Privacy Policy

Home / Policies / Privacy

Last updated: 13 August 2026

This Privacy Policy explains how Mumbai Trekizens ("we", "our" or "us") collects, uses, stores and protects your personal data when you use mumbaitrekizens.in, book a trek, or create a user account. We handle personal data in line with India's Digital Personal Data Protection Act, 2023 (DPDP Act).

1. Information We Collect

  • Account & profile data (optional): if you create an account — full name, email, mobile number, and (only if you choose to add them) profile photo, date of birth, city, short bio.
  • Safety & health data: emergency contact name & number, and (optional) blood group. We collect these only to keep you safe on treks. This is treated as sensitive data and is never shown publicly.
  • Booking data: name, email, phone, participant details, food preference, pick-up point, and any government photo-ID checked at the base village for safety/permits.
  • Payment data: processed by our payment gateway (Razorpay). We do not store card details on our servers.
  • Trek history: your completed treks, certificates, badges, statistics and (if you opt in) reviews and travel portfolio.
  • Website usage: cookies, IP address, device information, pages visited, referring URL.
  • Communications: emails and WhatsApp messages for booking and customer service.

2. How We Use It

  • To create and manage your account and profile
  • To confirm bookings and communicate trek details
  • To keep you safe on treks (emergency contact, health information, ID/permit checks)
  • To issue trek certificates, badges and build your travel portfolio
  • To send transactional emails (account, booking, reminders, invoices)
  • To send trek updates and offers only if you have opted in
  • To improve our website and service quality

3. Consent & Legal Basis

We process your data based on the consent you give when you create an account or make a booking, and to fulfil the service you request. Where you provide sensitive data (such as blood group or emergency contact), you consent to us using it for trek safety. You can withdraw consent for optional processing (like marketing) at any time.

4. Sharing of Information

We share limited personal data only with:

  • Payment processor (Razorpay) to enable payments
  • On-ground partners (transport, homestays, permits) — name and count only, for the specific trek
  • Our infrastructure providers (Supabase for the database, Cloudflare for hosting, Resend for email) purely to run the service
  • Government authorities when required by law (forest permits, ID verification)

We do not sell your data to third parties for marketing.

5. How We Store & Secure Your Data

Your data is stored in a secured cloud database (Supabase) with encryption in transit (HTTPS) and row-level access controls, so each account can only access its own data. Your private fields — emergency contact, blood group, date of birth, payment and booking details — are never exposed on any public page. No system is 100% secure, but we follow industry-standard practices and review our security regularly.

6. Public Profile & Travel Portfolio

Your account and portfolio are private by default. If you choose to make your travel portfolio public, only non-sensitive information is shown — your name, photo, bio, completed treks, badges, certificates and statistics. We will never show your email, mobile number, emergency contact, blood group, payment information or booking amounts on a public page. You can switch your portfolio back to private at any time.

7. Data Retention

We keep personal data only as long as needed — for the life of your account, and for legal/accounting purposes (typically up to 7 years for financial records) after that. You can ask us to delete your account and personal data at any time (see below).

8. Your Rights (DPDP)

  • Access — request a copy of the data we hold about you
  • Correction — fix inaccurate information (most of this you can edit yourself in your profile)
  • Erasure — request deletion of your account and personal data
  • Withdraw consent — opt out of marketing at any time (unsubscribe link in every email)
  • Grievance — raise any concern about how your data is handled

To exercise any of these, write to our Grievance Officer at mumbaitrekizens@gmail.com. You can also delete your account yourself from your account settings once accounts are live.

9. Cookies

We use essential cookies to keep you logged in and your session active, and analytics cookies (Google Analytics) to understand website usage. You can disable non-essential cookies from your browser settings.

10. Children

Accounts and our services are directed at users aged 18 and above. Minors may join a trek only under a booking made by a parent or guardian, whose consent covers the minor's data.

11. Changes

We may update this Privacy Policy from time to time. Material changes will be notified to registered users by email and/or a notice on the site.

12. Grievance Officer & Contact

Grievance Officer: Mumbai Trekizens, Sector 20, Kamothe, Navi Mumbai, Maharashtra 410209. For any privacy-related request or complaint, write to mumbaitrekizens@gmail.com.