EveryoneLast updated 30 October 2026
Safety & Security Policy
Safety on Brujo is a shared responsibility between the Platform and its users. Brujo implements technical, administrative, and organizational safeguards to protect users and their information, and provides safety-oriented features such as live trip tracking, QR-verified boarding, and secure payments. This page summarizes those measures and what you can do to stay safe.
1. Platform Security Measures
- All communications between the Brujo app, website, backend, and authorized third-party providers are protected with encrypted protocols — HTTPS with Transport Layer Security (TLS).
- Passwords are never stored in plain text; they are hashed using industry-standard techniques (bcrypt), and Brujo employees cannot retrieve your original password.
- Infrastructure protections include firewalls, secure hosting environments, database security controls, activity and access monitoring, rate limiting, vulnerability assessments, security patch management, and backup and disaster recovery procedures.
- Access to personal information is role-based and restricted to authorized personnel with a legitimate business need, under confidentiality obligations.
- Fraud detection mechanisms monitor for suspicious transactions, unauthorized account access, duplicate accounts, and abuse of the Platform.
2. Safe Boarding with QR Credentials
- Every confirmed booking includes a unique QR boarding credential issued solely for the registered traveller.
- QR Codes must not be copied, altered, transferred, shared, or used fraudulently.
- Boarding verification (including location-assisted verification, where enabled) helps ensure only genuine ticket-holders board.
3. Live Trip Tracking and Location Safety
- With your permission, location features enable live trip tracking, route visualization, navigation assistance, and boarding verification — designed to enhance traveller safety.
- Location access can be enabled, disabled, or modified at any time through your device settings, although location-dependent safety features may then be limited.
4. Payment Safety
- Payments are processed exclusively through authorized third-party payment gateways (Razorpay) over encrypted channels compliant with industry standards, including PCI DSS where applicable.
- Brujo never stores complete card numbers, CVV numbers, UPI PINs, or internet banking credentials.
- Never share payment credentials or OTPs with anyone — including anyone claiming to represent Brujo.
5. Your Role in Staying Safe
- Keep your login credentials confidential and never share OTPs with any person. Brujo will never request OTPs through unsolicited calls, emails, or messages.
- Use a secure password and protect your device with a screen lock or biometric authentication.
- Install operating system and application updates promptly.
- Notify Brujo immediately if you suspect unauthorized account activity.
- Brujo is not responsible for unauthorized access resulting from a user's failure to protect their credentials or device.
6. Age and Guardian Supervision
- Users must generally be at least 18 years of age to independently make bookings, complete financial transactions, or create an Organizer account.
- Individuals between 13 and 18 may use certain features only with the involvement, supervision, and consent of a parent or legal guardian, where permitted by applicable law.
7. Reporting Incidents
- Report suspected security incidents, fraud, or unsafe behavior to official@brujo.in.
- When Brujo becomes aware of a security incident, we investigate, contain and mitigate risks, restore affected systems, implement corrective measures, notify affected users where required by law, and cooperate with authorities where legally required.
8. Enforcement
- Accounts that violate the Terms & Conditions, engage in fraud, abuse the Platform, harm other users, breach community guidelines, or engage in unlawful activities may be suspended, restricted, deactivated, or permanently terminated — with or without prior notice depending on severity.
- Brujo cooperates with law enforcement and regulatory authorities as required or permitted under applicable law.
9. A Note on Security
- While Brujo implements commercially reasonable, industry-standard safeguards, no method of electronic transmission or storage is completely secure.
- Brujo cannot guarantee that unauthorized access, cyberattacks, or other incidents will never occur; users acknowledge these inherent risks when using internet-based services.
- This policy is effective from 30 October 2026 (Version 2).