Legal

Privacy Policy

Last updated: September 2026

Kadal2Sahyadri ("we", "us") runs a marketplace where people book outdoor adventures with independent organizers. This policy explains what personal data we collect, why, who we share it with, how long we keep it, and the rights you have under India's Digital Personal Data Protection Act, 2023 ("DPDP Act"). For the data described here we are the Data Fiduciary.

At a glance

We collect what is needed to run your account and your bookings, and nothing for advertising.
We never sell your data, and we use no advertising or analytics trackers.
Organizers see the participant details they need to run the trip you booked. Government ID numbers are shown to them masked.
ID numbers are encrypted and automatically erased after your trip.
Your data is stored in India. You can correct it or delete your account from Account settings.

1. What we collect

1.1 Your account

Name, email address, mobile number and password. The password is stored only as a one-way hash.
If you sign in with Google: your Google account identifier, name and email. We never receive your Google password.
Your referral code, and who referred you, if anyone.
When you accepted our Terms and this policy, and which version.

1.2 Bookings and participants

When you book, we collect what the organizer needs to run the trip safely:

Contact phone and email for the booking.
For each participant: name, age and gender. Also a mobile number, if the organizer requires one.
A government ID document type and number, only for activities that require it, for example where a forest or protected-area permit needs a participant list.
An emergency contact: name, phone number and relationship.
Your pickup point, add-ons, coupon used and any notes.
If a participant is under 18: the parent or guardian's name, relationship and phone number, and the consent record (see section 8).

1.3 Payments

Payments are handled by Razorpay. We never see or store card numbers, CVV, UPI PINs or bank passwords. We keep the Razorpay order and payment IDs, the amounts, the payment and refund status, and the tax invoice for each booking.

1.4 If you are an organizer

Your name, email, mobile number, organization name and public profile details (description, website and social links).
Verification documents you upload: a government ID (PAN or masked Aadhaar), and optionally business registration, bank statement, insurance or other certificates.
Bank account number, IFSC and bank name for payouts, and your GSTIN if you are registered.
Team members you invite, and guides you list (name, gender, certifications and bio). You must have each guide's consent before listing them.
Walk-in bookings you record, including the customer details you enter.

1.5 Other things you give us

Reviews: rating, text, and any photos or videos you upload.
Problem reports and complaints about a booking, and the replies to them.
Waitlist sign-ups for a full departure: name, email, optional phone and number of seats. You don't need an account for this.
Your wishlist, and messages you send to our support team.

1.6 Collected automatically

Sign-in records: each time you sign up, sign in or refresh your session, we record the IP address, the browser and device type, and an approximate location (city or region) worked out from the IP address. These records help us detect account misuse.
Essential cookies and browser storage that keep you signed in and save your progress (section 9).

1.7 What we don't collect

We do not collect your precise location, contacts or photos from your device. We don't run analytics, advertising or social-media tracking scripts. When an organizer scans a QR e-pass, the camera image is decoded on their phone and only the pass code is sent to us.

2. Why we use it

We process your data on the basis of the consent you give when you sign up or book. Where the DPDP Act allows, we also rely on legitimate uses, such as complying with law, tax and accounting rules, or responding to a medical emergency. We use it to:

create and secure your account, and verify your email or phone with a one-time code;
take bookings, collect payments, issue invoices and process cancellations and refunds;
give organizers the participant details, e-passes and manifests they need to run the trip and meet permit requirements;
send booking confirmations, reminders, changes and other service messages;
verify organizers before they can publish activities, and pay them out;
publish reviews, handle complaints and provide support;
detect and prevent fraud, fake reviews and account misuse;
meet our legal, tax and regulatory obligations.

We don't use your data for advertising, sell it, or make automated decisions about you that have legal or similarly significant effects.

3. Who we share it with

3.1 The organizer of your booking

When you book, that activity's organizer and their team can see each participant's name, age, gender, mobile number (if collected) and the emergency contact. This lets them run the trip and reach you about pickups, changes or emergencies. Government ID numbers are shown to them masked. The full number is only available when an organizer downloads a permit list for a departure that requires one. Every such download is logged, and the organizer's owner can review the log. The organizer may give that list to the permit authority, such as a forest department.

Organizers may use this data only to run the booked activity (see section 10). An organizer's public profile never shows their contact details, GSTIN or verification documents, only which types of document were checked.

3.2 Service providers

We use the following providers to run the platform. Each receives only what it needs for its task:

Provider	What for	Data involved
Razorpay	Payments and refunds	Amount, booking reference, your contact details; card or UPI details go directly to Razorpay
Google Cloud (Mumbai region)	Hosting our servers, database and uploaded files	All data described in this policy
Google Identity Services	“Sign in with Google”, only if you use it	Your Google account identifier, name, email
Hostinger	Sending email, including one-time codes	Your email address and the message
ip-api.com	Approximate location of a sign-in, for security	The IP address of the sign-in
Ola Maps	Place search when you type a location	The search text only, nothing that identifies you
YouTube (Google)	Videos organizers add to activity pages	Standard YouTube data when you play an embedded video (see section 9)
SMS and WhatsApp providers (MSG91, Meta), when switched on	Sending one-time codes and booking messages by SMS or WhatsApp	Your mobile number and the message

3.3 When the law requires it

We may disclose data when required by law, a court order or a government authority, or when necessary to protect someone's life or safety, or to investigate fraud.

