Privacy policy

For information a traveller gives while booking a trip, the operator running that trip decides what is collected and why, and Wandr Labs processes it on the operator's behalf. For operator accounts and for visitors to our own website, Wandr Labs decides and is responsible.

• Operators: name, email, phone, business details, logo and trip content, bank-account details for payouts (held by our payment partner), and how you use the dashboard.
• Travellers: name, phone, email, age and gender for each person on a booking, the trip and date booked, and payment status.
• Documents travellers choose to upload for the operator, such as an ID card, passport or medical certificate. These are stored privately and visible only to the operator of that trip.
• Technical data: pages visited, device and browser type, and approximate location (city) from your IP address, collected through analytics and security logs.
• How a visitor reached a trip page: the ad, post, link or website that sent them. It is saved with any booking or enquiry they make, so the operator can see which of their ads and posts bring bookings. It never includes the visitor’s name, phone or email in our analytics tool.

• To create bookings, take payments, and let operators and travellers see the same details in one place.
• To send the emails that belong to a booking: confirmations, payment receipts, reminders and the verification codes used to sign in.
• To keep the service secure, prevent fraud and fix problems.
• To understand which parts of the product are used, so we can improve it.

We do not sell personal information, and we do not use travellers' details to market to them.

Only the services we need to run the product, each under their own privacy terms:

• Supabase (database, sign-in and file storage, hosted in Sydney, Australia).
• Vercel (website hosting).
• Cashfree Payments (processing and splitting payments).
• Resend (sending email).
• PostHog (product analytics).

The operator of a trip sees the details of travellers booked on it. We may also disclose information when the law requires it.

We keep account and booking records for as long as the operator's account is active and for the period needed for accounting and legal obligations afterwards. You can ask us to delete other information sooner, unless we must keep it by law.

You can ask to see, correct, or delete the personal information we hold about you, and to withdraw consent you gave. A traveller can do many of these directly with their operator through the traveller portal. For anything else, contact us using the details below and we will respond within a reasonable time, as the Digital Personal Data Protection Act, 2023 requires.

Access to data is limited by account, documents are kept in private storage, and sign-in is protected with email verification. No system is perfectly secure, so if you believe your account or data has been exposed, tell us straight away.

We use cookies that keep you signed in and remember your session, analytics that help us see how pages are used, and a cookie on public trip pages that remembers for 30 days which ad, post or link brought you there. You can block cookies in your browser, but sign-in will not work without the essential ones.

Operators and account holders must be 18 or older. Operators may add travellers under 18 to a booking, but the adult making the booking is responsible for giving their details.

We will update the date at the top of this page whenever this policy changes.

Questions about this page, or a request about your data? Write to us through the form on our company page and say which page you are asking about. We reply to every message.