Privacy Policy

The short version

1. What you type, and where it goes

To price a booking, the checkout asks for the details the operator's rules actually need:

• the full name of each adult travelling
• each child’s age for a hotel selection; age, height, or both for activities when the selected ticket requires them
• an email address and WhatsApp number for the lead guest

Up to the moment you pay, none of this is transmitted to us. Names, heights and contact details stay in the page’s memory. Hotel searches send adult counts, child ages, room allocation and stay dates directly to our accommodation partner before payment. We do not store those searches in our booking database or browser storage. Reloading or closing the tab discards it.

The group questionnaire is optional. All three choices are required before either the WhatsApp or Telegram button opens a group. Clicking a platform button with missing answers highlights the unanswered questions. A completed questionnaire opens the selected group and keeps both group links available in the pop-up. We send the selected category IDs together only when you complete it, not while you select or change an answer. Completed responses are saved separately from bookings in our backend database, without names or contact details. No partial answers are saved and no answers are written to browser storage. Database saving is separate from analytics and may occur when analytics is disabled. Group links still work if either saving or analytics fails. Previously saved itinerary phone numbers may remain in our records; contact us to request deletion.

When you press the pay button, we send those details to our booking backend, which stores them so we can place your booking and reach you about it. We also pass your name, email, and phone number to our payment provider so they can process the charge and show you a receipt. Apart from the hotel search details described above, we do not send your traveller details to booking partners automatically — we place each booking ourselves and contact you if an operator needs anything more.

2. What happens automatically

Some data moves simply because the page loads.

Our ticketing partner

Your browser requests prices and availability directly from the partner's API. That request carries your IP address, your browser and device type, and which products you are looking at. It happens on page load, before you interact with anything.

Our accommodation partner

Your browser requests hotel rooms, prices and the selected room's photo directly. Requests include the property, stay dates, adults and child ages allocated to each room, and your connection information. These requests happen when a stay loads and whenever the party or a child’s age changes. The room photo loads from a URL returned by that partner, so its image host receives the same connection information. These requests do not include names, heights, email addresses or phone numbers.

Image hosting

Attraction photos load from the partner's image CDN, which sees the same connection information.

Our hosting provider

Standard web server logs — IP address, timestamp, page requested, user agent — kept briefly for security and debugging.

Our analytics provider

Firebase Analytics, a Google service, records that a page was opened and which actions were taken on it. It receives your IP address, from which an approximate country and city are derived rather than stored, along with your device, browser, and screen size — and how you arrived here: the site that linked you, or the campaign tag on the link if it carried one. It sets cookies so a returning browser is not counted as a new person. Section 3 lists every event, and what is deliberately left out of them.

Our advertising providers

Google Ads and Meta. Their tags load on every page so an ad visit can be measured instead of treated as an unrelated visit. Both receive the page address and ordinary connection information such as your IP address, browser and device type, and can set cookies to recognise a browser or an ad interaction and include that browser in an advertising audience. Google is also told when the party step of checkout is reached and the amount then showing in the plan. Meta is told every event listed in section 3, with the same details our analytics tool receives: which trip, which activity, plan and payment amounts, and our own booking reference. Neither receives names or contact details. Meta receives the completed questionnaire’s fixed-choice categories. Section 3 says exactly what each records; Google's advertising controls are at myadcenter.google.com.

Our payment provider

When you reach the traveller-details step, your browser starts loading our provider's payment script so the window opens without a wait; from then they can see your IP address, but nothing you type is sent to them until you press pay. Pressing pay opens a payment window hosted by our provider. They receive your name, email, phone number, and the amount, plus whatever card, UPI, or banking details you enter with them. Those payment credentials go straight to them and never pass through Talking Lobby. They set their own cookies inside that window and apply their own privacy policy and fraud checks.

Our booking backend

Paid bookings are stored in a hosted database and trigger a notification email to us. That record holds the traveller names, any child ages and heights, the lead guest's email and phone number, the activities and dates chosen, the amount, and the payment reference. It does not hold card details.

