Privacy Policy

We collect different types of information depending on how you interact with us. Here is a full breakdown of what we may collect and why:

We use the information we collect for the following purposes, each with a corresponding legal basis:

We will never use your personal information for purposes incompatible with those listed above without obtaining your explicit consent first.

We do not sell, rent, or trade your personal information to third parties for marketing purposes. We only share your data in the following limited circumstances:

• Service providers: Hotels, resort operators, trek guides, and transport drivers who are part of delivering your booked itinerary. They receive only the minimum data needed (e.g., your name, check-in date, number of guests) and are required to handle it confidentially.
• Government authorities: The Uttarakhand Tourism Development Board, Kedarnath Management Authority, Forest Department, and other statutory bodies where submission of your ID and personal details is legally required for Yatra or trekking permits.
• Technology providers: Our website infrastructure is provided by Vercel (hosting) and Supabase (database). Both process data under strict data processing agreements and comply with industry security standards.
• Analytics providers: Google Analytics receives anonymised usage data as described in ourCookie Policy.
• Legal requirements: We may disclose your data if required by law, court order, or to protect the rights and safety of our team or the public.

We retain your personal data for as long as necessary to fulfil the purpose for which it was collected and to comply with our legal obligations:

• Booking data and identity documents: Retained for 3 years after your travel date. This is necessary for dispute resolution, tax compliance, and government audits related to Yatra permits.
• Communication records: Enquiries and messages retained for 2 yearsafter your last contact with us.
• Financial records: Transaction records retained for 7 years as required by Indian accounting and tax laws.
• Website analytics data:Aggregated and anonymised; retained per Google Analytics' default 14-month data retention window.
• Marketing preferences: Retained until you withdraw consent or request deletion.

When your data is no longer required, we will securely delete or anonymise it so it can no longer be associated with you.

We implement appropriate technical and organisational measures to protect your personal data against accidental loss, unauthorised access, alteration, or disclosure. These measures include:

• Encrypted data transmission via HTTPS/TLS across our entire website.
• Database-level row security and access controls on our Supabase backend.
• Restricted staff access — only team members who need your data to deliver your booked services can access it.
• Regular security reviews and dependency updates.
• Physical security of office documents containing guest ID copies.

However, no method of internet transmission or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security. In the event of a data breach affecting your rights, we will notify you without undue delay.

As a data subject, you have the following rights with respect to your personal information:

• Right to Access: You can request a copy of all personal data we hold about you. We will provide this within 30 days of a verified request.
• Right to Rectification: If your data is inaccurate or incomplete, you can ask us to correct it. For example, if your name is misspelled on the booking, we will update it immediately.
• Right to Erasure: You can request deletion of your personal data where it is no longer necessary for the purpose it was collected, and where there is no overriding legal obligation for us to retain it.
• Right to Restrict Processing: You can ask us to pause processing of your data in certain circumstances (e.g., while a dispute is being resolved).
• Right to Object: You can object to processing based on legitimate interests (e.g., marketing emails). We will cease that processing unless we have compelling grounds to continue.
• Right to Withdraw Consent:Where processing is based on consent (e.g., promotional emails), you can withdraw consent at any time by clicking "Unsubscribe" in an email or contacting us directly.

To exercise any of these rights, contact us using the details in Section 7. We will respond within 30 days. We may need to verify your identity before processing the request.

Our services are not directed at children under 13 years of age. We do not knowingly collect personal information from children under 13. If a child is part of a tour group, all consent and data submission is handled by a parent or legal guardian.

If you believe we have inadvertently collected data from a child under 13 without parental consent, please contact us immediately and we will delete the data.

Our website may contain links to external websites, including Uttarakhand government portals, accommodation partners, and payment services. These sites have their own privacy policies and we are not responsible for their content or practices. We encourage you to review their privacy policies before providing any personal information.

For any questions, concerns, or requests related to this Privacy Policy, or to exercise your data rights, please contact our Privacy Contact:

We also invite you to review our Cookie Policy and Terms & Conditions for a complete picture of how we operate.