Privacy Policy

1. Introduction & Overview

Welcome to Antaraa ("Antaraa", "we", "us", or "our"). We operate the experiential retreat sanctuary and digital platform accessible at www.antaraatheretreat.com. We are deeply committed to honoring your digital privacy with the same sacred intentionality that guides our experiential retreats.

This Privacy Policy outlines how we collect, process, store, and safeguard your Personal Data in compliance with global data protection standards, including the General Data Protection Regulation (GDPR) and the Digital Personal Data Protection Act, 2023 (India DPDP Act).

2. Information We Collect

Due to the deeply transformative, residential nature of our retreats, we collect specific categories of information when you interact with our website, submit an application, or participate in our programs:

• Identity & Contact Data: Full legal name, age, gender, nationality, residential city/country, email address, phone number, and WhatsApp contact details.
• Application & Wellbeing Disclosures: Personal reflections, intentions for attending, background in mindfulness or therapy, physical limitations, emotional readiness disclosures, and specific dietary or lifestyle preferences voluntarily provided during the vetting application.
• Transactional & Reservation Data: Reservation tier selected, deposit amounts, transaction references, billing address, and payment confirmation status. (Note: We do not store full credit card or banking details directly; all payments are processed via our PCI-DSS Level 1 certified partner, Razorpay).
• Technical & Analytical Data: Anonymized IP addresses, browser specifications, operating system, and navigation patterns gathered through strictly controlled session cookies.

3. How We Use Your Information & Lawful Basis

We process your personal information under the following lawful bases:

• Consent: When you voluntarily submit an application questionnaire, subscribe to communications, or consent to optional analytical cookies.
• Performance of a Contract: To review your retreat candidacy, issue invitation links, process payments, reserve your suite, and provide retreat experiences.
• Vital Interests & Duty of Care: Reviewing health disclosures and emergency contact details to ensure participant safety and emotional containment during breathwork, cold exposure, and deep meditation.
• Legitimate Interests: Maintaining platform security, defending against automated spam or DDoS attacks, and refining retreat curations.

4. Cookies & Tracking Technologies

We use minimal cookies and local storage tokens strictly necessary for website operation, security verification, and remembering your privacy choices. We classify cookies into:

• Essential Cookies: Critical for navigation, preventing CSRF attacks, and securing access to the guest portal. These cannot be disabled.
• Analytical Cookies: Optional, aggregated performance metrics used solely to understand site performance without tracking individual identity across external websites.

You may adjust or revoke your cookie consent at any time by clicking the "Cookie Preferences" link in our website footer.

5. Third-Party Partners & Data Sharing

We do not sell, rent, or monetize your personal data. We disclose your information strictly to verified service providers under contractual confidentiality agreements:

• Razorpay Software Private Limited: For secure, tokenized payment processing.
• Supabase Inc.: For encrypted cloud database hosting with row-level security protocols.
• Facilitator & Clinical Guides: Dr. Krunal, Shelly Grover, Nishtha, and Dhwani review relevant application intentions under strict medical and ethical non-disclosure standards.
• Legal & Regulatory Authorities: Only when legally mandated by Indian law or judicial summons.

6. Data Security & Retention

We employ modern encryption standards (TLS 1.3 in transit, AES-256 at rest) and strict role-based access controls to safeguard your data. Application submissions and health disclosures are securely retained only for the duration necessary to curate your retreat and for statutory tax compliance periods (typically 7 years for financial records under Indian income tax regulations), after which they are permanently deleted or irreversibly anonymized.

7. Your Rights (GDPR & India DPDP Act)

Depending on your jurisdiction, you hold substantial rights regarding your personal data:

• Right of Access & Summary: Request a copy of the personal information we hold about you.
• Right to Correction & Erasure: Request rectification of inaccurate information or deletion of your personal records.
• Right to Withdraw Consent: Revoke consent previously granted for optional processing.
• Right to Grievance Redressal: Lodge a query or concern with our designated Data Protection Officer.