Group questionnaire records

Google Firebase Firestore stores the three selected category IDs, trip ID, destination, first selected platform, schema version and submission timestamp under a random response ID. These records are separate from bookings and contain no traveller names, contact details or browser analytics identifiers. Only our backend can write them; browser access is denied. A daily aggregate counter limits submissions without storing IP addresses in these records.

Previously saved itineraries

A phone number previously given to the keep-this-trip prompt is stored in the same database as bookings, along with the trip and the selections you had made, and triggers a notification email to us so a person can follow it up. It is not sent to the ticketing partner, the payment provider, or the analytics and advertising tools.

Links you choose to follow

Opening a product page, the creator's Instagram, our WhatsApp support, or a Telegram or WhatsApp group link hands you to that service, whose privacy policy applies. Joining an ordinary WhatsApp group makes your phone number visible to other members. Telegram profile and phone-number visibility depend on its settings and existing contacts. We do not send your questionnaire answers to either group through the invite link, and a link click does not confirm membership.

You can see these connections for yourself in your browser's network inspector. We would rather tell you than have you find out that way.

3. Cookies, storage, and tracking

Our analytics tool sets cookies. They hold a random identifier for your browser — enough to count one returning visitor as one person rather than two, and to see whether a visit that ended in a booking began on Instagram. They carry nothing about who you are.

The Google and Meta advertising tags can set cookies too, holding browser and ad-interaction identifiers so a later visit or checkout can be measured against an ad. They expire on each provider's own schedule and carry none of the traveller details you type here.

These are the events recorded, and they are the whole list:

• a page was opened, and which one
• a trip was opened, and which trip
• the reel was played, or a photo gallery was opened
• the list of what a ticket includes was opened
• a date, time, or ticket option was changed
• an activity was added to or removed from the plan, and how many are in it
• the plan was reviewed, and each checkout step reached, with the total showing at that step
• the lead guest name, email, or WhatsApp number became valid in checkout — once per field per checkout, without sending the entered value
• the pay button was pressed, and whether the payment then succeeded, failed, or was cancelled
• on a successful payment: the amount, the currency, and our own booking reference
• the group questionnaire was shown, whether from an exit signal or after 10 seconds of visible time on a trip page, without requiring scrolling or viewing an activity card (including during checkout), and whether it was dismissed before completion
• the questionnaire was completed, with the trip ID and three fixed-choice categories: planning stage, reason for visiting and booking consideration
• a Telegram or WhatsApp group button or link was clicked after answering the questionnaire, with the trip ID and platform — not confirmation of joining
• a waitlist address was submitted — as a traveller or as a creator, and whether it saved

Meta receives every event in that list, with the same details our analytics tool gets — including which trip and activity it concerns, the totals and payment amount, and our own booking reference. Google Ads receives reaching the party step of the checkout, where you choose who is travelling. The Google event is sent once per visit and carries the plan total as it stands at that moment — the amount and the currency, nothing else. Neither receives traveller names or contact details. Meta also receives the completed questionnaire’s fixed-choice categories.

No traveller name, email address, phone number, child age, or height appears in any of them. Not on the payment event, not anywhere. What comes back to us is counts of actions and the selected questionnaire categories: how many people opened a trip, built a plan, paid, and which choices questionnaire respondents selected.

Beyond those two advertising tags, we use no session recording, no heatmaps, and no other trackers, and we do not sell this data or hand it to anyone but the providers named in section 2. We write exactly one entry of our own to your browser, in session storage: a note under talkinglobby:itinerary-prompt:{routeId} that the group questionnaire has already been shown, so it cannot appear twice in the same visit. It holds only the prompt outcome, no answers or contact details, and your browser discards it when you close the tab. Apart from that, what you type is held in the page's memory and written nowhere.

If your browser or an extension blocks analytics or either advertising tag, the whole site still works and we make no attempt to get around the block. Google also publishes a browser add-on that turns analytics off everywhere, at tools.google.com/dlpage/gaoptout, and personalised ads can be managed through each provider's account controls.

