Privacy Policy

Junto Pvt. Ltd ("Junto", "we", "us") operates the Junto platform - a group travel planning and marketplace service available at junto.travel. This policy explains what personal data we collect, why we collect it, and the rights you have over it. Junto Pvt. Ltd is the data controller for the personal data described here.

If you have any question about this policy or your data, contact us at privacy@junto.travel.

What We Collect

Account information. When you create an account we collect your email address and password (stored by our authentication provider in hashed form), or your name, email, and profile photo when you sign in with Google or Apple.

Profile information. Details you choose to add: your display name, avatar, contact number, and optional demographic details (such as age range, gender, and fitness level) used to show anonymized group statistics on trips.

Booking and payment information. When you book a trip we collect the details needed to process the booking. Card payments are processed by Stripe; Junto never stores your full card number.

Content you create. Trip plans, group chat messages, images you share, questions and answers on trips, and reviews.

Usage data. With your consent (see our Cookie Policy), we collect analytics about how the site is used so we can improve it.

Why We Process It

We rely on the following lawful bases under the GDPR:

• Contract - creating and managing your account, processing bookings and payments, running group chat, and providing customer support.
• Consent - sending marketing and promotional emails, and setting analytics or marketing cookies. You can withdraw consent at any time from your profile settings or the unsubscribe link in any marketing email.
• Legitimate interest - keeping the platform secure, preventing fraud and abuse, and enforcing our Terms and Conditions.
• Legal obligation - retaining records we are required to keep, such as payment and tax records.

Marketing Communications

Marketing emails are strictly opt-in. We record when you gave consent, where you gave it (for example at signup or from your profile), and the wording you agreed to, so we can evidence it later. Every marketing email includes an unsubscribe link, and you can also turn marketing updates off under Notifications in your profile settings.

Transactional emails - booking confirmations, payment receipts, password resets, and similar service messages - are sent regardless of marketing preferences because they are part of operating your account.

Who We Share It With

We share personal data only with the processors we need to run the service, under data processing agreements:

• Supabase - database, authentication, and file storage.
• Stripe - payment processing and fraud prevention.
• Resend - transactional email delivery.
• Klaviyo - our customer relationship platform. We sync your account details and activity on Junto (such as trips you save or book) so we can manage your relationship with us and understand how the service is used. If you accept marketing cookies, we also share the pages and trips you view while signed in, so that what we send you reflects what you are actually interested in. We only send you marketing email if you have given us marketing consent, and you can withdraw it at any time in your profile settings.
• Google - analytics (only when you consent to analytics cookies) and sign-in.

We never sell your personal data. Trip hosts see the information needed to run their trip. That is your display name and booking status, and once a host has accepted you onto their trip, the phone number, emergency contact and any dietary needs or allergies you gave at booking, so they can reach you and look after you while you are away. Other travellers never see any of it. Demographic details shown on trip pages are aggregated and anonymized, and are hidden entirely for small groups.

How Long We Keep It

We keep account data for as long as your account exists. Booking and payment records are retained for as long as required by tax and accounting law. Marketing consent records are kept while your consent is active and for a reasonable period after withdrawal so we can evidence past compliance. Chat messages and trip content are removed when the associated account or trip is deleted.

Your Rights

Under the GDPR you can ask us to access, export, correct, or delete your personal data, restrict or object to processing, and withdraw consent at any time. Profile details can be corrected directly from your profile settings.

For access, export, or deletion requests, email privacy@junto.travel from the address on your account. We respond to all requests within 30 days. You also have the right to lodge a complaint with your local data protection authority.

Cookies

We use cookies and similar technologies as described in our Cookie Policy. Nothing beyond strictly necessary cookies is set without your consent, and you can change your choices at any time via the Cookie settings link in the footer.

Changes to This Policy

We may update this policy as the platform evolves. When we make material changes we will update the date at the top of this page and, where the change affects how we use your data, notify you by email or an in-product notice before it takes effect.