Privacy Policy

1. Data Controller / Responsible Business

Hat Rack is responsible for personal data processed through the platform unless a third-party service, gateway, agency, tour operator, social-login provider, embedded media provider, or other independent service acts as its own controller or equivalent responsible party.

UAE operating address: UAE Address Placeholder

India operating address: India Address Placeholder

2. Personal Data We Collect

The data we collect depends on how you use the platform. We do not require every user to provide every category.

3. How We Collect Data

We collect data directly from you when you register, log in, update your profile, upload a file, post content, save preferences, add an address, join a public feature, submit an author or agency request, create a promotion, add items to cart, make a payment, request a refund, redeem or validate vouchers, contact support, or use account tools.

We also collect some data automatically through cookies, sessions, server logs, browser interactions, security controls, analytics or performance tools, payment workflows, social-login callbacks, embedded content, and vendor integrations. We may receive limited information from payment gateways, banks, card networks, shipping/fulfilment providers, agencies, tour operators, or support vendors where needed for a transaction.

4. User Images, Documents, and Public Uploads

Uploaded images and files may include profile photos, footprint photos, bucket-list images, blog or story images, promotion campaign images, service images, product customization artwork, custom print files, screenshots, identity or license documents for specific applications, and agency or payout documents. We use these uploads to operate the feature you selected, display content, moderate content, generate thumbnails or previews, process print or fulfilment requests, review eligibility, support disputes, and maintain transaction records.

If you choose public visibility for profile, story, review, bucket, footprint, author, or feed content, other users may view, save, follow, interact with, or share links to that content. Spending details for footprint entries may be hidden where the product setting allows, but public travel details, notes, media, and author/profile information can still be visible depending on your choices.

Please do not upload passwords, full card numbers, CVVs, unnecessary identity documents, private addresses, children’s information, health details, or other sensitive material unless a specific secure workflow requires it. We may remove uploads that appear unlawful, infringing, abusive, unsafe, privacy-invasive, or unsuitable.

5. Payments, Gateways, Refunds, and Financial Records

We may use Stripe, Razorpay, configured checkout-zone payment methods, banks, card networks, UPI or netbanking providers, and other payment or finance vendors. These providers may collect and process payment credentials, card details, UPI details, authentication data, fraud-screening data, and payment-device data under their own policies.

We generally store gateway references such as payment intent IDs, checkout session IDs, Razorpay order/payment IDs, verification status, order metadata, refund state, voucher state, settlement records, invoices, receipts, tax details, and support history. We do not intend to store full card numbers or CVV codes on our own servers. Agency bank details and withdrawal records may be stored for payout, verification, tax, accounting, fraud, and dispute-management purposes.

Refund and chargeback records may be retained even after account deletion requests where necessary for legal, accounting, fraud-prevention, tax, gateway, or dispute obligations.

6. Why We Use Personal Data

• Create, authenticate, secure, and manage user accounts.
• Operate profiles, public feeds, stories, comments, follows, reviews, wishlists, bucket lists, footprint maps, passports, and community features.
• Process carts, orders, tours, vouchers, product customization, shipping, invoices, receipts, payments, refunds, fraud checks, and customer support.
• Review and manage author, agency, promotion, wallet, withdrawal, bank, settlement, tax, and staff-permission workflows.
• Remember preferences such as market, currency, distance unit, public-profile visibility, cart state, and UI/session settings.
• Moderate content, investigate abuse, enforce Terms, prevent fraud, protect the platform, and comply with law.
• Improve reliability, diagnose errors, measure feature usage, maintain security, and plan product improvements.
• Send service messages, OTPs, password reset messages, receipts, order updates, support responses, and legally required notices.

7. Legal Bases for Processing

Where applicable law requires a legal basis, we rely on one or more of the following: performance of a contract, steps requested before entering a contract, legitimate interests, consent, compliance with legal obligations, protection of users and the platform, fraud prevention, dispute handling, and establishment or defense of legal claims. Where consent is required, you may withdraw it where the law permits, but withdrawal will not affect processing already completed or processing needed for legal, security, fraud, or transaction reasons.

