Privacy Policy

This policy explains what YarBal Private Limited (“we”, “us”), trading as Yarbal at yarbal.me and kashmir.pi, does with your personal data. We are based at Qamarwari, Srinagar, Jammu & Kashmir, India.

What we collect

When you make a booking or enquiry: your name, email address, telephone number, travel dates, number of travellers, and anything you choose to tell us in the notes field — which may include dietary requirements, mobility needs or medical information relevant to altitude. You decide how much of that to give us; some of it we genuinely need in order to keep you safe on a mountain.

When you sign in with Pi: your Pi user identifier (uid), your Pi username, and — if you grant that scope — your wallet address. These are returned to us by the Pi Platform after you authorise it. We verify them server-side against Pi's API.

When you pay in Pi: the payment identifier and the blockchain transaction id. Note that the Pi blockchain is a public ledger and we do not control it.

Automatically: ordinary web server logs, including IP address and request times, kept for security and abuse prevention.

We store your itinerary, theme, currency and season preferences in your browser's local storage. That never leaves your device and you can clear it at any time.

What we never collect

We never receive, see, or store your Pi wallet keys, passphrase or seed. Payment authorisation happens entirely inside the Pi Browser and the Pi Wallet. We can request a payment; only you can approve one. Nobody at Yarbal can move funds from your wallet, and any message claiming otherwise is a fraud attempt.

We do not collect payment card numbers. Card and bank payments, where offered, are handled by a payment provider and we see only the outcome.

Why we hold it

• To perform the contract — we cannot book a houseboat without giving them a name.
• To keep you safe — dietary, medical and altitude information passed to the guide who needs it.
• Legal obligation — tax records, and any guest register a property or the authorities require.
• Legitimate interest — preventing fraud and abuse of the booking system.
• Consent — the seasonal newsletter, and nothing else. One click unsubscribes.

Who we share it with

Only the specific suppliers your itinerary requires: the houseboat, hotel, homestay or camp you are staying at; the guide and driver assigned to you; and any permit authority for restricted areas such as Gurez and Tulail, where sharing identity details is a legal condition of entry.

We also use the Pi Platform for authentication and payments, and our hosting and email providers as processors.

We do not sell your data. We do not share it for advertising. We do not use third-party advertising or analytics trackers on this site.

Where it is stored, and for how long

Booking records are held for as long as the booking is live and afterwards for the period Indian tax law requires. Enquiries that do not become bookings are deleted within 24 months. Server logs are kept for a short operational period.

Our servers may be located outside India. Where data is transferred internationally we take reasonable steps to ensure it is protected to a comparable standard.

Your rights

Under the Digital Personal Data Protection Act, 2023, and — if you are in the UK or EU — under the UK GDPR / GDPR, you may ask us to:

• give you a copy of what we hold about you;
• correct anything inaccurate;
• delete your data, where we are not legally required to keep it;
• stop using it for a particular purpose, including marketing;
• nominate someone to exercise these rights on your behalf.

Write to privacy@yarbal.me. We will respond within 30 days. There is no charge. Our grievance officer is Najam Gul, contactable at the same address. If you are not satisfied with our response you may complain to the Data Protection Board of India, or to your local supervisory authority.

Children

This site is not intended for children. Where a booking includes travellers under 18, we deal with the adult making the booking, who is responsible for the information they give us about them.

Security, honestly stated

We use HTTPS throughout, we verify Pi authentication tokens server-side rather than trusting the browser, and access to booking data is restricted to the people running the business. No system is perfectly secure, and we will not claim otherwise. If we become aware of a breach affecting your data we will tell you and the relevant authority as the law requires.

Changes

If we change this policy materially we will update the date at the top and, for anything significant, tell customers with a live booking by email.