Privacy Policy

This Privacy Policy explains how Hidden Leaves ("we", "us") collects, uses, stores, and protects your personal data when you use hiddenleaves.in and related services.

We comply with the Information Technology Act, 2000, the SPDI Rules 2011, and applicable provisions of the Digital Personal Data Protection Act, 2023 (DPDPA) as they come into force.

Account data: name, email, mobile number, password (stored as a salted hash — never plain text).

Booking data: travel dates, guest details, package/hotel selections, payment method preference (demo mode — no card numbers stored).

Reviews: ratings, text, optional destination references, linked to your account.

Technical data: IP address, browser type, device info, cookies (see Cookie Policy).

Communications: messages sent via contact form, WhatsApp, or email support.

Process and manage bookings, send confirmations, and provide trip support.

Authenticate your account and enforce role-based access (users see only their data; staff/admin have moderated access).

Moderate and publish customer reviews.

Improve our website, detect fraud, and comply with legal obligations.

Send promotional offers only if you opt in. You may unsubscribe anytime.

User accounts, bookings, and reviews are stored in our secure server database — not in browser localStorage.

Passwords are hashed with bcrypt. Sessions use signed JWT tokens with HTTP-only cookies.

API routes validate authentication and roles on every request. Users cannot modify other users' bookings or reviews.

We use HTTPS in production, security headers (CSP, HSTS, X-Frame-Options), and input validation via Zod on all forms.

Account data: retained while your account is active, plus 3 years after last activity for legal/tax purposes.

Booking records: 7 years (GST and tourism regulations).

Reviews: retained while published; you may request deletion of your own review.

Server logs: 90 days.

Access, correct, or delete your personal data by emailing support@hiddenleaves.demo.

Withdraw consent for marketing communications.

Lodge a complaint with our Grievance Officer (see Contact) or the Data Protection Board of India.

Payment gateways (production): PCI-DSS compliant processors — we never store full card numbers.

Instagram/Facebook APIs: only if configured, to display your public business posts.

We do not sell personal data to advertisers.

Our services are not directed at children under 18. Bookings for minors must be made by a parent or guardian.

Data Controller: Hidden Leaves Travel Pvt. Ltd., registered at Demo Office, Mall Road, The Mall, Himachal Pradesh 171001. GSTIN: 02AABCDE0000F1Z5. CIN: U99999XX0000PTC000000.

Grievance Officer: Demo Officer, grievance@hiddenleaves.demo, +91 90000 00000. Response within 48 business hours.