PRIVACY
POLICY

Data you provide directly

• Full name — provided during booking, used to confirm reservations with operators
• WhatsApp / phone number — used to send booking confirmations and for operator coordination
• Email address — collected via Google Sign-In, used for account identification and support
• Booking details — activity chosen, date, number of people, session preference
• Payment information — processed entirely by Razorpay. We never see or store your card, UPI, or bank details. Only a Razorpay transaction reference ID is stored on our end.
• Reviews and ratings — star ratings, tags, and optional comments you submit after a completed trip

Data collected automatically via Google Sign-In

• Google display name and profile photo (if available)
• Google account email address
• Firebase Authentication UID (an internal identifier — not your Google ID)

Data we do NOT collect

We use your data only for purposes directly related to providing the EscapeBuddy service. We collect only what is necessary — nothing more.

Core purposes

• Processing your booking — your name, contact, date and activity details are used to create and confirm your reservation
• Operator coordination — your name and WhatsApp number are shared with the operator after your Stage 1 payment is confirmed, so they can contact you with trip-specific details
• Payment processing — booking amounts and reference IDs are used to track staged payments (30% advance + 70% balance)
• Customer support — your contact details allow us to respond to queries, resolve payment issues, and assist with cancellations
• Booking history — your past bookings are shown in the "My Trips" section of the app
• Reviews — your submitted ratings and tags are stored for platform quality improvement and future operator ranking

What we never do with your data

• We do not sell your data to any third party
• We do not use your data for targeted advertising
• We do not share your data with operators before payment is confirmed
• We do not profile you for purposes unrelated to adventure bookings
• We do not send marketing messages without your explicit consent

Adventure operators

After your Stage 1 payment (30%) is confirmed, we share your name and WhatsApp number with the operator you have booked with. This is the minimum information required for the operator to contact you and prepare for your trip. Operators on our platform have agreed to our Operator Terms and are prohibited from using your contact details for any purpose other than fulfilling your booked activity.

Service providers

We use the following service providers who may process your data on our behalf as part of delivering EscapeBuddy:

• Firebase / Google — authentication, database (Firestore), and cloud storage infrastructure
• Razorpay — payment processing. All payment data is governed by Razorpay's own PCI-DSS compliant infrastructure. We never receive raw card or UPI credentials.
• Cloudinary — activity and operator photo hosting

Legal requirements

We may disclose your data if required to do so by law, court order, or a lawful request from a government authority in India, including under the IT Act 2000 or any applicable regulation.

The following third-party services are integrated into EscapeBuddy. Each has its own privacy policy governing how they handle data. We recommend reviewing them:

These services operate under their own terms. EscapeBuddy is not responsible for the privacy practices of these external services beyond our contractual agreements with them.

We retain your data only for as long as it is needed for the purposes described in this policy, or as required by applicable law.

Retention periods

• Booking data (name, contact, dates, payment references) — retained for a minimum of 1 year from the date of the booking, as required under the DPDP Rules 2025, and up to 3 years for dispute resolution purposes
• Payment logs — retained for 3 years for financial record-keeping and Razorpay reconciliation
• Review data — retained indefinitely as anonymous platform data, linked to user account until account deletion
• Account data — retained while your account is active. Upon account deletion request, personal identifiers are erased within 30 days, subject to the above booking data retention requirements

Under India's Digital Personal Data Protection Act, 2023 (DPDP Act) and DPDP Rules, 2025, you have the following rights as a Data Principal:

To exercise any of these rights, contact us at escapebuddy2@gmail.com with the subject line "Data Rights Request". We will respond within a reasonable time, typically within 30 days.

Data Protection Board of India

If you are not satisfied with our response, you have the right to file a complaint with the Data Protection Board of India once its complaint filing mechanism is operational (expected mid-2027 under Phase III of the DPDP Act implementation). Until then, unresolved grievances may be escalated to MeitY or through the consumer courts under the Consumer Protection Act, 2019.

You can request deletion of your EscapeBuddy account and associated personal data at any time. Here's how:

Method 1 — WhatsApp (fastest)

Send us a WhatsApp message at +91 97499 54019 with the message: "Delete my EscapeBuddy account — [your registered email]". We will process your request within 7 business days.

Method 2 — Email

Send an email to escapebuddy2@gmail.com with subject: "Account Deletion Request" and your registered Google email address. We will process your request within 7 business days.

EscapeBuddy is an adventure booking platform intended exclusively for users who are 18 years of age or older. All adventure activities listed on our platform require participants to be adults.

• We do not knowingly collect personal data from individuals under the age of 18
• If you are a parent or guardian and believe your child has registered on EscapeBuddy, contact us immediately at escapebuddy2@gmail.com
• We will delete any data belonging to a minor promptly upon verified notification
• Minors participating in activities booked by an adult guardian do so under the full responsibility of that adult

In accordance with DPDP Rules 2025, any inadvertent collection of data from a person below 18 years will be treated as a privacy incident and addressed immediately.

We take the security of your data seriously and implement reasonable technical and organisational measures to protect it:

• Firebase Firestore — your data is stored on Google's infrastructure with encryption at rest and in transit, access logging, and automated backups
• Razorpay PCI-DSS — all payment processing meets Payment Card Industry Data Security Standards. EscapeBuddy never receives or stores your raw payment credentials
• Firebase Authentication — user sessions are managed via secure tokens. Passwords are never stored on our servers (we use Google Sign-In)
• Access controls — Firestore security rules restrict data access to authenticated users who own that data only
• No third-party analytics — we use Google Analytics on our website (escapebuddy.in) but do not track individual user behaviour inside the app beyond what is necessary for booking functionality

We may update this Privacy Policy from time to time as our platform evolves, as Indian data protection law develops (particularly the DPDP Act's full rollout by May 2027), or as we add new features.

• The "Last Updated" date at the top of this page will always reflect when the most recent changes were made
• For significant changes (such as new types of data collection or new third-party sharing), we will notify you via an in-app notification or banner before the changes take effect
• Continued use of EscapeBuddy after a policy update constitutes acceptance of the updated terms
• This policy is always accessible at escapebuddy.in/privacy-policy

We recommend reviewing this policy periodically. We will never make retroactive changes that reduce your existing privacy rights without explicit consent.

For any questions, data rights requests, or concerns about this Privacy Policy, reach us through any of the following channels:

Grievance Resolution Process

• Step 1 — Contact us via email or WhatsApp with your concern
• Step 2 — We will acknowledge your grievance within 48 hours
• Step 3 — We will resolve or provide a detailed response within 30 days
• Step 4 — If unresolved, you may escalate to the Data Protection Board of India (once operational, expected mid-2027) or approach consumer courts under the Consumer Protection Act, 2019