How Onyatrips organizes and tracks its legal and regulatory compliance posture.
Last updated: 8 August 2026
Effective Date: 8 August 2026
Last Updated: 23 August 2026
This is a meta-level framework document describing how Onyatrips organizes, tracks, and intends to mature its legal and regulatory compliance posture. It sits above, and cross-references, our individual policies rather than duplicating them. It distinguishes law that currently and clearly applies to Onyatrips from law that may apply depending on jurisdiction, business model, or scale, and from international frameworks we use only as a benchmark.
This Framework explains how Onyatrips approaches legal and regulatory compliance across privacy, platform governance, consumer protection, payments, and emerging areas such as AI. It is intended for internal governance use and, in a form appropriate for public disclosure, as a public-facing statement of our compliance approach.
This Framework applies to Onyatrips Tech Private Limited's operation of the Onyatrips platform. It does not itself create new user-facing rights or obligations beyond those established in our other policies — it is an organizing document.
For each legal area below, we classify Onyatrips' relationship to it as one of:
| Classification | Meaning |
|---|---|
| CURRENTLY APPLICABLE | The law clearly applies to Onyatrips today given its incorporation, location, and current activities. |
| LIKELY APPLICABLE, SCOPE UNCONFIRMED | The law probably applies but its precise scope/threshold has not been confirmed with counsel. |
| MAY BECOME APPLICABLE | Applicability depends on future business decisions (e.g., expanding to a new jurisdiction, introducing a new payment model). |
| BENCHMARK ONLY | Not confirmed as directly applicable today; used as a design standard because it reflects good practice or may become relevant with growth. |
This Framework does not currently name a specific internal legal owner, compliance officer, or governance committee. We intend to formally designate: (a) an individual or team responsible for legal/policy ownership; (b) a process for legal review of new features before launch; and (c) a cadence for reviewing and updating published policies (see Section 9).
We aim to track regulatory developments relevant to our business (data protection, consumer protection, platform/intermediary regulation, payments, and travel-sector-specific rules) and to update our policies and product accordingly. We do not currently have a documented regulatory-monitoring process, a compliance risk register, or scheduled compliance audits — establishing these is recommended as the business scales.
Classification: CURRENTLY APPLICABLE. As an entity processing the personal data of individuals in India, Onyatrips is subject to the DPDP Act, 2023. Our approach to DPDP Act compliance — lawful basis, data-principal rights, consent, and grievance handling — is set out in full in the Privacy Policy, which is the authoritative document for this topic. Key implementation gaps flagged there and repeated here for governance visibility: no self-serve deletion/export tooling, no named Grievance Officer, no formally defined retention schedule, and no adopted breach-notification procedure.
Classification: CURRENTLY APPLICABLE. Onyatrips, as an intermediary hosting user-generated content and facilitating communications between Users, operates within the framework of the Information Technology Act, 2000 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. This includes: publishing terms of service and privacy policy (done — Terms and Conditions, Privacy Policy); operating a notice-and-takedown mechanism for unlawful content (addressed in the Terms and Conditions' User-Generated Content module and the Copyright Policy); and designating a Grievance Officer. A named Grievance Officer with published contact details does not currently exist; the general legal@onyatrips.com mailbox is our current contact channel for this purpose. We intend to designate a named Grievance Officer as a compliance priority.
Classification: CURRENTLY APPLICABLE. Onyatrips facilitates paid bookings today (group-trip seats and Place slots, via Razorpay), so the Consumer Protection Act, 2019 and the Consumer Protection (E-Commerce) Rules, 2020 apply, including obligations around grievance redressal, accurate pricing disclosure, and cancellation/refund transparency. A full applicability and obligations assessment against these live bookings has not been completed with counsel; see also the Refund and Cancellation Policy for the current, honestly-limited state of our refund process (manual, case-by-case — no automated refund processing exists yet).
