Privacy Policy

Orbitrek Tour and Travels, a sole proprietorship trading as Orbitrek Travels ("Orbitrek," "we," "us"), helps travelers plan and request custom journeys. This policy explains what personal information we collect through our website, why we collect it, who helps us handle it, and the choices you have.

We operate from Thane, Maharashtra, India, so Indian law governs how we handle your personal information. Today that means the Information Technology Act, 2000 and the rules made under it on reasonable security practices and sensitive personal data.

India's Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 will replace much of that regime, in stages. The Data Protection Board of India was established in November 2025. The obligations that will bind a business like ours, notice, consent, your rights, and reporting breaches, take effect in May 2027. We are not claiming those duties already bind us, and you should not read this page as telling you that you hold enforceable rights under that Act today. We have written this policy to that standard anyway, and we will update it as each stage comes into force.

In plain terms: we collect only what we need for a purpose we have told you about, we ask for your consent, we keep it secure, and you can ask us what we hold about you and have it corrected.

• Account information. When you sign in or create an account, authentication is handled by our identity provider, Clerk. We receive your name, email address, profile image, and a unique account identifier so we can associate saved itineraries and requests with you. We never see or store your password.
• Trip & itinerary details. The preferences you enter into our trip planner (destination, trip length, party size, travel style, budget tier, pace, travel month, and anything you choose to write about what you want from the trip), together with the itinerary generated from them. Please don't include medical details; the planner asks you not to.
• Booking request details. When you submit a request for a tour we record the tour, your departure date, the number of travelers, and the estimated total. The request form also has an optional phone number field; we do not currently store phone numbers in our database.
• Contact messages. Our contact form collects your name, email address, the topic you pick, and your message. That message is emailed to our team inbox so a specialist can reply. It is not saved to our database.
• Reviews. If you choose to leave a review, it is published on the relevant tour page together with your rating and the first name on your account. We publish a review only with the traveler's permission, we never write or edit a review on a traveler's behalf, and you can ask us to take yours down at any time. Every review shown on this site comes from a real traveler; where a tour has no reviews yet, we say so rather than displaying a rating.
• Technical & log data. We do not run advertising or analytics trackers on this site. Our hosting and content-delivery providers keep standard server logs, IP address, timestamp, the page requested, and browser user-agent, to keep the site available and secure, and our error-monitoring tool records technical diagnostics when something breaks.

We do not ask you for financial information on this website. If you go ahead with a trip, any payment details are arranged directly with your specialist and are not collected here.

We use essential first-party cookies and browser local storage only. Signing in relies on a session cookie set by Clerk; your light/dark theme choice and your response to our cookie notice are saved in your browser's local storage, not in a cookie we send to a server. We do not deploy third-party advertising or cross-site tracking cookies, and we do not sell or share browsing data with advertisers.

Most browsers let you refuse or clear cookies and site data. Clearing them will sign you out, reset your theme, and bring back the cookie notice; disabling essential cookies altogether will prevent sign-in from working.

We use your information for the purposes below, and we rely on your consent, given when you create an account, plan a trip, or send us a message, as the basis for handling it.

• To build, save, and revisit the itineraries you request.
• To respond to your consultation requests and contact messages, and to send you the confirmation email for a request you submitted.
• To operate, secure, and improve our website, including limiting abuse of the itinerary generator.
• To comply with legal, tax, and regulatory obligations.

We do not use your personal information for automated decision-making that has a legal effect on you, and we do not sell it. You can withdraw your consent at any time, see Your rights below.

We do not process online payments through this site today. Submitting a request takes no payment, it starts a conversation with a specialist, who arranges payment separately once details are confirmed. If we introduce online checkout in the future, card processing will be handled by a PCI-compliant payment processor and full card numbers will never reach Orbitrek's servers; we will update this policy before any such feature goes live. How money is handled once a trip is confirmed is described in our Refund & Cancellation Policy.

Orbitrek operates from India, but the services that run this website are hosted primarily in the United States. That means your personal information may be stored and processed outside India.

Indian law permits this, on conditions we meet. Under the rules currently in force, we may transfer your information to a provider outside India where the transfer is necessary to perform our agreement with you or you have consented to it, and only where that provider maintains a comparable standard of data protection which we require of each of them by contract.

Looking ahead, the Digital Personal Data Protection Act, 2023 takes a more permissive approach: it allows transfer outside India except to countries the Central Government restricts by notification. No such notification currently affects the countries our providers operate in. If one is issued, we will change providers or arrangements to match.

