Privacy Policy

This Privacy Policy explains how Sarthak Dhonchak (sole proprietor), 1001, DLF Corporate Greens, Sector 74A, Gurugram, Haryana 122004, India ("SoloNomads", "we", "us", "our") collects, uses, shares and protects your personal data when you use our website at https://solonomads.com (the "Site"), reserve or book a trip, or otherwise interact with us, including through WhatsApp and email.

We are the data controller (or, under India's Digital Personal Data Protection Act 2023, the data fiduciary) for the personal data described in this policy. Contact: hello@solonomads.com.

1. Data we collect

We don't knowingly collect more data than we need for the purposes below.

2. Purposes and lawful basis

3. Who we share data with

We share personal data only where necessary, with:

• our licensed local agency partners and their guides, in the country you're travelling to, so they can arrange and deliver ground services (accommodation, transport, activities, permits) for your trip;
• Skydo, to process bank transfer payments;
• Resend, our email service provider, to send booking and account emails, including sign-in links;
• Google, only if you choose to sign in with Google, to confirm who you are;
• our hosting and infrastructure providers — Vercel (application hosting), Neon (database), and Cloudflare R2 (file storage) — all operating in EU regions for data relating to EU/UK users where technically feasible;
• Upstash, which counts form submissions to stop abuse. It stores only scrambled codes made from IP and email addresses, never the addresses themselves;
• analytics providers (Google Analytics 4, and PostHog, which stores its data in the EU), only where analytics is on for you (see clause 9);
• Sentry, which receives error reports from the Site with personal details removed, and stores them in the EU;
• professional advisers (accountants, lawyers) where necessary for our own compliance; and
• regulators, tax authorities or law enforcement, where required by law.

We do not sell your personal data, and we don't share it with third parties for their own independent marketing purposes or for cross-context behavioural advertising.

4. International transfers

Because our operations and suppliers span India, Thailand, Vietnam, Laos, Indonesia, Sri Lanka and other countries, your data may be transferred outside your home country, including to countries that don't have a data protection law equivalent to the UK/EU GDPR. Where we transfer personal data of UK or EU residents outside the UK/EEA, we rely on appropriate safeguards, such as the UK International Data Transfer Agreement or the EU Standard Contractual Clauses, or transfers necessary for the performance of a contract with you (for example, sending your name to a local agency to arrange your trip). Contact us for details of the safeguards used for a specific transfer.

5. Retention

We keep personal data only as long as necessary for the purposes it was collected:

• Booking and financial records: for as long as required by applicable tax and accounting law (typically 6–8 years).
• Marketing consent and preferences: until you unsubscribe or withdraw consent, plus a short record to prove that withdrawal.
• WhatsApp group membership: removed after your trip ends, or earlier on request.
• Traveller account: kept while you use it. Ask us and we'll delete it; booking and financial records stay for the period above. Sign-in links expire after a short time, and you stay signed in until you sign out or your session expires.
• Enquiries that don't lead to a booking: deleted or anonymised after a reasonable period, typically within 24 months of last contact.
• Photos/media with your consent: retained for marketing use until you withdraw consent (see Booking Terms §19), subject to material already published.

6. Your rights

Depending on where you live, you may have the right to: access the personal data we hold about you; correct inaccurate data; request erasure; restrict or object to processing; request a portable copy of your data; and withdraw consent at any time (without affecting processing already carried out). India's DPDP Act 2023 provides similar rights as its provisions come into force, and we already honour them, including the right to a grievance redressal mechanism and to nominate another person to exercise your rights if you become unable to.

To exercise any of these rights, email hello@solonomads.com. We aim to respond within one month (or the timeframe required by the law that applies to you). We may need to verify your identity before actioning a request.

US state privacy rights. We don't sell personal data and don't share it for cross-context behavioural advertising, so opt-out-of-sale/sharing mechanisms required by laws such as the California CPRA, Colorado CPA, Connecticut CTDPA and Virginia VCDPA don't add anything beyond what's above — you can still access, correct, delete or port your data, and opt out of analytics cookies at any time via "Cookie settings" in the footer (see our Cookie Policy); we also honour recognised opt-out preference signals such as Global Privacy Control.