Classification: MAY BECOME APPLICABLE. We do not currently operate an advertising business or third-party ad placements on the Platform (see the Cookie Policy). If we introduce advertising, sponsored listings, or influencer-marketing arrangements in the future, Advertising Standards Council of India (ASCI) guidelines and applicable competition law (regarding, for example, ranking transparency and self-preferencing) would become relevant, and this Framework would be updated accordingly. Business-listing ranking practices are additionally addressed in the Business Listing Policy.
Classification: LIKELY APPLICABLE, SCOPE UNCONFIRMED. We have not confirmed whether Onyatrips' current activities — business listings for hotels/tour operators, and now live group-trip and Place-slot bookings (see Section 11) — trigger specific travel-agent, tour-operator, or hotel-aggregator licensing or registration requirements under Indian tourism regulation, or equivalent requirements in any other jurisdiction where we may operate. The Terms and Conditions expressly state that Onyatrips is not a travel agent or tour operator and does not act in that capacity; whether this characterization is sufficient to avoid sector-specific licensing obligations, given that bookings are now live (not merely planned), requires dedicated legal analysis as a priority, not a future-scaling item.
Classification: CURRENTLY APPLICABLE. Paid booking is live for Users today (group-trip seats and Place slots). Onyatrips' payment integration is built exclusively against Razorpay, a licensed payment aggregator/gateway, and does not directly handle card data (see the Security Policy); see the Refund and Cancellation Policy for the current, honest state of booking/payments. We do not hold, transmit, or intermediate funds ourselves — Razorpay's own regulatory status (as a Reserve Bank of India-regulated payment aggregator) governs the payment-processing layer. This currently-applicable classification, and its practical implications (PCI-DSS scope, e-commerce/consumer-protection obligations, AML/KYC exposure below), have not yet been confirmed with counsel — flagged as a priority, not deferred as a future concern. Our peer-to-peer expense-splitting feature (which would track, but not move, money between Users, if introduced) has not been separately assessed for implications under payment-aggregator or payment-system regulation, though no funds would transfer through Onyatrips for that feature; it does not currently exist.
Classification: LIKELY APPLICABLE, SCOPE UNCONFIRMED (upgraded from "not currently applicable" now that paid booking is live). We do not currently perform AML screening or KYC verification of Users — our only identity checks are the email-based verification described in the Privacy Policy. Razorpay carries its own regulatory AML/KYC obligations as a payment aggregator, which reduces Onyatrips' direct exposure, but with real payments now flowing through the Platform this should be confirmed with counsel rather than assumed low-risk, and revisited again if Onyatrips ever handles funds more directly (e.g., a future wallet feature — none currently exists) or facilitates higher-value transactions.
We have not confirmed the specific GST treatment applicable to booking fees, platform/service fees, or business-onboarding revenue (if any) generated through the Platform. This should be assessed with a qualified tax adviser as transaction volume grows, and reflected in the Refund and Cancellation Policy once determined.
Our approach to content moderation, prohibited conduct, and enforcement is set out in the Community Guidelines; companion/offline-meeting-specific safety is addressed in the Travel Companion Safety Policy; child safety is addressed in the Child Safety Policy. As documented there, several enforcement capabilities (in-app report/block tooling, live chat moderation, a formal appeals process) are not yet built — this Framework does not restate those gaps in detail but flags them as governance priorities, since platform-safety regulation both in India (IT Rules 2021) and internationally (see Section 17) increasingly expects functioning versions of these controls.
Our accessibility posture, including confirmed gaps, is set out in the Accessibility Statement. We have not confirmed whether any specific accessibility law (e.g., India's Rights of Persons with Disabilities Act, 2016 and its accessibility standards for electronic content) imposes binding obligations on Onyatrips at its current scale; the Accessibility Statement is written as a good-practice commitment rather than a certified-compliance claim regardless.
