Privacy Policy
What we collect, why, who we share it with and how long we keep it. We collect what is needed to arrange and fly your trip safely, we tell you when a law or an aviation authority needs it, and we do not sell personal data.
Who is responsible for your data
Go Heli Nepal Private Limited, Kathmandu, Nepal, is the data controller for personal data collected through gohelinepal.com, the Go Heli Nepal app, WhatsApp and the flight desk. Write to support@gohelinepal.com about your data, call the desk on +977 98 6104 4994, or write to hello@gohelinepal.com for anything else.
The operator that flies you is a separate controller for what it needs to run the flight — its passenger manifest, weight and balance records and safety records — and handles that data under its own obligations to the Civil Aviation Authority of Nepal (CAAN).
What we collect
Enquiries and messages: your name, email address and phone number, the route, dates and party size, passengers' weights, and anything you write to us by email, phone or WhatsApp.
Bookings: what an operator needs to fly and manifest you — each traveller's name, nationality, passport number, date of birth and weight — and your booking, payment and invoice records. Where a landing needs a permit, the details the permit office asks for.
Health and fitness to fly: anything you tell us about pregnancy, a heart or lung condition, recent surgery or another condition that affects flying at altitude. We ask for it only so the operator can decide whether it is safe to carry and land you.
Rescue and SOS requests: the callback number, the name of the person reporting if given, the casualty's condition, how many people need help, any location note and altitude, insurance and assistance-company details, and your device's GPS position if you choose to share it. We also record the IP address the request came from.
Accounts: name, email address, phone number and role. Your password is stored only as a cryptographic hash, which we cannot read. If you turn on two-step sign-in, we store the secret that generates your codes. If you choose Sign in with Google, Google tells us your name and email address.
Technical data: IP address, browser and device details and the pages requested, recorded by our hosting provider and our servers for security and to prevent abuse.
Booking for other people
If you book for a group, a family or a client, you give us the other travellers' details. Please tell them you are doing so and point them to this policy. A parent or guardian gives the details for a child travelling with them.
Why we use it, and on what basis
To answer your enquiry and bring back quotes, and to arrange, confirm and change your booking with the operator: because it is needed to provide the service you asked for.
To give the operator the names, weights and passport details a manifest, a weight and balance calculation or a permit requires, and to keep the accounting and booking records the law requires: because the law and aviation rules require it.
To pass health details to the operator so it can decide whether flying is safe: with your consent, which you give when you tell us. You can withdraw it, but the operator may then be unable to carry you.
To coordinate a rescue: to protect someone's life or health, including when the person concerned cannot consent at the time.
To keep accounts secure and stop fraud and abuse: because we and our customers have a legitimate interest in a safe service.
We send email only about things you have started — an enquiry, a booking, an account or a rescue. We do not send marketing, and we make no decision about you by automated means alone.
Who we share it with
Operators. Operators asked to quote receive what they need to price the flight: route, dates, party size, weights and your notes. The operator flying you receives what it needs to fly you, including travellers' names, a contact number, any health details you gave for fitness to fly and, where a permit or manifest requires them, passport details. Operators cannot see your account or your other bookings.
Aviation and government authorities. Passenger names, nationalities, passport numbers and weights may be passed, through the operator or by us, to CAAN, airport security, the Department of Immigration and national park or conservation-area permit offices, where a flight, a landing or a permit requires them.
Rescue. What you send in an emergency is shared with the operators, hospitals and medical responders, the police and other authorities where needed, and your insurer or its assistance company so that the rescue can be authorised and paid for.
Service providers that process data for us: Cloudflare, which hosts the site and API and provides content delivery, security and cookieless, aggregate web analytics; Resend, which sends our email; Google, only if you choose Sign in with Google, which shares your name and email address with us; WhatsApp, run by Meta, only if you choose to message us there, under WhatsApp's own terms; and, once online payment is available, the payment processor named at checkout, which handles card and wallet details — we never see full card numbers.
Police, courts and investigators, only when the law requires it, on a written request from an authority entitled to make it or under a court order.
If the business or part of it is sold or merged, the buyer, under this policy.
We do not sell personal data, and we do not share it with advertisers.
Transfers outside Nepal
Some of the providers above store or process data outside Nepal, including in the United States and the European Union. We use them because the service cannot run without them, and we share with each only what its job needs. Sending your booking to an operator in Nepal is necessary to provide the flight you asked for.
Cookies and storage on your device
The site sets no advertising or tracking cookies.
If you sign in, our API at api.gohelinepal.com sets heli_access_token and heli_refresh_token, which keep you signed in and cannot be read by scripts in the page; heli_csrf, which protects forms from cross-site forgery; heli.signed_in, which tells the page you are signed in; and, only during two-step sign-in, heli_mfa_challenge and heli.mfa_pending, which expire after five minutes.
heli.currency remembers the currency you chose, for one year.
Your browser's local storage remembers whether you paused motion or muted sound, and session storage keeps a half-filled form if you navigate away. Neither leaves your device.
Cloudflare may set a strictly necessary security cookie to protect the site from automated abuse. Google's sign-in button, where it appears, may set its own cookies or storage under Google's policies.
How long we keep it
Booking, manifest, invoice and rescue records: seven years, to meet accounting and aviation record-keeping expectations and because rescue records are often needed for insurance claims.
Health details given for fitness to fly: with the booking they belong to, and no longer.
Enquiries that did not become bookings, and contact messages: two years.
Accounts: for as long as the account is open. When you delete your account, your name, contact details, saved travellers and reviews are removed straight away; the booking, invoice and rescue records above are kept without your name on them.
Technical logs: only as long as they are needed for security, normally a few months.
Your rights
You can correct your name and phone number, and delete your account, yourself from your account's settings page. Deleting asks for a code we email to you, and cannot be undone.
You can also ask for a copy of the personal data we hold about you, ask us to correct or delete it, ask us to stop or limit using it, or ask for it in a form you can take elsewhere, by writing to support@gohelinepal.com. We reply within 30 days. Where a booking or rescue record must be kept for legal reasons, we will tell you which parts we cannot delete and why.
You have rights under Nepal's Individual Privacy Act, 2075 (2018), which requires your consent before personal data is collected or disclosed, and limits its use to the purpose it was collected for. If you live in the European Union or the United Kingdom, you also have rights under the GDPR or the UK GDPR, including the right to complain to your data protection authority.
Raise any concern with us first, so we can put it right.
Security
Connections to the site and API are encrypted. Passwords are hashed, sign-in cookies cannot be read by scripts, and access to booking, health and rescue data is limited to the staff and operators who need it.
No system is completely secure. If a breach puts your data at risk, we will tell you and, where the law requires it, the authorities, without undue delay.
Cameras at helipads and airports
We do not run cameras. Airports, helipads and operators may record CCTV at their premises for security, under their own rules and Nepali law.
Children
The site is not aimed at children, and we do not knowingly open accounts for anyone under 18. Parents and guardians book for children travelling with them and give us the details the operator needs.
Changes to this policy
When what we collect, or who we share it with, changes, we update this page and the date at the top of it. This policy is governed by the law of Nepal.
The other policies
Questions about any of this? Ask the desk.
Tell us the flight. We do the comparing.
Send your route, your date and who is flying. We ask every licensed operator that can fly it and come back with the cheapest, aiming within four hours.