# PRIVACY POLICY **PahariPath** Operated by: **Saksham**, a sole proprietorship trading as "PahariPath" ("**Company**", "**we**", "**us**", "**our**") Effective Date: **24-06-2026** | Last Updated: **24-06-2026** This Privacy Policy explains how the Company collects, uses, discloses, and safeguards personal data in connection with paharipath.in and related services (the "**Platform**"), in accordance with the **Digital Personal Data Protection Act, 2023** ("**DPDP Act**") and other applicable Indian law. By using the Platform, you consent to the practices described in this Policy. --- ## 1. Personal Data We Collect ### 1.1 Data you provide directly - **Booking data:** name, phone number, email address (optional), number of guests, check-in/check-out dates, guest photograph (optional, for E-Pass), pledge acceptances. - **Traveller Profile data:** name, phone number, city, activity history (bookings, eco offsets, pledges taken, PAHADI points and tier), profile photograph (optional). - **Host / partner application data:** name, property details, phone number, email address, login credentials, property photographs, identity/ownership verification documents. - **User-generated submissions:** Community Pin locations and descriptions, location correction reports, reviews, host feedback about guests, PAHADI task suggestions — together with any name or contact detail voluntarily included in such submissions. - **Support communications:** any information you provide when contacting support, including your name, contact details, and the content of your enquiry. - **Payment confirmation data:** payment status, amount, and transaction reference. **The Company does not collect, view, or store your card, UPI ID, or bank account details** — these are collected and processed exclusively by Razorpay. ### 1.2 Data collected automatically - Basic, aggregated, cookieless usage analytics via Plausible Analytics (page views, referrer, approximate location at country/region level). Plausible does not use cookies and does not track individual users across sessions. - Device/browser information necessary for the Platform to function (e.g., for map rendering and responsive layout). - Approximate location, only where you explicitly grant browser location permission (e.g., "Near Me" or "Use my location" features), used solely to compute distances to destinations during that session and not persisted on our servers beyond what you choose to save to your Traveller Profile. ### 1.3 Data we do **not** collect We do not knowingly collect biometric data, financial account credentials, precise real-time location tracking outside your explicit, session-specific use of location features, or any data from persons we know to be under 18 years of age. --- ## 2. Purpose and Legal Basis for Processing We process personal data for the following purposes, on the basis of your consent (obtained through use of the relevant feature) and/or as necessary for performance of a contract with you: (a) to create and confirm Bookings, and to share necessary booking details with the relevant Host solely for the purpose of fulfilling that Booking; (b) to operate the Traveller Profile, PAHADI Points, referral, and wishlist features; (c) to process host/partner applications and operate the host dashboard; (d) to respond to support enquiries and grievances; (e) to maintain, moderate, and improve Community Pins, reviews, and other user-generated content; (f) to send booking confirmations, transactional updates, and (where you have separately subscribed) newsletter content; (g) to detect and prevent fraud, abuse of the PAHADI Points/referral system, and violations of our Terms of Service; and (h) to comply with applicable legal, tax, and regulatory obligations. We do not process personal data for any purpose incompatible with the above without seeking fresh consent, except where otherwise permitted or required by law. --- ## 3. Disclosure of Personal Data We disclose personal data only as follows, and to no other party for commercial gain: | Recipient | What is shared | Why | |---|---|---| | **The Host you book with** | Name, phone number, booking dates, guest count | To enable the Host to fulfil your Booking | | **Razorpay** (payment aggregator) | Payment amount and your contact details as required for payment processing | Payment processing, governed by Razorpay's own privacy policy | | **Supabase** (database/infrastructure provider) | All platform data, as our data processor | Hosting and operating the Platform's backend | | **Vercel** (hosting provider) | Standard web request logs | Serving the Platform | | **Plausible Analytics** | Aggregated, cookieless usage data | Understanding aggregate site usage | | **Law enforcement / regulators** | As legally compelled | Compliance with a valid legal order, court process, or governmental request | We do not sell personal data. We do not share personal data with advertisers, data brokers, or any third party for their independent marketing purposes. --- ## 4. Cookies