MakeMyTrip Privacy Policy 2026: Your Contacts Are On Its Servers

The most quotable sentence in MakeMyTrip's privacy policy is eleven words long and sits under a heading called PERMISSIONS REQUIRED FOR USING OUR MOBILE APPLICATIONS.

"When the MMT app is installed on your phone or tablet, a list of permissions appear and are needed for the app to function effectively. There is no option to customize the list."

What follows is fourteen permissions, each with MakeMyTrip's own stated reason beside it. Most are unremarkable for a travel app — camera for review photos and UPI QR scanning, calendar to add your trip, location to pre-fill your nearest airport, Bluetooth so a third-party self-drive partner can let you unlock a car.

Two are not unremarkable, and both are described plainly in the document rather than hidden. On contacts: "If you allow us to access your contacts, it enables us to provide a lot of social features to you such as sharing your hotel/ flight/ holidays with your friends, inviting your friends to try our app, send across referral links to your friends, etc. We may also use this information to make recommendations for hotels where your friends have stayed. This information will be stored on our servers and synced from your phone."

Stored on our servers and synced from your phone. That is the part most people would not assume from the word "permission" — the address book does not stay on the handset for a one-off share; the document says it is copied to MakeMyTrip and kept in step with your phone.

And on SMS: "If you allow us to access your SMS, we read your SMS to autofill or prepopulate 'OTP' while making a transaction and to validate your mobile number." That is the standard Indian OTP-autofill pattern, and the document says what it is for in one sentence rather than burying it.

The full list is worth seeing in one place, because the stated purposes are specific and several of them are about identifying you rather than serving you.

IMEI/IMSI — "enables us to identifying different users uniquely and helps us to prevent frauds" (the grammar is the page's). SIM Serial Number — "enables us to read your sim serial number and helps us in authenticating your mobile number for UPI registration". Device ID & Call information — "used to detect your Android ID through which we can uniquely identify users". Identity — "enables us to know about details of your account(s) on your mobile device… to auto-fill your email ID's". Phone — to call hotels, airlines and the contact centre from inside the app. Phone Number — login, UPI and fraud prevention. Device & App history — OS, version, network, hardware model, unique device identifier, preferred language.

Subscription Information is the one with the most generous stated purpose: it "enables to provide you a seamless experience depending upon your network… this also enables us in providing to you the train status even in an offline mode". Wi-Fi connection information is for "more detailing on maps, better image loading". Video/Audio is for video reviews. Calendar puts the trip in your calendar. Bluetooth is there so self-drive partners can "permit you to lock and unlock your self-driven vehicles".

None of this is secret and none of it is unusual for a large Indian travel app. What makes it worth reading is that the document is unusually candid about the trade, right down to the line saying the list cannot be customised. Your phone's own operating system will still let you deny individual permissions; the policy's statement is about the list the app presents.

The page at makemytrip.com/legal/privacy_policy.html is not one document. It is two, run together.

The first is headed "Privacy Policy - MakeMyTrip" and opens: "MakeMyTrip (India) Limited (hereinafter 'MMT') recognizes the importance of privacy of its users… as a responsible data controller and data processer." Concerns go to privacy@go-mmt.com. This is the document aimed at Indian users, and consent is framed by use: "By using or accessing the Website or other Sales Channels, the User hereby agrees with the terms of this Privacy Policy… If you disagree with this Privacy Policy please do not use or access our Website."

About 33,500 characters in, after a section headed "CHANGES TO THE PRIVACY POLICY", a second document starts: "Privacy Policy (EU, UK and US)". That is where the named legal rights are. GDPR Article 21(1) for objecting to legitimate-interest processing and Article 21(2) for objecting to direct marketing; the California Consumer Privacy Rights Act section with its "No sale of personal information… has not been sold by MMT as of now" declaration, its Sensitive Personal Information disclosure, its Retention Disclosure and its Non-discrimination Declaration; and a different contact, dpo@makemytrip.com.

A practical consequence worth stating carefully: the itemised, article-numbered rights on this page are set out in the document headed for the EU, the UK and the US. The India-facing document is less specific about mechanism — it offers withdrawal of consent by writing to privacy@go-mmt.com and notes that "if such processing of data is essential for us to be able to provide service to you, then we may not be able to serve or confirm your bookings after your withdrawal of consent." Whether any Indian statutory right applies regardless of what a policy itemises is a matter of law, not of this page.

One line in the India document that does apply to everyone: "the data shared with MMT shall be primarily processed in India and such other jurisdictions where a third party engaged by MMT may process the data on MMT's behalf."

Three absences are worth recording precisely, because an absence is easy to assert carelessly and we checked each one mechanically across the full 84,150 characters we read.

No retention period. The India policy gives no figure at all. The EU/UK/US document says MMT will keep data "for as long as is necessary to enable you to use our services or to provide our services to you… to comply with applicable laws, resolve any disputes and otherwise to allow us to conduct our business, including to detect and prevent fraud". The California Retention Disclosure says "for the duration necessary to fulfil the objectives outlined in this Privacy Notice". No number, in days, months or years, appears in any of the three.

No named grievance officer. The words "Grievance" and "Nodal" do not occur anywhere in the text we read. Two email addresses are published — privacy@go-mmt.com in the India policy and dpo@makemytrip.com in the EU/UK/US document — and the EU/UK/US document describes a data protection function responsible for "monitoring compliance with relevant legislation in relation to the protection of personal data". We report this absence as an absence from this page on this date. We draw no legal conclusion from it, and a company may publish such details elsewhere on its site or in its app.

No mention of India's own data protection statute. The strings "Digital Personal Data Protection" and "DPDP" do not appear. GDPR appears four times and the California Consumer Privacy Rights Act four times. Again: that is a statement about what a document contains, not about whether any obligation applies to anyone.

One: decide about contacts deliberately. The contacts permission is the only one on the list whose stated effect is that the data "will be stored on our servers and synced from your phone". If you do not use the share-with-friends features, your phone's settings let you deny it individually regardless of what the in-app list offers.

Two: turn on two-factor authentication. The policy recommends it itself and tells you where: "in the Security section of your account settings". A travel account holds passport numbers, co-traveller details and a saved payment method.

Three: remember that reviews are public and syndicated. "Each User who posts review or ratings, Q&A, photographs shall have a profile, which other Users will be able to access… The reviews written or posted may also be visible on other travel or travel related platforms." We read MakeMyTrip's review policy separately — including when a review gets removed or edited.