While your information is in another country, it is subject to that country's laws, including lawful requests for access by its courts, law enforcement, and national security authorities, regardless of the protections we have in place. We choose established providers, share only what each one needs to do its job, and require them by contract to protect your information and to process it only on our instructions.

We do not sell your personal information and we do not share it for advertising. We share it only with the service providers that make the site work, and only as much as each one needs:

• Clerk creates and secures your account and keeps you signed in.
• Neon hosts the managed PostgreSQL database where your account, itineraries, and requests are stored.
• Amazon Web Services hosts and serves the website itself (AWS Amplify), and stores and delivers our photography (Amazon S3 and CloudFront).
• Resend delivers our transactional email, such as the confirmation for a request you submitted and messages you send us through the contact form.
• Amazon Bedrock drafts itineraries: your planner answers are sent to an Anthropic Claude model that runs inside AWS, in US regions. AWS documents that the model provider has no access to these prompts and responses.
• Cloudflare Turnstile checks that the contact form and trip planner are being used by a person rather than a bot. It receives your IP address and technical signals from your browser for that check only, and does not track you across sites.
• Sentry records technical error reports so we can find and fix faults on the site.

Where a trip goes ahead, we also share the details a supplier needs to deliver it, for example a hotel needs your name and dates, and an airline or a trek-permit authority may need passport details. We tell you what a supplier requires before we send it.

We may also disclose personal information where the law requires it, or to establish or defend a legal claim. If Orbitrek is ever involved in a sale or reorganization of the business, information may be transferred as part of it, subject to this policy.

Generated custom itineraries are retained for approximately 30 days to give you time to review and act on them, after which they are automatically removed by a daily clean-up. An itinerary you have unlocked (purchased) is kept as a record of that purchase for as long as your account exists. An itinerary attached to a booking request is kept for as long as we keep that request, so your trip history stays intact.

Account records, booking requests, and correspondence are kept only as long as necessary to provide our services, maintain business records, and meet legal and tax obligations, then deleted or anonymized. Indian tax and company-law record-keeping rules set minimum periods we cannot go below, so where you ask us to delete something we are required to retain, we will tell you that and why.

Access to the site and its database is authenticated and encrypted in transit, administrative tools are restricted to named staff accounts, and credentials are stored only in our hosting provider's secret configuration. No system is perfect, but we take reasonable technical and organizational safeguards appropriate to the sensitivity of what we hold, as Indian law requires.

If a breach of your personal data occurs, we will tell you and the relevant authority promptly, and explain what happened, what it affects, and what we are doing about it.

You can ask us to:

• Tell you what we hold about you, how we have used it, and who we have shared it with.
• Correct information that is inaccurate, incomplete, or out of date.
• Erase information we are not legally or contractually required to retain.
• Withdraw your consent to our handling of your information, at any time. Withdrawing consent means we can no longer plan trips for you or keep your saved itineraries, and we may have to close your account, we will tell you the consequences before we act on your request.
• Nominate someone to exercise these rights on your behalf if you die or become unable to act for yourself. Email our grievance officer with the nominee's name and contact details and we will record it.

Write to our grievance officer using the details below. We will acknowledge your request within 48 hours and respond substantively within 30 days, or tell you why we need longer. We may need to verify your identity first, normally by confirming you control the email address on the account, so we do not disclose your information to someone else.

If you are not satisfied with how we handled your request, you can complain to the appropriate Indian authority. Once the Digital Personal Data Protection Act, 2023 is fully in force, that will be the Data Protection Board of India. Nothing in this policy limits your rights under the Consumer Protection Act, 2019, including your right to approach a Consumer Disputes Redressal Commission. If you live outside India, you may have additional rights under your local law, and we honour those where they apply to you.

This website is intended for adults arranging travel. Under Indian data-protection law a childis anyone under 18, and we do not knowingly collect a child's personal data through this site without the verifiable consent of a parent or guardian. We do not profile children, monitor their behaviour, or direct advertising at them, we run no advertising or behavioural tracking on this site at all.

Where a trip includes minors, the adult making the booking gives us their details, and we ask only for what a supplier actually needs. Please share those details directly with your specialist rather than through the website. If you believe a child has given us personal data without a guardian's consent, contact our grievance officer and we will delete it.

Indian law requires us to name a grievance officer and publish how to reach them. Ours is:

Our grievance officer is accountable for this policy and for the personal information in our care. Email is monitored and is the fastest route to us today. You can also use our contact page. See also our Terms of Service and Refund & Cancellation Policy.