Privacy Policy

What this policy covers

This Privacy Policy explains what personal data we collect on excursiv.com and 21regents.com (and any future apps we release), why we collect it, how long we keep it, who we share it with, and what rights you have over it. We've written this in plain language rather than dense legal text, so you can actually understand what you're agreeing to, while still covering everything the law requires us to disclose.

Contact: hello@excursiv.com

"Personal data" means anything that identifies you as a person, like your name, email address, IP address, or cookie identifiers, plus anything we store alongside those, like how you use the site. Some places call this "personal information" instead, we mean the same thing.

We can only speak for ourselves here. When you book something through any provider featured on our Platforms, including the providers we currently work with and any we add in the future, that provider handles your data under their own privacy policy and terms, not this one. Read theirs before you book.

This site isn't directed at anyone under 16, and we don't knowingly collect personal data from anyone under 16. If we learn we've collected it from a child without a parent or guardian's permission, we delete it.

A note on where we're at: Excursiv is an early-stage business, and some of the formal structures larger companies have, like a designated EU representative or a dedicated Data Protection Officer, aren't in place yet. We describe our actual current practice honestly throughout this policy, and we intend to put these formal mechanisms in place as we grow and once we're formally incorporated. This policy isn't a substitute for a lawyer's review before we take on meaningful volumes of EU, UK, California, or other regulated traffic.

What we collect, and where it comes from

What you give us directly

- Account info: your email address and a password. We store your password as a secure salted hash through our authentication provider, Supabase Auth. We never see or store it in plain, readable form.

- Correspondence: if you email hello@excursiv.com, we keep that conversation, and anything personal you choose to include in it, so we can respond to you.

- Saved experiences: if you bookmark a listing while logged in, we store a record linking your account to that listing.

- Membership information: if and when 21 Regents membership functionality goes live, we may collect application or profile information you choose to submit.

What we collect automatically

- Device and technical info: your IP address, device type, browser type and version, operating system, and general settings, standard information any website automatically logs.

- Approximate location: country- and region-level location, derived from your IP address only. We do not collect GPS-level or exact street-address location.

- Usage activity on Excursiv: which pages on our Platforms you visit, how long you spend on them, what you search for on our site, and which links you click while you're on Excursiv, including links that take you to a provider's website. This is specifically your activity on our Platforms, not your browsing elsewhere. Some of this is collected through cookies, see our Cookie Policy for the full breakdown.

- Email engagement: the time and date of messages you send us, and how you interact with any emails we send you, such as whether it was opened.

What we work out ourselves

We use your approximate, IP-derived location to decide which destinations to show you, through a system we call "GeoLens." That's the extent of it, we don't build behavioral profiles, interest categories, or other inferences about you, and we don't use any inferred data to change the price you see.

What we receive from other companies

- Providers and affiliate networks. If your click on an Excursiv link leads to a qualifying booking, we're told that a booking happened and what commission we're owed, either directly by the provider or through the affiliate network managing that integration. This is limited strictly to what's needed to confirm and calculate the commission. We do not receive your payment details, government ID, or the substantive details of your booking, such as travel dates or party size, from providers.

- Our infrastructure providers. Supabase, Vercel, and Typesense, who host, run, and power search on the site for us, generate normal operational logs (like request logs) as part of running the Platforms.

What we don't collect

We don't, as a matter of course, collect: payment card or bank information (we don't process payments ourselves); government-issued ID or passport details; precise GPS location; biometric data; or information revealing race or ethnicity, religion, health status, sexual orientation, trade union membership, or criminal history (what GDPR calls "special category data" and CCPA calls "sensitive personal information"). If you voluntarily include this kind of information in an email to us, we handle it with extra care and only use it to respond to you.

Why we use your data, and our legal basis for doing so

Each purpose below lists what data it involves and, where relevant under GDPR Article 6, the legal basis we rely on.

Running the site. Generating search results and comparisons, making sure the site displays correctly on your device. *Data used:* device info, usage activity. *Legal basis:* our contract with you (the Terms & Conditions), or our legitimate interest in operating a working service.

