Privacy Policy

Go Heli Nepal Private Limited, Kathmandu, Nepal, is the data controller for personal data collected through gohelinepal.com, the Go Heli Nepal app and the flight desk. Write to support@gohelinepal.com about your data, or hello@gohelinepal.com for anything else.

Enquiries and messages: your name, email address and phone number, the route, dates and party size, passengers' weights, and anything you write to us.

Bookings: what an operator needs to fly and manifest you — each traveller's name, nationality, passport number, date of birth and weight — and your booking, payment and invoice records.

Rescue and SOS requests: the callback number, the name of the person reporting if given, the casualty's condition, how many people need help, any location note and altitude, and your device's GPS position if you choose to share it. We also record the IP address the request came from.

Accounts: name, email address, phone number and role. Your password is stored only as a cryptographic hash, which we cannot read. If you turn on two-step sign-in, we store the secret that generates your codes.

Technical data: IP address, browser and device details and the pages requested, recorded by our hosting provider and our servers for security and to prevent abuse.

To answer your enquiry and bring back quotes, to arrange and confirm your booking with the operator, to coordinate a rescue, to keep accounts secure and stop abuse, and to keep the accounting and booking records the law requires.

We send email only about things you have started — an enquiry, a booking, an account or a rescue. We do not send marketing.

We rely on what is needed to provide the service you asked for, on our legal obligations, and — in an emergency — on protecting someone's life or health.

Operators. Operators asked to quote receive what they need to price the flight: route, dates, party size, weights and your notes. The operator flying you receives what it needs to fly you, including travellers' names, a contact number and, where a permit or manifest requires them, passport details. Operators cannot see your account or your other bookings.

Rescue. What you send in an emergency is shared with the operators, medical responders and, where needed, the authorities and your insurer's assistance company.

Service providers that process data for us: Cloudflare, which hosts the site and API and provides content delivery, security and cookieless, aggregate web analytics; Resend, which sends our email; Kudos CRM, which runs the chat window on the site (what you type into it is processed by them); Google, only if you choose Sign in with Google, which shares your name and email address with us; WhatsApp, run by Meta, only if you choose to message us there, under WhatsApp's own terms; and, once online payment is available, the payment processor named at checkout, which handles card and wallet details — we never see full card numbers.

Authorities, where the law requires it.

We do not sell personal data, and we do not share it with advertisers.

Some of the providers above store or process data outside Nepal, including in the United States and the European Union. We use them because the service cannot run without them, and we share with each only what its job needs.

The site sets no advertising or tracking cookies.

If you sign in, our API at api.gohelinepal.com sets heli_access_token and heli_refresh_token, which keep you signed in and cannot be read by scripts in the page; heli_csrf, which protects forms from cross-site forgery; heli.signed_in, which tells the page you are signed in; and, only during two-step sign-in, heli_mfa_challenge and heli.mfa_pending, which expire after five minutes.

heli.currency remembers the currency you chose, for one year.

Your browser's local storage remembers whether you paused motion or muted sound, and session storage keeps a half-filled form if you navigate away. Neither leaves your device.

Cloudflare may set a strictly necessary security cookie to protect the site from automated abuse. The chat window, and Google's sign-in button where it appears, may set their own cookies or storage under their providers' policies.

Booking, invoice and rescue records: seven years, to meet accounting and aviation record-keeping expectations and because rescue records are often needed for insurance claims.

Enquiries that did not become bookings, and contact messages: two years.

Accounts: for as long as the account is open, and up to two years after it is closed.

Technical logs: only as long as they are needed for security, normally a few months.

You can ask for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it, by writing to support@gohelinepal.com. We reply within 30 days. Where a booking or rescue record must be kept for legal reasons, we will tell you which parts we cannot delete and why.

You also have rights under Nepal's Privacy Act, 2075 (2018). Raise any concern with us first, so we can put it right.

Connections to the site and API are encrypted. Passwords are hashed, sign-in cookies cannot be read by scripts, and access to booking and rescue data is limited to the staff and operators who need it.

The site is not aimed at children. Parents and guardians book for children travelling with them and give us the details the operator needs.

When what we collect, or who we share it with, changes, we update this page and the date at the top of it.