1. Who we are and what this policy covers
Radikal is operated by Radikal Ventures Private Limited, Himachal Pradesh, India. We are responsible for the personal information we process to operate our website, accounts, trip bookings, custom-trip requests, guide applications and support services.
This policy explains the information we collect, its purposes, who receives it, how it is protected and retained, and your choices. It applies to travellers, prospective customers, guides, applicants and website visitors, including visitors outside India. A third-party service you choose to use may also have its own privacy policy.
2. The information we collect
We receive information you provide through forms, your account, uploads and conversations; information generated when you use the service; and limited information from services you choose, such as Google sign-in. The categories depend on the features you use.
Guest custom-trip and guide-application submissions create an account using the account details you supply; they are not anonymous enquiries. Photos supplied through Google sign-in may be stored as an external avatar URL and fetched for display.
Forms identify required fields for the requested feature. An account needs an email and a supported sign-in method; a booking or application needs the relevant contact and arrangement details. Optional profile information and additional requests are your choice. Without necessary information, we may be unable to create the account, respond to the enquiry or administer the booking; declining optional details does not by itself prevent those services.
Only provide another person's information if you have an appropriate lawful basis or their permission. Tell them about this policy. Avoid putting identity documents, medical records, bank passwords, card security codes, banking one-time passwords or UPI PINs in free-text fields, chats or public uploads.
- Account and contact information: name, email, optional or feature-required phone number, username, profile photo, account preferences and authentication records. Passwords are stored as hashes, not plaintext. If you choose Google sign-in, we receive the identity/profile information needed to authenticate you, such as your email, name and photo.
- Booking and enquiry information: trip and date selections, group size, add-ons, prices, booking/payment status, bank-transfer references, requests and information you voluntarily include when planning a trip. Optional requests can include dietary, medical or accessibility needs; provide only what is necessary for the arrangement. We may need refund destination details to arrange a refund. Current checkout uses bank transfers and reference confirmation; it does not require your bank login or UPI PIN.
- Guide information: application details, location, experience, interests, languages, biography, qualifications you provide, website/social links and uploaded media. Guides can also provide payout account details, IFSC, UPI details, payout preference and a cash note.
- Content and communications: support/custom-trip messages, reviews, uploaded photos/videos, enquiries, service emails, notifications and operational records, including team notes and audit records about bookings or requests.
- Technical and usage information: IP-related information, approximate location supplied by the hosting infrastructure where available, browser/device information, request times, pages and interactions, error reports, security events and performance measurements.
- Referral and attribution information: referral identifiers, signup method, campaign/source parameters and landing path, and whether an attributed account subsequently books. These are marketing/operational records, not proof of a person's identity or trustworthiness.
3. How and why we use information
We use personal information for the purposes connected to the feature or relationship through which it was collected. Providing information for a booking does not give us unlimited permission to use it for unrelated purposes.
- Create and secure accounts; authenticate sign-ins; manage profiles, preferences and password recovery.
- Plan and administer trips, courses and retreats; process enquiries, reservations, payment confirmation, cancellations, refunds and guide payouts.
- Review guide applications, operate public guide/trip pages and support collaboration between the team and guides.
- Answer messages and send relevant operational communications, such as booking updates, account-security notices and unread-reply digests.
- Prevent misuse and fraud, enforce permissions, maintain audit records, troubleshoot errors and improve site usability and performance.
- Understand referral/campaign effectiveness and service usage; comply with applicable tax, accounting, legal and regulatory obligations; and handle disputes or lawful requests.
4. Our approach to lawful processing
Indian requirements relevant to this policy include the Information Technology Act, 2000 and rules made under it, and the Digital Personal Data Protection Act, 2023 and rules made under it, to the extent they apply and have come into force. Different obligations can take effect at different times; the DPDP framework has phased implementation.
Where consent is required, it should be specific to the relevant purpose and can be withdrawn. Other processing may be permitted or required by applicable law, including specified uses of information voluntarily provided for a requested service, compliance with legal obligations, or responding to an emergency. Where another jurisdiction's law applies, relevant grounds may include taking steps you request before a contract, performing the service contract, consent, legal obligations or legitimate interests subject to the safeguards that law requires.
Some operational processes are automated, such as search ordering, availability calculations, abuse prevention and configured guide-application approval. Contact us if you believe an automated result is incorrect and want it reviewed.
Legal context: the Government of India overview of the DPDP framework and phased implementation and European Commission information on individual rights.
6. Public profiles, reviews, media and calendar sharing
Guide profiles, published trips and public reviews are intended to be visible to other people. Reviews can display the author's name, rating, comment and date. Public pages may also be indexed by search engines and included in our sitemap or public trip feed. Uploaded profile, guide and trip media can be served from publicly accessible storage URLs, including application media before a guide profile is published; an unlisted URL is not an access-control guarantee.
Do not upload information you want to keep confidential. Original media may retain embedded metadata, including location, so remove unwanted metadata before uploading. Copies made by search engines, recipients or other websites may remain after we remove our own copy; we cannot guarantee their deletion.
Calendar exports and subscription links are for the authorised viewer, but events can contain booking references, traveller names and party sizes. Treat a subscription link like a password. Reset it if shared accidentally. Exporting, forwarding, or adding events to Google Calendar discloses those event details to the recipient or calendar service you choose.