Classification: BENCHMARK ONLY, with one CURRENTLY APPLICABLE caveat. As established in the Privacy Policy and Responsible AI Policy, Onyatrips does not currently operate machine-learning-based recommendation, matching, or scoring systems in production — discovery and matching run on deterministic rule-based filtering. The one confirmed AI/ML-adjacent component is an experimental content-moderation microservice (combining keyword rules with a classical machine-learning profanity/spam classifier), which is not currently wired into the live chat path. Because no consequential AI/ML system is currently in production, comprehensive AI-specific regulation (such as the EU AI Act) is not currently applicable to Onyatrips' actual operations, but is used as a design benchmark for how we intend to govern any AI capability introduced in the future — see the Responsible AI Policy for the full framework.
Classification: BENCHMARK ONLY, pending confirmation of actual EEA/UK/California user presence. The Privacy Policy explains GDPR/UK GDPR and CCPA/CPRA principles and the rights we would extend to users in those jurisdictions if and to the extent those laws apply to us. We do not claim GDPR or CCPA "certification" — no such certification exists under either law — and we do not claim blanket compliance without confirming applicability first.
We reference the following as design benchmarks, not as laws currently binding on Onyatrips, because they represent maturing global expectations for platforms like ours and may become directly relevant with international expansion:
We have not conducted a sanctions/export-control applicability assessment. This is generally more relevant to businesses handling cross-border payments, technology exports, or specific restricted-party transactions; given Onyatrips' current India-focused operations and its reliance on a regulated payment aggregator (Razorpay — see Section 11) for payment processing, immediate exposure is likely limited, but this should be revisited with international expansion.
Our approach to government and law-enforcement requests is set out in full in the Law Enforcement Request Policy.
Consumer-facing complaint handling is addressed operationally through our support/feedback channels (see the Refund and Cancellation Policy) and contractually through the "Arbitration," "Jurisdiction," and "Governing Law" clauses of the Terms and Conditions. Whether the Consumer Protection (E-Commerce) Rules, 2020's specific grievance-redressal-timeline requirements are being met by our current manual, non-SLA-bound process has not been assessed.
Our confirmed third-party processors are listed in the Privacy Policy. Formal vendor due-diligence and data-processing-agreement documentation for each has not been confirmed as complete. We do not currently operate an affiliate program (see the Disclaimer); if one is introduced, affiliate-disclosure compliance (e.g., under Indian advertising-disclosure norms) would need to be built into that feature from the outset.
We do not currently have a formal, company-wide record-retention schedule (distinct from the User-data retention discussion in the Privacy Policy) or a defined legal-hold process for preserving records relevant to litigation or a regulatory inquiry. Establishing both is recommended as part of general compliance maturity.
We do not currently have a documented compliance-training program for staff/contractors (e.g., on data handling, content moderation standards, or law-enforcement request handling). This is recommended as the team grows.
This Framework is deliberately structured around what is CURRENTLY APPLICABLE and confirmed, versus what requires further work. The consolidated set of implementation and legal-review items across all of our policy documents — including this one — is intended to function as a de facto compliance roadmap; the highest-priority items (self-serve data deletion, cookie consent, age-gate enforcement, a named Grievance Officer, in-app reporting tooling, and an incident-response procedure) recur across multiple documents and should be treated as the near-term priority set.
We will update this Framework as our regulatory posture, product, and jurisdictional footprint evolve. Material changes will be reflected in an updated "Last Updated" date above.
This Framework references, and should be read alongside, every other Onyatrips legal and policy document: the Terms and Conditions, Privacy Policy, Cookie Policy, Community Guidelines, Travel Companion Safety Policy, Refund and Cancellation Policy, Disclaimer, Security Policy, Law Enforcement Request Policy, Child Safety Policy, Accessibility Statement, Review and Rating Policy, Business Listing Policy, Responsible AI Policy, Intellectual Property Policy, and Copyright Policy.
We use analytics cookies to understand how you use Onyatrips, so we can improve it. These are optional — the site works fully without them. Learn more.