Privacy & data
What we collect, who else sees it, and how to get it back or deleted.
Last updated
MaladTrip is not yet trading. This document is published in draft while the company is being incorporated, and the registered entity and grievance officer named below will be completed before any booking is taken.
1. Who is responsible for your data
Under India’s Digital Personal Data Protection Act 2023, MaladTrip is the Data Fiduciary for the personal data described here — meaning we decide what is collected and why, and we answer for it.
We have not yet appointed a grievance officer. The Act requires one, and their name and address will be published here before MaladTrip takes its first booking. Until then, data questions go to privacy@maladtrip.in.
2. What we collect
When you make an account, we store your name, email address and phone number.
When you book, we store what you booked, the dates, the number of guests, what you paid and the payment reference. We do not store your card or UPI details at any point — those go straight to Razorpay.
If you host or guide, we also store your payout details and any verification documents you send us. Bank account and UPI details are encrypted before they are written to the database, so they cannot be read out of it — not by an attacker and not by us.
Optionally: a profile photo, the languages you prefer, and the interests you pick for recommendations. You can leave all of those blank.
3. Why we use it
To take and confirm your bookings, to let a host know who is arriving, to pay providers, to send you receipts, to show reviews, to answer support requests, and to meet tax and accounting obligations.
We do not sell your data. We do not send marketing email unless you ask us to, and you can stop it in one click.
4. Who else sees it
The host or guide you book with sees your name, your phone number and your booking details, because they need to reach you and let you in.
These companies process data on our behalf:
| Company | What for | What they get |
|---|---|---|
| Supabase | Runs sign-in and hosts the database everything is stored in. | Your name, email address, phone number and everything else in your account. |
| Razorpay | Takes the payment when you book. | Your card or UPI details, which go to Razorpay directly — they never reach MaladTrip. |
| Twilio | Sends booking confirmations by SMS. | Your phone number and the text of the message. |
| SendGrid | Sends booking emails and receipts. | Your email address and the contents of the email. |
| Cloudinary | Stores and serves photographs. | Photos you upload, including guide verification documents. |
| Anthropic | Generates a suggested itinerary when you use the trip planner. | The trip details you type into the planner. Not your name, contact details or bookings. |
| Google Maps | Shows where a listing is. | Loading a map tells Google you viewed that page. |
Some of these are outside India, so your data may be processed abroad. We otherwise share data only where the law requires it.
5. How long we keep it
| What | How long | Why |
|---|---|---|
| Your account | Until you delete it. | Deleting it removes your profile, saved trips and cart. |
| Bookings and receipts | Eight years after the booking. | Indian tax and company law require records of transactions to be kept, so these survive account deletion. They are unlinked from your profile where they can be. |
| Reviews you wrote | Indefinitely, shown without your name once your account is deleted. | Removing them would misrepresent a host’s rating to everyone who reads it afterwards. |
| Payout and bank details | While you are a host or guide, plus eight years. | Same tax rules. Stored encrypted; MaladTrip staff cannot read them. |
6. Your rights
Under the DPDP Act you can ask us to:
- tell you what data we hold about you and who we have shared it with;
- correct anything wrong or out of date;
- delete your data, subject to the records we are required to keep;
- withdraw consent you previously gave, as easily as you gave it;
- nominate someone to exercise these rights if you die or become incapacitated.
Corrections you can make yourself from your account settings. For deletion, see the next section. For anything else, write to privacy@maladtrip.in.
If we do not resolve a complaint to your satisfaction, you can escalate it to the Data Protection Board of India.
7. Deleting your data
You can ask us to delete your MaladTrip account and the personal data we hold about you at any time, whether you signed up with an email address, with Google or with Facebook.
- Email privacy@maladtrip.in from the address on your account, with the subject line “Delete my account”. If you signed in with Facebook or Google, say so and include the name shown on your MaladTrip account.
- We confirm the request by replying to the same address, so that nobody else can delete your account by asking.
- Within 30 days we delete your profile, your saved trips and wishlists, and any data we received from Facebook or Google when you signed in, and we tell you when it is done.
Booking and payment records are kept for the period the law requires (see section 5) with your name removed from anything that is not needed to keep them. If you signed in with Facebook, you can also remove MaladTrip from Settings → Apps and websites in your Facebook account, which stops Facebook sharing anything further with us; it does not delete what we already hold, which is what the steps above are for.
8. How it is protected
Traffic is encrypted in transit. Bank and payout details are encrypted before storage. Access to the database is restricted, and administrative actions — approving a listing, changing a role, resolving a dispute — are written to an audit log.
No system is perfectly secure. If a breach affects you, we will tell you and the Data Protection Board, as the Act requires.
9. Cookies
We use cookies to keep you signed in and to remember your cart. There are no advertising or tracking cookies on this site. Loading a Google map on a listing page tells Google you viewed it.
10. Children
MaladTrip is not intended for children under 18, and we do not knowingly collect their data. A parent booking for a family does not need to give us a child’s details beyond the number of guests.
11. Changes
If we change how we use your data, we will update this page and tell you by email before the change takes effect.