8. Analytics, diagnostics and approximate location
We use site analytics and performance/error monitoring to understand usage, identify broken flows and improve loading and reliability. Monitoring can process page/request information, browser/device details, timing and error context. We apply filtering and redaction to reduce unnecessary account, private-route and query information in diagnostics; no filtering system is a guarantee that every event is free of personal information.
The current application does not enable Sentry session replay. IP-derived country, region, city, coordinates or timezone supplied by the hosting infrastructure may be used in security/audit records; country can suggest a currency. These are approximate network-derived signals, not continuous tracking of your device's precise GPS location. We do not request browser geolocation permission.
9. Processing outside India
Radikal is an Indian company, but hosting, storage, email and monitoring providers can process information in India and other countries. The applicable region depends on provider configuration and the service used; this policy does not promise that all data stays in India.
International processing is subject to applicable Indian transfer restrictions and any additional protections required by a law that applies to the processing. Contact us if you need information about the relevant provider, processing location or transfer safeguards.
10. Retention and deletion
Retention depends on the type of information, the purpose for which it is held, the status of a booking or account, legal/accounting requirements, security needs and disputes. A reservation expiring or a cookie expiring does not mean the underlying booking, attribution or audit record is erased.
Account deactivation and soft deletion are not the same as permanent erasure. Booking/payment records, guide payout-change audits, support records, reverted-reply archives and other necessary history can remain after an account, trip or request is removed from ordinary views. Some audit records also restrict permanent account deletion. Completed or failed email jobs can retain their delivery information and contents; there is no universal automatic purge deadline represented by this policy.
We assess deletion requests against applicable retention requirements and other people's rights. Where information must be retained, we limit its use to the relevant retention purpose. Removal from active systems may not immediately remove backups, caches or copies controlled by others. Ask us about the retention basis for a particular record rather than assuming every category has the same duration.
11. How we protect information
Our safeguards include hashed passwords, server-side permission checks, validation and rate limiting, scoped data reads, upload checks, security/audit records and additional verification for sensitive changes. Access to information such as guide payout details is restricted and audited.
No internet service can guarantee absolute security. Keep your password private, secure your email account, and do not share account or calendar-feed credentials. If you suspect unauthorised access or a data incident, contact us promptly. We assess incidents, take steps to contain and remediate them, and notify affected people and relevant authorities where applicable law requires.
12. Your choices and privacy rights
You can update information through your profile where the feature is available and contact us for other privacy requests. Where applicable law provides these rights, you may request information about processing and sharing, access to your information, correction or completion, erasure, withdrawal of consent, grievance redressal, and nomination of another person to exercise rights following death or incapacity, subject to the applicable conditions.
If laws such as the GDPR apply to your situation, additional rights may include restriction, objection, data portability and a complaint to the competent supervisory authority, subject to their conditions. These rights are not unconditional and are not a statement that every jurisdiction's law applies to every visitor.
Withdrawing consent does not undo processing already lawfully carried out or remove information that must lawfully be retained. If you decline information necessary for a requested service or withdraw the relevant consent, we may be unable to continue that feature or booking. We will explain the consequence relevant to your request. Optional marketing consent, where sought, is separate from necessary operational communications.
To withdraw consent or object to optional processing, contact our published privacy channel and identify the purpose involved. You can also use the relevant account or browser controls where available. We will assess the request and stop consent-based processing where required, unless continued processing is authorised or required by applicable law.
13. Contact, requests and grievances
Send privacy requests to contact@radikal.in with the subject 'Privacy request', and privacy complaints or grievances to grievance@radikal.in with the subject 'Privacy grievance'. These are our published contact channels for Radikal Ventures Private Limited, Himachal Pradesh, India. Describe the information or issue involved and the outcome you are seeking.
Where possible, write from the email linked to your account. We may request proportionate verification before disclosing or changing information; do not send passwords, banking OTPs or identity-document scans unless an appropriate secure process is specifically agreed. Requests made for another person may require evidence of authority.
We will review your request, explain any necessary verification, and respond within the period required by applicable law. If a request cannot be fulfilled fully, we will explain the applicable reason and available next steps. If a grievance remains unresolved, you may seek redress from the relevant competent authority where the applicable law provides it, including the Data Protection Board of India when its relevant complaint mechanism applies. Use any required internal grievance process first.
14. Children and information about minors
Radikal accounts and guide applications are intended for adults aged 18 or over. This does not mean the website currently verifies every visitor's age or that every trip is suitable for children.
A parent or lawful guardian should handle enquiries or bookings involving a child and share only information necessary for that arrangement. Do not create an independent account for a child. Where applicable law requires verifiable parental consent or other safeguards before processing a child's information, those requirements must be met; this policy is not a substitute for that process.
If you believe a child has supplied personal information without appropriate permission, contact us so we can review, restrict or remove it as appropriate. Our service is not designed to solicit information directly from children or provide behavioural advertising to them.
15. External websites and services you choose
Links to WhatsApp, Instagram, Google services, a guide's website or another external service take you to a separately operated service. Its privacy terms apply to the information it collects. Bank/UPI apps you use to make a transfer also operate separately from Radikal.
Read those services' policies before sharing information. Contact us if you need help understanding which information a Radikal feature sends to an external service; a link is not a promise that its privacy practices match ours.
16. Changes to this policy
We may update this policy when our services, providers, data practices or applicable requirements change. The date at the top identifies the latest published version. Where a material change requires additional notice or fresh consent, we will provide it as required by applicable law. Publishing a revision does not replace consent where consent is required.