The Platform uses only strictly necessary, functional cookies (e.g., to remember your cookie-consent choice). We do not use third-party advertising or cross-site tracking cookies. Plausible Analytics operates without cookies. --- ## 5. Data Retention We retain personal data only for as long as reasonably necessary for the purposes described in Clause 2, or as required to: (a) resolve disputes between Users, Hosts, and the Company; (b) maintain accurate PAHADI Points and booking history for the duration your account remains active; (c) comply with applicable tax, accounting, and legal record-keeping obligations (typically up to eight (8) years for financial records under Indian law); or (d) enforce our Terms of Service. Upon a valid deletion request under Clause 8, we will delete or irreversibly anonymise personal data except where retention is required by law or necessary to establish, exercise, or defend a legal claim. --- ## 6. Data Security We implement reasonable technical and organisational measures to protect personal data, including encrypted transmission (HTTPS/TLS), access controls on our database, and restricted administrative access. **No method of electronic transmission or storage is completely secure, and the Company does not warrant or guarantee absolute security of any data transmitted to or stored on the Platform.** In the event of a personal data breach that the Company reasonably determines is likely to result in significant harm to affected Users, the Company will notify affected Users and the Data Protection Board of India, as required under the DPDP Act, within the timeframe prescribed by applicable law. --- ## 7. Cross-Border Data Storage Our infrastructure providers (including Supabase and Vercel) may store or process data on servers located outside India, in accordance with their respective hosting regions. By using the Platform, you acknowledge and consent to such processing, which is undertaken subject to those providers' own security and compliance obligations, and only to the extent consistent with any restrictions the Central Government may notify under the DPDP Act from time to time. --- ## 8. Your Rights Under the DPDP Act Subject to applicable exceptions and verification of your identity, you have the right to: (a) obtain a summary of the personal data we hold about you and the processing activities undertaken; (b) request correction, completion, or updating of your personal data; (c) request erasure of your personal data, unless retention is necessary for a purpose described in Clause 5; (d) withdraw consent at any time, without affecting the lawfulness of processing carried out before such withdrawal (noting that withdrawal of consent for essential processing, such as booking data, may mean we can no longer provide the associated service to you); (e) nominate another individual to exercise these rights on your behalf in the event of death or incapacity; and (f) file a complaint with the Data Protection Board of India, if established and applicable, after first raising the grievance with us. To exercise these rights, contact us using the details in Clause 12. We will respond within the timeframe required under applicable law. We reserve the right to charge a reasonable fee or decline manifestly unfounded or excessive requests, to the extent permitted by law. --- ## 9. Children's Data The Platform is not directed at, and must not be used by, individuals under the age of 18. We do not knowingly collect personal data relating to children. If we become aware that we have inadvertently collected personal data from a person under 18, we will take reasonable steps to delete such data promptly. Parents or guardians who believe their child has provided us data should contact us immediately using the details in Clause 12. --- ## 10. Third-Party Links and Services The Platform may contain links to, or integrate with, third-party services (including Google Maps, OpenStreetMap, WhatsApp, YouTube embeds, and Razorpay). This Policy does not apply to, and the Company is not responsible for, the privacy practices of such third parties. You are encouraged to review the privacy policies of any third-party service before providing personal data to it. --- ## 11. Changes to this Policy We may update this Policy from time to time to reflect changes in our practices or applicable law. Material changes will be indicated by updating the "Last Updated" date above, and, where required by law, by additional notice. Continued use of the Platform after such changes constitutes your acknowledgment of the updated Policy. --- ## 12. Grievance Officer and Contact In accordance with the DPDP Act and applicable Indian law, data-related grievances may be directed to: **Grievance Officer:** Saksham **Email:** hello@paharipath.in **Address:** Near GSSS Ward No. 6, Nadaun, Distt. Hamirpur, Himachal Pradesh, India - 177033 We aim to acknowledge grievances within a reasonable time and resolve them as expeditiously as possible, consistent with applicable law. ---