Privacy Policy

1. Who controls your data

Outway Club is the data fiduciary (controller) for the personal data described here. For any privacy request, write to hello@outway.club with “Privacy” in the subject line.

This policy is written to meet the Digital Personal Data Protection Act, 2023 (India) and, where it applies to travellers based in Europe, the GDPR.

2. What we collect

When you create an account

• Your name and email address
• A password, stored only as a salted hash by our authentication provider: we never see it

When you send a booking request

• Your name, email address and phone number, and how many of you are travelling
• The city you are travelling from, and whether you want us to book your flight or train
• Your answers to the short questionnaire about how you like to travel, including the age band you select. We use these only to place you in a group that suits you, and we do not publish them, sell them or share them with anyone outside Outway Club.
• Anything you choose to add in the two optional boxes at the end

When you make a booking

• Full name, age and gender for each traveller on the booking
• Contact email and, where you provide it, a phone number
• Special requests you choose to tell us, which may include dietary or medical information
• Booking amount, Razorpay order and payment identifiers, and refund identifiers

We do not receive or store your card number, CVV, UPI PIN or netbanking credentials. Those go directly from your browser to Razorpay.

When you contact us or subscribe

• Name, email, optional phone number and the content of your message
• Your email address if you join the list for future escapes

When you submit a review

• The display name you choose, your rating, review text and, optionally, a video link

Automatically

• Your IP address, used solely to rate-limit our public forms and payment endpoint against abuse. These counters are keyed to your IP and pruned automatically.
• A session cookie so you stay signed in. It is strictly necessary for the site to work.

There are no advertising cookies, no third-party analytics trackers and no cross-site profiling on this website.

3. Why we hold it, and on what basis

• To deliver a trip you booked: performance of our contract with you. Traveller names go to hotels; group counts go to transport operators.
• To take payment and issue refunds: performance of contract, and legal obligation for tax records.
• To reply to enquiries and booking requests: your consent, given by writing to us or sending the request, and steps taken at your request before entering a contract.
• To email you about a future escape: your consent, given by subscribing. One click unsubscribes and we never add you without an action from you.
• To prevent spam and fraud on our forms and checkout: our legitimate interest in keeping the service usable and secure.
• To publish a review you submitted: your consent, revocable at any time.

4. Who we share it with

We share the minimum necessary with these categories of recipient, and no one else:

• Supabase: database, authentication and file storage. Your account and booking records live here.
• Razorpay: payment processing and refunds. Receives your name, email and payment instrument details directly.
• Resend: sends our transactional email. Receives your email address and the content of the message being sent.
• Vercel: hosts and serves this website.
• Trip suppliers: the specific hotels, transport operators and activity providers on your itinerary receive the traveller names and, where relevant, the dietary or accessibility information you gave us.
• Authorities: where we are legally required to disclose, for example hotel ID records mandated under Indian law.

We do not sell personal data, we do not rent mailing lists, and we do not share your data with advertisers.

5. How long we keep it

• Booking and payment records: 8 years from the end of the financial year, as required by Indian tax and accounting law.
• Account data: until you ask us to delete the account.
• Enquiries: 24 months from your last contact with us.
• Marketing subscriptions: until you unsubscribe.
• Rate-limit records: automatically deleted after 24 hours.

6. Your rights

You can, at any time and free of charge:

• Ask for a copy of the personal data we hold about you
• Ask us to correct anything inaccurate
• Ask us to delete your data, subject to records we must keep by law
• Withdraw consent for marketing email, or ask us to unpublish a review you submitted
• Ask us to restrict or object to a particular use of your data
• Nominate someone to exercise these rights on your behalf if you are unable to

Email hello@outway.club and we will respond within 30 days. If you are not satisfied with our response you have the right to complain to the Data Protection Board of India.

7. How we protect it

All traffic to this site is encrypted in transit over HTTPS. Database access is governed by row-level security policies, so one traveller cannot read another's booking even if they hold a valid session. Administrative access is limited to named accounts with an explicit admin role. Passwords are hashed, never stored in readable form, and payment credentials never touch our servers.

No system is perfectly secure. If a breach occurs that is likely to affect you, we will notify you and the Data Protection Board without undue delay.

8. Children

This site is not directed at children and we do not knowingly create accounts for anyone under 18. Where a minor travels with us, their details are provided by the accompanying adult who made the booking, and we process them only to deliver the trip. If you believe a child has given us data directly, tell us and we will delete it.

9. International transfers

Our infrastructure providers may process data on servers outside India. Where that happens, transfers are made under the providers' standard contractual clauses and equivalent safeguards. You can ask us for details of where your data is hosted.

10. Changes to this policy

If we change how we use personal data in a material way, we will update this page and email account holders before the change takes effect. See also our Terms of Service and Cancellation & Refund Policy.