Privacy
Policy.

We collect only what we need in order to understand and answer you. In practice, that means:

• —Identity and contact details. Your name, email address and mobile number, as you enter them.
• —Travel and enquiry details. When you use an enquiry form or the “Get Prices” button on a stay card, we collect the details you share — the stay or experience you are interested in, your travel dates, number of travellers or visitors, trip budget and preferred location.
• —Partnership details. When you enquire about partnering with us, we collect your full name, base location, the partnership option and interest area you select, and the free-text description you write about yourself or your property.
• —Correspondence. Copies of the messages you send us — enquiry emails and our replies — are kept in our team mailbox so we can continue the conversation.
• —Technical information collected automatically. Our servers and hosting provider may record your IP address, browser type and version, device and operating system, referring and pages viewed, and the approximate time of your visit. This is standard web-server logging used to keep the site secure and understand which pages are useful.
• —Cookies. A small set of strictly necessary cookies — see section 9.

• —Directly from you, when you fill in the travel enquiry form on our homepage, use the “Get Prices” form on a stay card, submit the partnership form, or write to us by email.
• —Automatically, through standard server logs and hosting-provider security features when you browse the site.
• —From our team members, who record details of the journey they arrange for you when you become a client.

• —To respond to your enquiry and prepare the itinerary or proposal you asked for.
• —To share pricing, availability and logistics for the stay or experience you are interested in.
• —To manage an ongoing relationship with you, including bookings, changes and cancellations.
• —To evaluate and respond to partnership, guide, investor or influencer enquiries.
• —To keep our website secure, prevent abuse, and diagnose technical faults.
• —To understand, in aggregate, how the site is used so we can improve it.
• —To meet our legal, tax and regulatory obligations.
• —To send you updates about your own enquiry. We do not send marketing or promotional emails unless you have asked to receive them, and you can opt out at any time by writing to connect@terracultr.com.

• —We do not sell, rent or trade your personal information to anyone.
• —We do not share it for cross-context behavioural advertising, and we run no advertising or cross-site tracking technologies.
• —We do not use your information for automated decision-making or profiling that produces legal or similarly significant effects.

We rely on your consent when you submit a form, which you may withdraw at any time by writing to us. Where consent is not the basis, we rely on our legitimate interest in responding to you and operating a secure website, on the performance of a contract we have entered into with you, or on compliance with a legal obligation. If you visit us from the European Union, the United Kingdom or another jurisdiction with its own data protection law, you may in some cases have additional or different rights — see section 12.

We share your personal information only with the service providers who help us operate this site, and only to the extent needed for them to do their job:

• —Cloudflare — hosting and content delivery of the website, including security and abuse protection.
• —Neon — our managed database provider, which stores the site content we publish (stays, images metadata and similar content).
• —Resend — our email delivery provider, used to carry your enquiry to our team and our replies to you.
• —Clerk — our authentication provider for the Terracultr content management dashboard. It applies only to our internal administrators and never to visitors browsing the public site.
• —Cloudinary — our image hosting provider, which serves the property and destination photography shown on the site.
• —Property owners, guides and partners we work with — but only where necessary to deliver a journey you have asked us to arrange, and only the details that arrangement requires.
• —Law enforcement, courts or regulators, where we are legally compelled to disclose.

Each of these providers acts under a contract that restricts how they may use personal information we pass to them. Where a provider processes personal information on our behalf, we take reasonable steps to ensure it is handled consistently with this policy.

Some of our service providers process information on servers located outside India. Where that happens, transfers are made in accordance with applicable law and with appropriate safeguards. If you have questions about where your information physically resides, contact us and we will tell you what we can about the providers involved.

• —Enquiry and correspondence records are kept in our team mailbox for up to 24 months after our last interaction with you, so we can answer follow-up questions and resolve disputes. If you become a client, records connected to the journey we arrange for you are kept as long as needed to deliver it and as required for tax and accounting purposes.
• —Server and security logs are kept for a short, limited period — no longer than 90 days.
• —Partnership enquiries are kept while the conversation is active and for a reasonable period afterwards.

We keep cookies to the minimum the site needs to work. We use no advertising cookies, no cross-site behavioural tracking and no analytics profiling of individual visitors.

• —Strictly necessary cookies — used by the site to function securely. The public site sets none beyond what hosting security requires.
• —Authentication cookies — set only for signed-in team members using the content management dashboard, through our authentication provider. Visitors browsing the public site are not signed in and are not issued these cookies.

You can control or delete cookies through your browser settings at any time. Blocking strictly necessary cookies may prevent parts of the site (such as administrative sign-in) from working. Because the public site does not use advertising or tracking cookies, no separate cookie consent is required for browsing it today; if that changes, we will ask for your consent before any non-essential cookies are set.

The public site is served over HTTPS. Administrative access to our content management dashboard is restricted to authorised team members and protected by role-based authentication. Access to the database used by public pages is read-only, and each provider we use applies its own security controls under the contract we hold with it. These measures are proportionate to the nature of the information we hold, but no method of transmission or storage is completely secure. If a personal data breach affects you, we will notify you and the relevant authorities as required by applicable law. If you believe your information has been compromised, please tell us immediately at connect@terracultr.com.

Subject to the law, you have the right to:

• —Ask what personal information we hold about you and get a copy of it.
• —Have inaccurate or incomplete information corrected.
• —Have your information erased, where we no longer need it.
• —Withdraw consent at any time, without affecting processing carried out before withdrawal.
• —Restrict or object to the way we use your information, and ask us to stop using it for a purpose it is no longer needed for.
• —Where the law grants it, receive your information in a portable, machine-readable format.
• —Opt out of any marketing communications — we will not send them again once you have told us to stop.
• —Nominate someone to exercise these rights on your behalf, in the event of death or incapacity.
• —Raise a grievance with us, and receive a response within the time prescribed by law.

To exercise any of these rights, write to us at connect@terracultr.com with the subject line “Privacy Request”. We will verify the request comes from you (or your nominee), acknowledge it and respond within the period required by applicable law. Requests are free of charge; we will never treat you differently for making one.

If you are in the European Union or the United Kingdom, you may also lodge a complaint with your local data protection supervisory authority. If you are a California resident, you have the right to know what personal information is collected about you, to request its deletion, and to opt out of its sale or sharing — we do not sell or share personal information, so there is nothing to opt out of, and you will not be discriminated against for exercising these rights. If you are in India, you may escalate an unresolved grievance to the Data Protection Board of India.

Even when a deletion request is made, we may be required or permitted to retain certain information — for example, records needed to establish or defend legal claims, to comply with tax and accounting law, or where a longer retention period is required by a competent authority. Where we retain information after a deletion request, we will keep it only for that purpose and no longer.

Our site and services are intended for adults. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, contact us and we will delete it promptly.

We may update this policy from time to time, for example to reflect changes in our services or in the law. The “last updated” date at the top of this page always reflects the current version. If a change is material — for example, a new purpose or a new category of data — we will announce it clearly on the site before or when it takes effect. If you have an active enquiry with us at that time, we will also write to you at the email address you have given us.

Questions, access requests, corrections, deletions and grievances are all handled by the same address. Write to us at connect@terracultr.com with the subject line “Privacy”, and we will acknowledge your message and respond within the period required by applicable law.

Our Terracultr Grievance Redressal Desk handles privacy grievances first. If you are not satisfied with our response, you may escalate the matter to us at the same address, or approach the relevant data protection authority in your jurisdiction.

This policy takes effect as of 3 October 2026 and is governed by and construed in accordance with the laws of India, and the courts of India have exclusive jurisdiction over any dispute arising out of or in connection with it.