Sending you to a provider. When you click through to a provider, we pass along the minimum information needed for that provider or its affiliate network to recognize the referral came from Excursiv. *Data used:* device info, click/referral data. *Legal basis:* legitimate interest, this is the operating mechanism of our referral-based business.

Running your account. Creating and maintaining it, remembering your saved experiences, keeping you signed in. *Data used:* account info, saved items. *Legal basis:* our contract with you.

Showing relevant destinations. Using your approximate location to power GeoLens. *Data used:* approximate, IP-derived location only. *Legal basis:* legitimate interest, delivering geographically relevant content.

Responding to you. Using the content of your emails to answer your questions or complaints. *Data used:* your correspondence, account info where relevant. *Legal basis:* legitimate interest, or our contract with you if you're already a user.

Understanding and improving the site. Aggregate usage data through Vercel Analytics and Speed Insights, to see what's working and fix what isn't. *Data used:* device info, usage activity. *Legal basis:* legitimate interest, or your consent for non-essential analytics cookies (see our Cookie Policy).

Tracking commissions owed to us. Using referral confirmations from providers to calculate what we're paid. *Data used:* referral/click data, booking confirmations (excluding your payment or trip details). *Legal basis:* legitimate interest, and, where applicable, our commercial agreements with providers.

Security and fraud prevention. Watching for abuse of the site, like automated scraping or credential-stuffing attempts on accounts. *Data used:* device info, usage activity. *Legal basis:* legitimate interest, and, where applicable, legal obligation.

Running the business. Bookkeeping and accounting (once we're incorporated), meeting tax and legal obligations, detecting fraud. *Data used:* account info, correspondence, financial records once incorporated. *Legal basis:* legal obligation and legitimate interest.

Where we rely on your consent, like non-essential cookies, you can withdraw it at any time. That doesn't undo processing that already happened while your consent was active. See our Cookie Policy for how to manage this.

We don't make any decision about you that has a legal or similarly significant effect based solely on automated processing. No algorithm decides anything meaningful about you here.

Who we share your data with

We don't sell your personal data, and we don't currently run third-party advertising on the Platforms.

Infrastructure and service providers. Supabase (database hosting and login), Vercel (site hosting, analytics, performance), and Typesense (search). Each processes data on our behalf, under their own security obligations, strictly to provide their service to us. If we add comparable tools later, such as email delivery or customer support software, we'll update this section to reflect it.

Providers and affiliate networks. Limited to referral and attribution data needed to confirm and calculate commissions we're owed. This applies the same way across our entire provider network, present and future, not only the providers named as examples elsewhere on the site.

Legal and safety reasons. We'll disclose data where required to comply with a law, court order, or lawful government request, to enforce our Terms & Conditions, or to protect the rights, safety, or property of Excursiv, our users, or the public, including in cases of suspected fraud.

If the business changes hands. If Excursiv is incorporated, sold, merged, or its assets transferred, your data may transfer as part of that transaction. You'll be told if the entity responsible for your data changes.

We do not, and will not, disclose your personal data to third parties for those third parties' own direct marketing purposes.

We may share aggregated or de-identified information, such as overall traffic statistics, without restriction, since it can't be traced back to you.

Cookies

Yes, we use them. Full detail on what kinds, how long they last, and how to control your preferences lives in our Cookie Policy, which forms part of this Privacy Policy.

Once you click through to a provider's website, anything they do with cookies from that point on is entirely their own practice, governed by their policies, not ours. We have no visibility into or control over it.

Where your data is processed

Our infrastructure providers may store and process data outside your home country, including in the United States. If you're in the EEA, UK, or another jurisdiction with data transfer rules, we rely on the safeguards our providers already have in place, such as the European Commission's Standard Contractual Clauses or the UK's International Data Transfer Addendum. You can request documentation of the relevant safeguard at hello@excursiv.com.

How long we keep your data

- Account data: for as long as your account is active, plus up to 30 days after deletion for recovery and legal purposes, then it's permanently deleted.

- Saved experiences: deleted immediately when you delete your account or remove the saved item yourself.

- Analytics data: follows Vercel Analytics' standard retention practices, generally no longer than 24 months in identifiable form where we hold it directly.

- Correspondence: kept as long as reasonably needed to resolve the matter, generally not beyond 24 months absent an ongoing need.

