Privacy Policy
Effective date: 28 October 2026
This policy explains how APLUSB DECOR PRIVATE LIMITED (“Portal Jump”, “we”, “us”) handles personal data when you visit portaljump.agency, sign in to the Portal Jump for agencies app, or open a trip link that an agency has sent you. It applies under the EU General Data Protection Regulation (GDPR) and the UK GDPR.
1. Who we are
- Company: APLUSB DECOR PRIVATE LIMITED
- Trading as: Portal Jump
- Registered in: India
- Email: hello@portaljump.co
For any privacy question or request, write to hello@portaljump.co.
2. Our role
We are the controller of the personal data of the people who hold or use an agency account (the agency owner, admins and team members), of the people who ask us for a demo, and of the technical and security records described below.
We are a processor for the personal data that an agency enters or collects through the service: its trip and itinerary content, the names and details of its clients and travellers, and the leads that people send through the contact box on a trip link. For that data the agency is the controller and decides why and how it is used. Our Data Processing Addendum applies to it. If you are a traveller or a lead and want to use your rights over that data, contact the agency that sent you the link. We will help the agency to answer you.
3. What we collect, why, and on what legal basis
| Category | What it includes | Why we use it | Legal basis |
|---|---|---|---|
| Account data | Name, email address and profile picture from Google or Microsoft when you sign in. Sign in tokens from those providers. Your chosen colour mode. | To create and secure your account and let you sign in. | Contract (providing the service to you or your agency). |
| Session data | A session token, its expiry, your IP address and browser user agent. | To keep you signed in and to protect the account from misuse. | Contract, and our legitimate interest in security. |
| Team members and agency profile | Agency name, logo, plan, the names, email addresses and roles of team members, and pending invitations. | To run the agency workspace and apply plan limits and permissions. | Contract. |
| Agency content | Library items (hotels, tours, places, restaurants, with address, map position, notes and price notes) and photos the agency uploads. Photos are cleaned of hidden data such as location in the browser and checked again on our server. | To store and show the agency’s content in its trip links. | Contract. Processor role where the content holds personal data. |
| Trip links and itineraries | Titles, destinations, stops, notes, start dates, a client or group name (stored encrypted), an optional passcode (stored only as a hash), and the link address. | To build and publish trip pages and to keep the passcode secret. | Contract. Processor role for client details. |
| Leads | The name, phone or email, and message that a visitor types into a contact box. They are stored encrypted. The Cloudflare Turnstile check also sees the visitor’s IP address. | To pass the enquiry to the agency that published the link and to block spam and bots. | Processor role on behalf of the agency (the agency’s legitimate interest in answering its enquiries). Our legitimate interest in preventing abuse. |
| View and click counts | A daily number per link for page views, journey opens and contact box opens. No name, IP address or device detail is stored with them. Known crawlers and link previewers are not counted. | To show the agency how its links perform. | Contract. These counts are not personal data about a visitor. |
| Demo requests | Name, email, phone, company, country, the page the request came from, and a hidden anti spam field. Your country may be pre selected from the location Cloudflare reports for your request. That location is not stored by us. | To reply to your request and arrange a demo. | Our legitimate interest in answering you, or steps you ask us to take before a contract. |
| Audit records | Who did what and when inside an agency (sign in, plan, team, library, link, delete, restore and brand changes), the action target, a keyed hash of the IP address and the user agent. The record can only be added to. | Security, accountability and resolving disputes. | Our legitimate interest in security, and legal obligations. |
| Payment and order data | Paddle handles checkout, tax and payment details. We receive confirmation of the plan, not your card details. | To provide the paid plan and keep accounting records. | Contract and legal obligations. |
| Messages to us | Anything you send to our email address. | To answer you. | Our legitimate interest, or contract. |
We do not sell personal data. We do not use it for advertising, and we do not make decisions about people by automated means.
4. How long we keep it
- Sessions end after 7 days, and are renewed while you keep using the app.
- Links and Library items that an agency deletes go to a recycle bin for 7 days. They can be restored in that time. After 7 days a daily job removes them for good, together with their destinations and stops, and removes photos that nothing else uses. Leads from a removed link stay with the agency, without the link.
- Agency content, team data and leads are kept while the agency account is open. After the account ends we delete or return them within 30 days, unless the law requires us to keep something longer.
- Audit records are not deleted when content is deleted. We keep them for as long as needed for security and to defend legal claims.
- Demo requests are kept for up to 24 months, or until you ask us to delete them.
- Order and tax records are kept for as long as the law requires.
5. Who receives personal data
| Recipient | What for | Data |
|---|---|---|
| Cloudflare, Inc. | Hosting, storage (database and files), network security, rate limiting, and the Turnstile bot check. | All data in the service, and visitor IP addresses. |
| Google LLC | Sign in with Google. Maps and Street View embedded in trip pages. Google Sheets receives demo requests. | Account data on sign in. The visitor’s browser contacts Google when a map loads. Demo request fields. |
| Microsoft Corporation | Sign in with Microsoft. | Account data on sign in. |
| Paddle.com Market Limited | Merchant of Record: takes payment, handles tax, invoices and refunds. Paddle is an independent controller of the data it collects at checkout. | Order and payment details. |
We also share data where the law requires it, to protect our rights, or with an adviser or buyer under a duty of confidentiality if the business changes hands. Agencies decide what to share with their own clients through the links they publish.
6. International transfers
Our providers run services in several countries, including the United States. When personal data of people in the UK or the European Economic Area is transferred to a country without an adequacy decision, we rely on safeguards such as the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, or on the EU US and UK US data bridges where the provider is certified. You can ask us for a copy of the safeguards by writing to hello@portaljump.co.
7. Your rights
Under the GDPR and the UK GDPR you can ask us to:
- give you access to your personal data and a copy of it;
- correct data that is wrong or incomplete;
- erase your data, in the cases the law allows;
- restrict how we use your data;
- give you your data in a portable format, where we use it under contract or consent;
- stop using your data where we rely on our legitimate interest, or for direct marketing;
- withdraw consent, where we rely on it, at any time.
To use a right, email hello@portaljump.co. We answer within one month and may ask you to prove who you are. For data that an agency controls, we pass your request to the agency. You can also complain to your data protection authority, for example the Information Commissioner’s Office in the UK, or the authority in the country where you live or work.
8. Security
- All traffic uses HTTPS, and our session cookies are marked secure and not readable by scripts.
- Client names and leads (name, contact, message) are encrypted before they are stored, with keys tied to the agency. Passcodes are stored only as hashes.
- Every query is limited to the agency that owns the data, and access depends on the member’s role.
- Sign in is by Google or Microsoft only, so we hold no passwords.
- Rate limits, a bot check on the contact box, and an append only audit record help to stop and trace abuse.
- Trip pages are kept out of search results, and itinerary pages are never cached by browsers or networks.
No system is perfectly secure. If a breach puts your rights at risk, we will tell the people and authorities that the law requires us to tell.
9. Cookies
We use only the cookies needed to sign you in and to unlock a passcode itinerary, and we load Turnstile and Google Maps where a trip page needs them. See the Cookie Notice.
10. Children
The service is for travel businesses and is not meant for anyone under 18. We do not knowingly collect data from children. If you think we have, write to us and we will delete it.
11. Changes
We may update this policy. The effective date at the top shows the latest version. If a change is significant, we will tell agency account holders by email or in the app before it applies.