India (DPDP Act 2023). As a data fiduciary, we give you notice, at or before collection, of what personal data we collect and why (clause 1 and clause 2 above), and rely on your consent or another lawful ground under the Act for each purpose. You have the rights in this clause, plus the right to a grievance redressal mechanism and to nominate another person to exercise your rights if you're unable to. To raise a grievance or exercise a DPDP right, email hello@solonomads.com; we'll acknowledge and address it in line with the Act's timelines as they come into force.

Canada (PIPEDA). Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), we collect, use and disclose your personal data only with meaningful consent and for purposes a reasonable person would consider appropriate in the circumstances. Outside Quebec, we rely on implied consent, with clear notice and an easy opt-out, for site analytics — see clause 9 and our Cookie Policy for the "Cookie settings" control and how we honour Global Privacy Control. We don't use analytics data for advertising or profiling. You have the right to access the personal data we hold about you, to challenge its accuracy and have it corrected, and to withdraw consent at any time, subject to legal or contractual restrictions. To exercise these rights, email hello@solonomads.com. If you're not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada (OPC). If you're a Quebec resident, Law 25 applies instead of PIPEDA's implied-consent standard for analytics: non-essential cookies are only set after you actively opt in via our cookie banner (see clause 9), and you have the same access and correction rights, enforced by Quebec's Commission d'accès à l'information.

New Zealand (Privacy Act 2020). We collect, hold, use and disclose your personal information in line with New Zealand's 13 Information Privacy Principles (IPPs). In particular: under IPP 3, this policy and clause 1 tell you what personal data we collect, why, and who we may disclose it to; under IPP 12, before disclosing your personal information to an organisation outside New Zealand (for example, a local agency partner delivering your trip, or a hosting provider — see clauses 3 and 4), we take reasonable steps to check it will be subject to comparable privacy safeguards, whether because the recipient is itself bound by the Privacy Act, is bound by a comparable overseas law, or has agreed contractual protections with us. Site analytics for New Zealand visitors follow the notice-and-opt-out approach in clause 9, with an always-available opt-out via "Cookie settings" and support for Global Privacy Control. You have the right to access your personal information and to request correction of it under Part 4 of the Act; we'll respond within the timeframes the Act sets out. To make a request, email hello@solonomads.com. If you're not satisfied with our response, you can complain to the Office of the Privacy Commissioner of New Zealand.

7. Children

Our services are not directed at, and we do not knowingly collect data from, anyone under 18. Our trips require travellers to be at least 18. If we learn we've collected data from someone under 18 without appropriate consent, we'll delete it.

8. "Show me to the group"

When you reserve, you can choose to show your first name, country and age range next to that departure on our website, so people looking at the date get a feel for the group. It's optional and off by default, and anyone viewing the departure can see it. You can withdraw consent at any time by emailing us, and we'll remove it from the page (we can't recall it from anyone who has already seen it).

9. Cookies and analytics

We use cookies and similar technologies as described in our Cookie Policy. We detect your approximate country from an IP-based geolocation signal at our hosting provider (no separate tracking cookie is used for this) to work out which rule applies to you:

• If you're in the EEA, UK, Switzerland, Brazil, or the Canadian province of Quebec, or we can't detect your country, non-essential cookies, including Google Analytics 4 and PostHog, are only set after you actively opt in via our cookie banner.
• Everywhere else, Google Analytics 4 and PostHog are on by default, and you can switch them off at any time via "Cookie settings" in the site footer.

We don't sell your personal data or share it for cross-context behavioural advertising, in any region.

10. Security

We use reasonable technical and organisational measures to protect your data, including encrypted connections (HTTPS), access controls on our systems, and hosting providers (Vercel, Neon, Cloudflare) that maintain their own security certifications. No system is completely secure, and we can't guarantee absolute security of data transmitted to us.

11. Contact and complaints

For any question about this policy or your data, email hello@solonomads.com or see our Contact page.

If you're not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority — for example, the Information Commissioner's Office (ICO) in the UK, your national Data Protection Authority in the EU, the Data Protection Board of India under the DPDP Act, the Office of the Privacy Commissioner of Canada (or Quebec's Commission d'accès à l'information, for Quebec residents), or the Office of the Privacy Commissioner of New Zealand.

12. Changes to this policy

We may update this Privacy Policy from time to time. The "last updated" date at the top shows the latest revision. Material changes will be highlighted on the Site.