Privacy Policy

EdenRoute Travels is the data fiduciary / controller for the processing described here. We are a Micro enterprise registered as a travel agency in India (Udyam Registration No. UDYAM-WB-06-0072077), with a registered address at Godamdhura, Ging Tea Garden, Lebong, Sadar, Darjeeling, West Bengal – 734105, India.

Contact us about privacy at request@edenroutetravels.com. Our Grievance Officer under the DPDP Act is Nabin Pokhrel; how to raise a complaint and our response timelines are set out on the Grievance Redressal page. Where required, our EU representative (GDPR Article 27) will be named here once appointed.

• Account data — name, email, password (stored only as a hash), role.
• Booking data — stays booked, dates, guest counts, amounts, messages.
• Payment data — handled by your bank / UPI app and our payment partners; we receive confirmation and reference identifiers (such as a UPI transaction reference), never full card numbers or bank credentials.
• Host verification (KYC) — government identity document number and type, phone, email, and settlement bank details. This is sensitive data and is access- controlled and logged.
• Content — reviews, ratings, trip stories, photos you upload.
• Guests recorded by a host — when a host enters a stay that was booked with them directly (name, and optionally email and phone), we keep it on the host's behalf for their calendar and invoices. A review left through a review link is tied to that one booking and shows only the guest's first name.
• Train ticket bookings — passenger name, age, and gender for each traveller, and an identity-document type if the railway requires one for that booking. We do not store the document number itself — it is passed to our rail booking partner to issue the ticket and is not retained on our servers.
• Technical data — IP address and basic device/browser information in security and audit logs.
• Consent records — which version of these documents you accepted, and when.

• To provide the service (create your account, take bookings, process payments) — performance of a contract.
• Host verification and fraud prevention — legal obligation and legitimate interests.
• Security, audit logging, and abuse handling — legitimate interests.
• Service emails (verification, booking confirmations, KYC outcome) — contract / legitimate interests.
• Review requests after a stay — one email with a review link after you check out: for stays booked through EdenRoute, and for stays recorded by a host only when that host asked us to send it (in the host's name; replies go to the host) — legitimate interests (genuine reviews for travellers and hosts). We don't email you again about that stay; contact us to have a review removed.
• Improving the service and support — legitimate interests.
• Where we rely on consent (the optional Google Ads measurement cookies described in our Cookie Notice, or any future marketing), you can withdraw it at any time without affecting prior processing.

We share personal data only with service providers that help us run the Platform:

• Payment partners (RBI-regulated payment gateway and UPI banking channels) — payment processing and refunds.
• Resend — transactional email delivery.
• Render — application and database hosting.
• Vercel — website hosting and delivery.
• Google (Google Ads) — on our public pages, ad-measurement data about whether a visit from one of our ads led to a booking or a new account (never your name, email or phone number); advertising cookies only if you press Allow on our cookie banner (see the Cookie Notice).
• Our rail booking partner — receives passenger details for the train(s) you book, to issue and manage the ticket. The specific partner will be named here once integration goes live.

We also share data where required by law, to enforce our Terms, or to protect the rights and safety of users. We do not sell personal data.

Our providers may process data outside your country, including in the EU, the UK, and the United States. Where GDPR applies, such transfers are made under an adequacy decision or Standard Contractual Clauses with additional safeguards. The specific transfer mechanism for each provider is being finalised and will be listed here.

Account and content data: while your account is active and for a reasonable period after closure. Booking and payment records: retained as long as needed for tax, accounting, and dispute purposes. Audit and security logs: a limited retention period. KYC records: retained for the period required by applicable law after the Host relationship ends, then deleted or anonymised. Messages between a guest and a Host are tied to that booking and are automatically deleted from our servers two months after the stay's check-out date. A detailed retention schedule is being finalised.

Subject to the applicable law, you can ask us to:

• access a copy of your personal data;
• correct inaccurate or incomplete data;
• delete your data (“right to be forgotten” / erasure);
• receive your data in a portable format;
• restrict or object to certain processing;
• withdraw consent where processing is based on consent;
• nominate another person to exercise your rights (DPDP Act).

To exercise any of these, email request@edenroutetravels.com. We may need to verify your identity. Where you have transacted, some records (bookings, payments) are kept even after an erasure request, with your identifying details removed. You also have the right to complain to your data-protection authority — the Data Protection Board of India, or your local supervisory authority in the EU/UK.

Passwords are hashed. Access to KYC and other sensitive data is restricted by role and every access is written to an audit log. We use encryption in transit and apply administrative and technical safeguards appropriate to the risk. No system is perfectly secure; if a breach affects you we will notify you and the relevant authority as required by law.

The Platform is not intended for anyone under 18, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.

We will post updates here with a new version number and date and, for material changes, give advance notice by email or in-product.