The payment window sets cookies of its own, for security and fraud prevention, which is what makes a card payment safe to accept. Other third parties your browser contacts may also set theirs under their own policies, and your browser's blocking settings apply to those as normal.

4. Why we use what we use

• Traveller details — before payment, to work out which ticket category each person falls into and what the trip costs, in your browser only. After payment, because operators require the names, ages, and heights of the people being ticketed.
• Contact details — to send your tickets and to reach you if an operator changes or cancels something.
• Payment records — to take the payment, place your booking, issue refunds, and meet the record-keeping and tax obligations that come with accepting money.
• Group questionnaire answers — to understand travel readiness, visitor intent and booking considerations so we can improve the product. We record predefined categories, not free text or contact details.
• Connection data — to serve the page, load images, fetch prices, and keep the site secure.
• Analytics — to know whether anyone is finding the site, which trips they open, and where they give up, so the product can be fixed. Counts in aggregate, and not used to profile you.
• Advertising measurement — to know whether the ads we pay for bring anyone to the site or to checkout, and to show our ads to people who have been here. This is the one place your visit is connected to something outside the site; it still involves nothing you typed.

5. Children's information

Some tickets price by a child's age or height, so the checkout asks for them. That information is used purely to pick the right ticket category and, like everything else, stays in your browser.

Talking Lobby is meant for adults planning family travel, not for children to use. Please do not enter more about a child than the ticket rules require.

6. How long anything is kept

If you do not pay and give us no number: we keep no booking or contact record. Short-lived server logs and analytics events, including completed questionnaire categories and browser identifiers, may remain on our analytics and advertising providers' retention schedules. Questionnaire choices held by the page disappear when it is reloaded or closed; completed response records remain in our database for product research until no longer needed and are not automatically deleted on reload.

If you gave a phone number to keep a trip: we hold that number, the trip, and the selections you had made until you ask us to delete them. It is not joined to any browsing record, and it creates no account or login.

If you do pay: we keep the booking record. Financial records have to be retained for several years under Indian tax law, so we cannot delete a paid booking on request, though we can remove details that are not part of that record. Our payment provider and the ticketing partner keep their own copies under their own retention policies.

7. Your rights

Indian data protection law, and comparable law elsewhere, gives you rights to access, correct, and erase your personal data, to withdraw consent, and to complain to a regulator.

If you never paid and never gave us a number, we hold no booking or contact record for you. Completed questionnaire database records use random response IDs and are not linked to your booking or contact details. Questionnaire analytics are associated with provider-managed browser identifiers; the controls in section 3 apply, and you can contact us with questions about those records. If you gave a number to keep a trip, message us and we will tell you what is held against it and delete it on request. If you did pay, we hold your booking record: message us and we will send you a copy, correct anything wrong, and delete whatever is not legally required to be kept. Card details are not ours to hand over, since they only ever existed with our payment provider.

8. Security

The site is served over HTTPS, and connections to the partner's and provider's systems are encrypted in transit. Card, UPI, and banking credentials are entered inside our payment provider's own window and never touch Talking Lobby's systems, so there is nothing of that kind for us to leak. Booking records are held in a database that only our backend can read — no browser can query it. No method of transmission over the internet is completely secure.

Treat anything you type into a shared or public device as visible to the next person using it, and close the tab when you are done.

9. Transfers outside India

The services your browser connects to — the ticketing partner, the image CDN, our payment provider, our analytics and advertising providers, our hosting provider, the database holding paid bookings, and Telegram or WhatsApp when you follow a group link — may process requests on servers outside India. Those transfers are inherent to the site working at all.

10. Changes to this policy

Talking Lobby changes as the product develops. If we add accounts, add another tracker, or change what we keep, this page will be updated first and the change flagged on the site.

11. Contact

Questions about privacy, or about a specific booking: message us on WhatsApp at 8105555895.