marketing choice, or raise a privacy concern. We may need to verify your identity before disclosing or changing information and may retain records where legally required.

Where someone booked for another passenger, we may need to verify the relationship and protect the other passenger's information before responding to a request.

An adult may book travel for a child where permitted. We aim to collect only the child information needed for the booking and applicable law. A minor should not independently make an account agreement without the required authority.

Some technology providers may process data outside Nepal. Where that occurs, Shuvmarg must assess the provider, the safeguards and applicable Nepalese law. Third-party services linked from Shuvmarg may explain their own processing in their privacy notices.

When the policy changes, the current version and effective date will be shown on this page. Material changes will be communicated through an appropriate channel where required. For an access, correction, deletion or other privacy request, contact Shuvmarg support using the details below and label the request as a privacy matter.