Privacy Policy

Personal information you give us directly:

• Name, and where applicable, emergency contact's name.
• Contact details — email address and phone number.
• Location details such as city, state, and pin code.
• Trekking preferences, past trek history, and interests.
• Identity documents — PAN, Aadhaar, Driving Licence, Passport, etc. — collected only when required for trek permits, government reporting, or booking verification, and only to the extent applicable law requires.

Sensitive personal information:

• Health information relevant to your fitness for trekking at altitude (pre-existing conditions, medication, allergies).
• Emergency contact details for use during a trek.
• Payment information — processed directly by Razorpay; Mountthrill does not store your card, UPI, or bank details on its own servers.

Information collected automatically:

• Device, browser, and usage data (pages visited, time on site, referral source) via cookies and analytics tools.
• Approximate location, where you permit it, to show relevant treks or check-in status.

We collect this information when you browse the Website, create an account, make a booking, subscribe to updates, fill a contact form, or respond to a survey.

We process your personal information on the following legal bases (Consent, Contractual necessity, Legal obligation, Legitimate interest) for the following purposes:

• Trek bookings: to process your booking, confirm availability, generate invoices, and communicate departure details.
• Safety on trek: to share relevant health and emergency contact information with our trek leaders and, where necessary, local guides or medical facilities.
• Account management: to maintain your Mountthrill account, booking history, and reward points (PointLedger).
• Communication: booking confirmations, itinerary updates, and responses to your queries, sent via email and/or WhatsApp.
• Marketing: with your explicit consent, updates about new treks, seasonal offers, or content we think you'd find useful. You can opt out anytime.
• Service improvement: understanding how trekkers use the Website to make it faster, clearer, and more useful.
• Legal compliance: including permit applications, forest department requirements, and tax records.

We work with the following categories of service providers, each bound by contract to use your data only for the purpose we specify and never to sell or misuse it:

• Payment processing: Razorpay (PCI-DSS compliant)
• Media & image storage: Cloudinary
• Transactional & marketing email: Resend
• Database & booking records: MongoDB Atlas
• Hosting & infrastructure: Vercel
• Website analytics: Google Analytics

We do not sell, rent, or trade your personal information to third parties. We will only share it beyond the providers above with your consent or where required by law (e.g. permit authorities, government reporting).

Note: The Website may link to third-party sites (e.g. partner accommodations, permit authorities). We don't control these sites and aren't responsible for their privacy practices.

We keep personal information only as long as it's needed for the purpose it was collected, or as required by law:

• Account information: Duration of active account, plus 3 years after closure
• Booking & transaction records: 8 years (tax and accounting requirements)
• Marketing preferences: Until you withdraw consent or unsubscribe
• Health information: Deleted within 30 days of trek completion, unless needed for incident investigation
• Identity documents: Duration required by the relevant permit authority, then securely deleted

We use appropriate technical and organisational safeguards to protect your information, including encryption of data in transit and at rest, access controls to our databases, and regular security reviews. However, no method of transmission is 100% secure. In the event of a breach, we will notify affected individuals and authorities as required under the DPDP Act.

Depending on applicable law, including India's DPDP Act, you have the right to:

• Access: request a copy of the personal data we hold about you.
• Correction: ask us to fix inaccurate or incomplete information.
• Erasure: request deletion of your data, subject to legal/record-keeping requirements.
• Withdraw consent: for anything we process based on your consent, including marketing.
• Grievance redressal: raise concerns about how your data has been handled.

To exercise any of these rights, email support@mountthrill.com. We'll respond within 30 days and may ask you to verify your identity first.

Cookies are small files stored on your device that help us understand how the Website is used and make it work better for you. We use cookies to recognise you on return visits, analyse traffic patterns, and remember preferences. Cookies don't give us access to your device. You can adjust your browser settings to decline them, though some parts of the Website may not work as smoothly.

We do not knowingly collect personal information from anyone under 18 without verifiable parental or guardian consent.

For any privacy questions, concerns, or grievances, or to exercise your rights under the DPDP Act:

• Grievance Officer: Sheetal Chauhan
• Email: support@mountthrill.com
• Phone: +91 99971 67205
• Registered Office: Dehradun, Uttarakhand, India

Mountthrill will respond to grievances within the timeframe prescribed by applicable law.