• Account Information: Your name; a mobile number or an email address — you can sign up with either, and adding the other is optional; and, optionally, a profile photo. Explorer accounts provide professional details. Business accounts provide GSTIN for verification.
• Content You Upload: Your Routes and the media in them (photos and videos), itineraries, destination details, and — for Business accounts — Showcase content and package listings.
• Usage Data: Routes viewed, itineraries saved, searches, accounts followed — used to personalise your experience.
• Device Data: Device model, OS version, device identifier, push notification token, IP address.
• Location Signals: State and city level inferred from destination searches and content engagement, used to personalise your feed and target Business ads. We do not collect precise GPS.
• Payment Data: Wallet top-ups for Business accounts are processed by a third-party payment provider. Galiaraa never sees or stores your card details — those stay with that provider. We store the transaction reference and your wallet balance.
• Payout and Verification Data (KYC): If you choose to receive payments from Galiaraa — as an Explorer eligible for payouts, or as a business partner receiving settlements — we collect and store the details needed to pay you and to verify your identity as required by law: your legal name, PAN, and either your bank account number with IFSC or your UPI ID. Explorers also record a short selfie video for identity verification, and business partners provide GSTIN and entity details. This information is stored by Galiaraa. It is required only if you want to be paid through the platform — never to browse, watch, save itineraries, or use Galiaraa as a traveler. It is accessible to authorised Galiaraa staff solely to verify your identity and process your payments, and every access is recorded.

We are a Data Fiduciary under the DPDP Act, 2023. We collect personal data only for the purposes stated in this policy, with your consent given at account creation. You may withdraw consent at any time by deleting your account. We will seek fresh consent before introducing any new data collection purpose.

• To operate the platform: feed, uploads, and notifications.
• To personalise recommendations based on your viewing and search history.
• To facilitate direct contact: when you send an inquiry to a Business, your contact details are shared with them.
• To record ad interactions: when you tap a WhatsApp CTA on an ad, an anonymised interaction is recorded. Your identity is not shared with the business at that point.
• To prevent fraud and comply with legal obligations.

• Message delivery: The mobile number or email address you sign in with is shared with our OTP delivery provider, solely to send sign-in codes.
• Payment processing: Business account payments are processed by a third-party payment provider. Card details are handled by that provider and never reach Galiaraa; we store the transaction reference. Payout details you provide for KYC (bank account, UPI, PAN) are stored by Galiaraa and shared only with our payment partner when a payout to you is executed.
• WhatsApp / Meta: When you tap a WhatsApp CTA on a Business ad, you are redirected to WhatsApp. That interaction is governed by WhatsApp’s and Meta’s own privacy policies. Galiaraa receives no data from the WhatsApp session.
• Business Accounts: When you send a direct inquiry to a hotel or agency, your contact details are shared with that business.
• Legal Obligations: We disclose data when required by law or government authority.

• Profile and content: Account lifetime, then removed within 30 days of account deletion (see Account Deletion).
• Payment and invoice records: 8 years (Companies Act 2013 s.128).
• Usage analytics events: 12 months.
• Ad impression data: 24 months.
• Trust & safety logs: 5 years (IT Rules 2021).

• Right to Access: Request a summary of personal data we hold.
• Right to Correction: Request correction of inaccurate data.
• Right to Erasure: Request deletion of your account and data within 30 days, subject to legal retention obligations.
• Right to Nominate: Nominate another person to exercise your rights on your behalf in the event of your death or incapacity.
• Right to Grievance Redressal: Contact our Grievance Officer at legal@galiaraa.com.

Delete your account at any time from app Settings. Your profile, Routes, and itineraries are removed within 30 days. Payment records and safety logs are retained as required by law. Business accounts with active wallet balance must request a refund before deletion.

Galiaraa is not intended for users under 18. If we become aware a minor has created an account, we delete it. Report suspected minor accounts to legal@galiaraa.com.

If you take part in Galiaraa Points, we keep a record of the points you earn, spend and lose to expiry and of the vouchers you redeem. We use it to operate the programme, prevent misuse and handle complaints. When you redeem a voucher, Galiaraa does not share your identity with the business; you deal with the business directly when you use the voucher. This record is retained and deleted with your account as described in § 5 (Data Retention) and § 7 (Account Deletion).