Privacy policy
Version 1.0
What we collect
Name, username, email address, mobile number and city at registration. For organisers, additionally: brand details, social handles, GSTIN where provided, and identity documents for the people responsible for each trip. Booking records, messages sent on the platform, reviews, and standard device and usage logs.
Why we collect it
To create and operate your account, process bookings and refunds, verify organisers, enable communication between travellers and organisers, meet financial record-keeping obligations, and detect fraud and abuse. We do not sell your data.
Consent (DPDP Act, 2023)
We record your consent at registration together with the policy version in force at that time. You may withdraw consent at any time from Account → Privacy, which begins account deletion.
Identity documents
Identity documents are stored in restricted private storage, reachable only through short-lived signed links, and are never shown to travellers or other organisers. Travellers see only a name and a photo for the person accompanying their trip.
Retention and erasure
Account data is retained while your account is active. On deletion, personal data is erased or irreversibly anonymised, except transaction records we are legally required to retain — those are kept with nothing identifying you.
Your rights
Access, correction, erasure and a machine-readable export of your data, all available from Account → Privacy, or by writing to the Grievance Officer.
Sub-processors
Payments: Razorpay. Email: our transactional email provider. Hosting, database and media storage: Amazon Web Services, in the region configured for the deployment.