Privacy Policy

This policy covers the Ghumooz traveler portal, the organizer studio, and our mobile apps. It explains what we do with personal data as the entity that decides why and how it is processed.

A trip organizer also handles your data in order to run your trip. For that use, they make their own decisions and are responsible for them; we require them by contract to use traveler data only to operate the trip.

Account details — your name, email address and password (stored only as a cryptographic hash; we cannot read it), and for organizers, business details.

Booking details — the trips you book, the travelers on the booking, and the passenger details a trip requires.

Government ID documents — where a trip requires identity verification. See Identity documents below, which describes this separately because it deserves separate treatment.

Payment records — the amount, status, and gateway reference for each payment. We do not receive or store your full card number. Card details go directly to our payment gateway.

Content you create — reviews, trip photos, chat messages, and support tickets.

Location data — only where you or your organizer turn on a live trip feature that needs it, such as convoy tracking during a departure or a tracker link you choose to share with family. It is tied to an active trip, not collected in the background.

Technical data — IP address, device and browser information, and logs of requests to our servers. We use these to keep accounts secure (detecting sign-in attacks and session theft) and to diagnose faults.

• To run your bookings — taking payment, holding it until settlement, passing the details the organizer needs to actually take you on the trip, and handling cancellations and refunds.
• To keep accounts and payments secure — rate limiting, lockouts after repeated failed sign-ins, detecting reuse of a stolen session, and fraud checks.
• To meet legal obligations — tax and financial records, and identity checks where they are required.
• To support you — answering tickets and investigating what went wrong on a trip.
• To improve the product — understanding which trips people look for, in aggregate.

Where a trip requires verification, you upload a government-issued ID. We treat these more carefully than anything else we hold:

• They are stored in encrypted object storage and are never served from a public URL. Access is granted through short-lived, single-purpose links.
• An automated step reads the document to pre-fill the verification form. A human reviewer — platform staff, or the organizer running your trip — confirms the result.
• They are visible only to the organizer running the trip you booked and to authorised platform staff. Every staff access is written to an append-only audit log.
• They are deleted 30 days after your trip is completed, unless we are required to keep them longer — for example while a dispute, a claim or a lawful request is open.

The organizer of a trip you book — the traveler details they need to run it. They may not use it for anything else.

Other travelers on your trip — only what you choose to share. Group chat shows your name to the group. Optional social features such as room matching only show what you explicitly opt in to, and can be turned off.

Reviews are public. We publish a shortened form of your name — your first name and last initial — never your full name.

Service providers — our payment gateways (Razorpay or Cashfree), cloud hosting and storage, email and messaging delivery, and error monitoring. They act on our instructions.

Authorities — where we are legally required to disclose, or to establish or defend legal claims.

We do not sell personal data.

We use a small number of cookies, and no third-party advertising or analytics trackers.

Strictly necessary — these keep you signed in and keep the site secure. They cannot be turned off without breaking sign-in, and do not require consent.

• access_token, refresh_token — your signed-in session. Not readable by scripts in your browser.
• sid — identifies the encryption session used to protect data in transit between your browser and our servers.

Optional — attribution

• ghumooz_ref — set for 30 days when you arrive through an organizer's own share link, so that a booking can be credited to the organizer whose link brought you. It records which organizer referred you and nothing else, and it is not used for advertising or shared with anyone. We ask before setting this one, and you can decline without any loss of functionality.

You can change your choice at any time from the cookie preferences link in the footer, and you can clear cookies in your browser settings.

Account data is kept while your account is open. Booking, payment and settlement records are kept for eight financial years after the transaction, as section 128(5) of the Companies Act 2013 requires for books of account.

Identity documents are deleted after the trip and any required retention window, as described above. Security logs are kept for a limited period for investigation. Reviews stay published unless removed.

Financial ledger and audit records are append-only by design and cannot be edited or erased; corrections are made by adding reversing entries. This is what makes the money trail trustworthy, and it means erasure requests cannot extend to them where we are legally required to keep the record.

You can:

• ask for a copy of the personal data we hold about you;
• ask us to correct it if it is wrong — much of it you can edit yourself in your account;
• ask us to delete it, subject to records we are legally required to keep (see How long we keep it);
• withdraw consent where we relied on it, such as the attribution cookie or optional features;
• nominate someone to exercise these rights on your behalf if you are unable to; and
• complain to us, and then to the Data Protection Board of India if you are not satisfied.

Write to privacy@ghumooz.com. We will respond within the period required by law. We may need to verify your identity first — which, and we recognise the irony, is to stop someone else getting your data by asking for it.

Passwords are hashed with a memory-hard algorithm and are never stored in a readable form. Sessions use short-lived tokens that rotate, and a session token presented from an unexpected device invalidates the whole session family rather than being honoured. Sensitive fields are encrypted at rest, and request bodies are encrypted in transit beyond standard HTTPS.

Staff access to traveler data is limited by role and written to an append-only audit log. Support staff acting on your behalf work in a read-only mode that cannot move money.

No system is perfectly secure. If a breach occurs that affects you, we will notify you and the authorities as the law requires.

Accounts are for adults. Children can travel on a booking made by a responsible adult, whose responsibility it is to provide the child's details. We do not knowingly create accounts for children, and will delete one if we find it.

Questions about this policy, or about your data: privacy@ghumooz.com. Formal complaints: manish@ghumooz.com, addressed to Manish Tondwal, Head of Trust & Safety. We acknowledge within 48 hours and resolve within one month of receipt; the office is staffed Monday to Friday, 09:00-18:00 IST.

By post: Ghumooz Private Limited, A-4 Tirupati Vihar, Patrakar Colony Road, Golyawas, Mansarovar, Jaipur, Rajasthan 302020.

If we change this policy in a way that materially affects you, we will tell you before it takes effect rather than quietly changing the date at the top.