Privacy Policy

Travellers

• Account details: name, email address, phone number, and a username or sign-in method.
• Bookings: the experience, date, number of guests, options, amount paid, and booking status. If you ask for a GST invoice, your GSTIN and business name.
• Payment confirmation from Razorpay (a payment ID and status). We never receive card numbers, UPI PINs or bank passwords.
• Messages you send to hosts or to us, and reviews and photos you post. Photos are re-encoded when uploaded, which removes location and camera data.
• “Notify me” requests for experiences that are coming soon.

Hosts, in addition: business name, address, GSTIN, tourism or activity licences, insurance details and their expiry dates, bank account and IFSC for payouts, and the listings, schedules and prices you publish.

Everyone: basic technical data needed to keep the service secure, such as IP address (used to limit repeated sign-in attempts and API abuse), browser type and error logs.

• To create and confirm bookings, take payment, issue refunds and pay hosts. The legal basis is your consent, given when you book, and the performance of the booking you asked for.
• To send booking confirmations, reminders, changes and cancellations by email and WhatsApp. These are service messages; we send marketing only if you opt in, and you can opt out at any time.
• To check that hosts are genuine and licensed, and to handle complaints, fraud and safety issues.
• To meet legal duties such as tax records, and to respond to lawful requests from authorities.
• To understand how the site is used and improve it, using aggregated data.

• The host of your booking gets your name, phone number, guest count, options and any notes, so they can run the experience. Hosts must use this only for your booking.
• Service providers that process data on our behalf: Supabase (database and sign-in), Vercel (hosting), Razorpay (payments and refunds), our email provider and our WhatsApp Business provider. They are bound by contracts to use it only for us.
• Referral partners such as hotels that sent you to us see only that a booking was made and its value, not your contact details.
• Authorities, when the law requires, for example forest departments for permit lists where an experience needs one, or in response to a valid legal order.

Some providers store data outside India. Where they do, we rely on their contractual safeguards and on the transfer rules of the DPDP Act.

• Essential cookies keep you signed in and protect forms. The site does not work without them.
• If you arrive through a partner's link, a cookie named eiq_ref remembers the partner for 30 days so they are credited for your booking.
• Your browser's local storage keeps preferences such as recent searches, saved places and language. This stays on your device.
• If we turn on analytics, we will list the tool here and use it to measure aggregate usage, not to build advertising profiles.

• Account data: while your account is open, and deleted or anonymised within 90 days after you close it.
• Booking, payment and invoice records: 8 years, because tax and accounting law requires it.
• Host verification documents: while the host is active, and up to 3 years after, for safety and complaints.
• Security logs: up to 180 days.

You can ask us to:

• tell you what personal data we hold about you and who we shared it with;
• correct or update it (most of it you can change yourself under Account);
• delete it, except records the law requires us to keep;
• withdraw consent for anything based on consent, such as marketing;
• nominate someone to act for you in case of death or incapacity.

Write to us using the details below. We respond within 30 days. If you are not satisfied, you can complain to the Data Protection Board of India.

Accounts are for adults. Children can join experiences booked by a parent or guardian; we collect only the guest count and any details the host needs for safety, given by the adult who books.

Data is encrypted in transit, stored with access controls, and only staff who need it can see it. If a breach affects your data, we will inform you and the Data Protection Board as the law requires.

• IQ Nexhaz Global LLP
• Contact form: explore.nexhaz.com/contact (we reply within 2 working days)

Privacy requests and complaints reach our Grievance Officer through the contact page.