3.4 Business transfers

If Kadal2Sahyadri is merged, acquired or sells its assets, your data may transfer to the new owner. We will tell you before that happens, and the new owner must honour this policy or ask for your consent again.

We never sell your personal data.

4. Where it is stored

Our servers, database and uploaded files are hosted with Google Cloud in its Mumbai region, in India. A few providers listed in section 3.2, such as Google Sign-In, YouTube and ip-api.com, may process the limited data they receive outside India, as the DPDP Act permits.

5. How long we keep it

Data	How long
Your account	Until you delete it. On deletion your name, email and mobile number are removed from the account straight away and you can no longer sign in.
Booking, payment and invoice records	As long as tax and accounting law requires (generally up to 8 years). This includes the participant names and booking contact details entered at the time, even after you delete your account.
Government ID numbers	Automatically erased after the trip ends, within the retention window we set (currently 30 days). The document type stays on the booking.
Parent / guardian consent records	As long as the booking record, because they show the processing was lawful.
Sign-in records (IP, device, approximate location)	12 months, then deleted automatically.
One-time codes and password-reset links	Deleted automatically once expired or used.
Organizer verification documents and bank details	While the organizer account is active, and afterwards only as long as needed for legal, tax or dispute purposes.
Reviews	Until you delete the review or your account. After account deletion a review shows as written by “Deleted User”.

6. How we protect it

All traffic is encrypted with HTTPS.
Passwords are stored only as BCrypt hashes.
Government ID numbers are encrypted at rest (AES-256-GCM), masked wherever they are shown, and each full-number download is logged.
Sign-in sessions use secure, HttpOnly cookies that page scripts cannot read.
Staff and organizer access is limited by role to what each person needs.

No system is perfectly secure. If a breach affects your personal data, we will tell you and the Data Protection Board of India as the DPDP Act requires. If you think your account has been compromised, contact us straight away.

7. Your rights

Under the DPDP Act you have the right to:

Access: get a summary of the personal data we hold about you and who we have shared it with.
Correction and completion: most details can be updated directly in Account settings.
Erasure: delete your account from Account settings. You can't delete it while you have an upcoming confirmed booking; cancel it first or wait until the trip is over.
Withdraw consent: you can withdraw at any time. It doesn't affect processing already done, and we may be unable to keep providing a service that depends on it.
Grievance redressal: complain to our Grievance Officer (section 12).
Nominate: name someone to exercise these rights for you in the event of your death or incapacity.

To use any of these rights, email [email protected] from the email address on your account. We reply within 30 days. If you are not satisfied with how we handle your grievance, you can complain to the Data Protection Board of India.

8. Children

You must be 18 or older to create an account. Children can join a booking as participants, but only with the verifiable consent of a parent or lawful guardian, as the DPDP Act requires. When a participant under 18 is added, the person booking must confirm they are that child's parent or lawful guardian. We record who gave consent, their relationship to the child, when and from which IP address, and the exact wording they agreed to. We don't use children's data for tracking, profiling or targeted advertising.

9. Cookies and browser storage

We use only what is needed for the site to work. There are no advertising or analytics cookies.

What	Purpose	How long
Sign-in cookies (HttpOnly)	Keep you signed in securely	Until you sign out or the session expires
k2s_user cookie	Lets pages know you are signed in and which area to show	Until you sign out
Booking draft (session storage)	Keeps a half-filled booking form if you reload; ID numbers are never saved	Until you close the tab
Saved travellers (local storage, this device only)	Lets you reuse names you have booked for before; ID numbers are never saved	Until you remove them or clear your browser data
Organizer dashboard drafts and scan log (local storage)	Keep unsaved listing drafts and recent check-ins on the organizer's device	Until cleared

Third-party content: the Google sign-in button (on sign-in pages), Razorpay checkout (when you pay) and embedded YouTube videos (on some activity pages) are loaded from those companies. They may set their own cookies under their own privacy policies. You can block or clear cookies in your browser settings, but blocking sign-in cookies will sign you out.

10. Organizer obligations

Organizers receive participants' personal data only to run the booked activity. As an organizer you must:

use participant data only to run the booked activity and meet its permit requirements;
not share it with anyone except the relevant permit authority, or anyone else without the participant's consent;
not use it for marketing, or contact participants about anything other than the booking;
delete any copies you keep outside the platform, such as downloaded manifests or permit lists, within 90 days after the activity ends;
keep any data you store reasonably secure, and have consent from each guide you list.

Breaking these rules breaches the Organizer Terms and may lead to account termination.

11. Changes to this policy

When we change this policy we update the date at the top. If a change materially affects how we use your data, we will email you before it takes effect and, where the law requires, ask for your consent again.

12. Contact and grievances

For privacy questions, requests or complaints, email [email protected]. This policy is governed by the laws of India, and disputes are subject to the courts of Karnataka.

Read this policy together with our Terms & Conditions and Refund & Cancellation Policy.