- Cookie data: per the durations in our Cookie Policy.

- Commission and financial records: once we're formally incorporated, kept as long as applicable tax and financial law requires, commonly several years.

You can ask us to delete your data at any time, subject to the exceptions above.

How we protect your data

- Passwords are hashed by Supabase Auth, we don't build or handle our own credential storage.

- Row-Level Security on our database means your saved experiences and account data are only accessible to you, the authenticated owner.

- We rely on Vercel's infrastructure-level network and hosting security.

- Access to production systems and service-role credentials is restricted to the platform operator.

No system is completely secure, and we can't promise a breach will never happen. If one affects your data, we'll notify you and the relevant regulators as required by law, including within the 72-hour window GDPR requires where applicable.

Your rights

For everyone, wherever you are

You can contact hello@excursiv.com to ask us to show you your account information, delete your account and associated data, manage your cookie preferences (see our Cookie Policy), or stop retaining past correspondence with you. Because Excursiv isn't yet a registered business entity, these requests are handled directly by the person operating the site, and we aim to respond within a reasonable time.

If you're in the European Economic Area or United Kingdom (GDPR / UK GDPR)

You have the following rights under Articles 15 through 22 of the GDPR:

- the right to know whether we process your data, and get a copy of it (access)

- the right to have inaccurate data corrected (rectification)

- the right to have your data deleted, sometimes called the "right to be forgotten" (erasure)

- the right to limit how we use your data in certain situations (restriction)

- the right to receive your data in a portable, machine-readable format (portability)

- the right to object to processing based on our legitimate interest, including profiling (objection)

- the right to not be subject to a decision based solely on automated processing that has a legal or similarly significant effect on you, we don't currently make any such decisions

- the right to withdraw consent at any time, where we rely on consent

If you're unhappy with how we've handled a request, you can complain to your national supervisory authority. In the UK, that's the Information Commissioner's Office (ico.org.uk). If you're in the EU, your national Data Protection Authority handles this.

We'll respond within one month of a verified request, extendable by two further months for complex requests, and we'll tell you if we need the extra time and why.

If you're in California (CCPA / CPRA)

You have the following rights under the CCPA as amended by the CPRA (California Civil Code Section 1798.100 and following):

- the right to know what categories and specific pieces of personal information we've collected, where it came from, why, and who we've shared it with

- the right to delete personal information we've collected from you, subject to certain legal exceptions

- the right to correct inaccurate personal information

- the right to opt out of the sale or sharing of your personal information. We don't sell personal information for money, and we don't "share" it for cross-context behavioral advertising as CCPA defines that term, because we don't run third-party advertising on the Platforms. There's currently nothing to opt out of on this front. If that ever changes, we'll add a clear "Do Not Sell or Share My Personal Information" option and tell you in advance

- the right to limit the use of sensitive personal information. As described above, we don't collect sensitive personal information as CCPA defines it, as a matter of course

- the right to non-discrimination for exercising any of these rights, we won't deny you service, charge you more, or treat you worse for asking

What we've actually collected, mapped to California's statutory categories (Cal. Civ. Code Section 1798.140(v)):

To exercise any California right, contact hello@excursiv.com. We'll verify your request using information reasonably available to us, generally by confirming control of the email address on your account, and respond within 45 days, extendable by a further 45 days where reasonably necessary, with notice of the extension.

California's "Shine the Light" law. Separately from CCPA, California Civil Code Section 1798.83 gives California residents who have an established business relationship with us the right to ask what personal data we've disclosed to third parties for those third parties' own direct marketing purposes over the past year. We do not make disclosures of this kind, we don't share your data with anyone so they can market to you directly. If you'd still like to submit a Shine the Light request, contact hello@excursiv.com.

If you're in Virginia, Colorado, Connecticut, Utah, or another U.S. state with a comprehensive privacy law

You have rights substantially similar to those above: access, deletion, correction, data portability, and the right to opt out of targeted advertising or the sale of personal information, where applicable under your state's law. As we don't currently sell personal information or serve targeted advertising, the practical scope of the opt-out right is currently limited, but we honor the access, deletion, correction, and portability rights for every user on request, regardless of state of residence, as a matter of practice. Contact hello@excursiv.com to exercise any of these rights, or your state Attorney General's office if you'd prefer to raise a concern with a regulator directly.