8. Cookies, Sessions, Local Storage, Analytics, and Ads

We use cookies, sessions, local storage, and similar technologies to keep users signed in, secure forms, remember market and cart choices, operate checkout, prevent abuse, measure performance, personalize platform behavior, and support embedded or third-party services. Advertising and sponsored surfaces may exist in the platform, but this legal page itself does not contain ad slots. Browser or device controls may allow you to block cookies, but some features may stop working correctly.

9. How We Share Personal Data

We may share personal data only as reasonably needed with hosting and infrastructure vendors, payment gateways, banks and card networks, shipping or fulfilment providers, tour operators, approved agencies, email and notification vendors, analytics or performance vendors, social-login providers, embedded media providers, moderation and support tools, tax/accounting advisors, legal advisors, regulators, courts, law enforcement, fraud-prevention partners, and successors in a merger, acquisition, restructuring, or asset transfer.

We may disclose public content according to your visibility settings. We may also disclose information if required by law, to enforce our Terms, to protect rights and safety, to investigate fraud or abuse, to process refunds or chargebacks, or to resolve disputes.

10. International Transfers

Because the platform is global, personal data may be stored, processed, or accessed in the United Arab Emirates, India, the user’s country, and other countries where our vendors, infrastructure, payment providers, support tools, or business teams operate. Where required, we aim to use appropriate safeguards such as contractual protections, access controls, transfer mechanisms, and vendor due diligence.

11. Retention

We retain data for as long as reasonably necessary for account management, feature operation, public content, customer support, order fulfilment, voucher redemption, tax and accounting, agency settlement, fraud prevention, moderation, legal claims, refunds, chargebacks, security, audit trails, and business continuity. Public content may remain visible until removed or restricted. Backups and logs may retain data for a limited additional period.

When a deletion request is approved, we may delete or anonymize account data and user content where feasible, while retaining order, invoice, payment, refund, tax, settlement, fraud-prevention, and legal records where retention is required or reasonably necessary.

12. Security Measures

We use reasonable administrative, technical, and organizational safeguards appropriate to the nature of the platform. Current safeguards include password hashing through the application framework, access roles and permissions for administrative/finance functions, server-side validation for uploads and forms, CSRF protection for web forms, OTP/password reset controls, gateway signature verification, encrypted or protected secrets where configured, logging, and vendor safeguards for payment processing and infrastructure.

No internet platform can guarantee absolute security. You must protect your password, OTPs, email account, devices, payment credentials, and any documents you upload. Please contact us promptly if you suspect unauthorized access or a security issue.

13. Children and Young Users

The platform is not intended for unlawful collection of children’s personal data. Users under 18 should use the platform only with parent or guardian involvement. We do not knowingly invite children to submit payments, identity documents, public travel records, or public posts without appropriate legal authority. If you believe a child has provided personal data unlawfully, contact us for review.

14. Your Privacy Rights

Depending on where you live and which law applies, you may have rights to be informed, access personal data, correct inaccurate data, delete data, withdraw consent, object to certain processing, restrict processing, request portability, opt out of certain marketing, complain to a regulator, or receive information about international transfers and automated decisions.

To make a request, contact the data request email below. We may need to verify your identity and account ownership. We may refuse, limit, or delay requests where permitted by law, including where data is needed for security, fraud prevention, unresolved orders, refunds, chargebacks, tax, accounting, legal claims, settlement records, or protection of other users.

15. Automated Processing and Personalization

The platform may use automated rules to recommend content, sort feeds, remember markets, calculate prices, validate payment status, detect fraud signals, enforce feature limits, apply voucher or promotion rules, and surface public content. We do not intend to make legally significant decisions about users solely through automated processing unless disclosed or permitted by applicable law.

16. Changes to This Privacy Policy

We may update this Privacy Policy to reflect product, legal, security, payment, vendor, or operational changes. The latest version will be posted on this page with the updated date. If a change materially affects how we use personal data, we will provide notice where required by law.

17. Privacy, Data, and Support Contacts