If you're in Canada

Our handling of your personal information is guided by the Personal Information Protection and Electronic Documents Act ("PIPEDA") and applicable provincial privacy legislation. You have the right to access the personal information we hold about you, challenge its accuracy, and have it corrected. Contact hello@excursiv.com to make a request. If your concern remains unresolved, you may contact the Office of the Privacy Commissioner of Canada (priv.gc.ca).

If you're in Brazil

Our handling of your personal data is guided by the Lei Geral de Proteção de Dados ("LGPD"). You have rights including confirmation that we're processing your data, access, correction, anonymization, portability, deletion, and information about who we share your data with, each as provided under the LGPD. Contact hello@excursiv.com to make a request. Brazil's data protection authority, the Autoridade Nacional de Proteção de Dados ("ANPD"), is the relevant regulator if your concern remains unresolved.

If you're in Australia

Our handling of your personal information is guided by the Australian Privacy Principles under the Privacy Act 1988 (Cth). You may request access to, and correction of, personal information we hold about you. Contact hello@excursiv.com. If unresolved, you may contact the Office of the Australian Information Commissioner (oaic.gov.au).

If you're in Singapore

Our handling of your personal data is guided by the Personal Data Protection Act ("PDPA"), including obtaining your consent for collection where required, and providing access and correction rights on request. Contact hello@excursiv.com. Singapore's Personal Data Protection Commission (pdpc.gov.sg) is the relevant regulator if your concern remains unresolved.

If you're elsewhere in Asia-Pacific

If you're in a jurisdiction with its own comprehensive data protection law, such as Japan's Act on the Protection of Personal Information or South Korea's Personal Information Protection Act, we aim to honor the substance of comparable rights on request, even where we haven't yet built out formal, jurisdiction-specific compliance mechanisms at this early stage of the business. Contact hello@excursiv.com.

If you're in South Africa

Our handling of your personal information is guided by the Protection of Personal Information Act ("POPIA"), including your right to access and correct personal information we hold about you, and to object to processing in certain circumstances. Contact hello@excursiv.com. South Africa's Information Regulator is the relevant authority if your concern remains unresolved.

If you're in India

Excursiv currently operates from India. As India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and its implementing rules come into full operative effect, we intend to comply with its requirements around notice, consent, and your rights as a data principal, including access, correction, and erasure of your personal data, and the right to grievance redressal. In the interim, contact hello@excursiv.com to make a request or raise a grievance. Once the DPDP Act's Data Protection Board is fully operational, it will be the relevant regulator for unresolved complaints.

If you're anywhere else

We'll honor reasonable requests to access, correct, or delete your personal data, made on the same practical basis described throughout this section, even in places where we're not under a specific legal obligation to do so yet. Contact hello@excursiv.com.

Children's privacy

As stated above, the Platforms aren't directed at, or intended for use by, anyone under 16. We don't knowingly collect personal information from children under 16. If we learn we've inadvertently collected it from a child under 16 without appropriate parental or guardian consent, we'll delete it promptly. If you believe a child has given us personal information, contact hello@excursiv.com.

Changes to this policy

We may revise this policy as our practices, our provider network, applicable law, or our corporate structure change, including upon incorporation. We'll update the "Last updated" date at the top when we do. Where a change is significant, such as a change in who's legally responsible for your data, a new category of data we collect, or the introduction of data sale or sharing, we'll give you more prominent notice, such as an on-site banner or a direct email, before the change takes effect, not just a quietly updated date.

A note on who runs this

Excursiv is currently operated by Tanmay Zende, as an individual sole proprietor based in India. Excursiv is not yet a formally registered company. Once it is, this policy will be updated to name the new legal entity, and you'll be notified of the change.

Contact us

Excursiv

Email: hello@excursiv.com

If you're in the EEA or UK and aren't satisfied with our response to a request, you have the right to lodge a complaint with your local supervisory authority. If you're in California, you may contact the California Privacy Protection Agency.

Related Policies