SurkleS is run by Surkles, C-1/3 Navijivan Society, GIDC, Ankleshwar, Gujarat 393002, India. We are the data fiduciary for the traveller app and the processor for the records that agencies, hotels and employers keep about their own clients and staff. Privacy questions: contact@surkles.in.
Grievances. Until a grievance officer is named on registration, the founders handle grievances at contact@surkles.in. We acknowledge a grievance within 48 hours and resolve it within 30 days. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.
Items marked sensitive are collected only when you enter them yourself, or when an agency, hotel or employer you are linked to adds them for its own records. You can remove what you entered at any time, and ask us or that business to remove the rest.
Email and password, or a Google sign-in identity. Purpose: your account.
Phone, passport, visa, Form C details, flight, train or PNR, hotel and room, care notes. sensitive Purpose: the agency's or hotel's duty of care during your trip or stay. The agency or hotel is the data fiduciary for these records; SurkleS processes them on its instructions.
Images or PDFs of identity documents that an agency or hotel uploads, with a log of who opened them and when. sensitive Stored privately, with no public links: a file opens through a link that expires after one minute.
Messages with your agency, hotel or circle; community posts and replies; fare reports; circle membership; trip plans.
City Pulse, cost hints, journey estimates, the safety report and the in-app assistant use an AI model (Google Gemini). The city you pick, the trip details for an estimate, and the questions you type to the assistant are sent to the model to produce an answer. Answers can be wrong; they are information, not professional, medical or legal advice. We do not use your data to train AI models.
Website visits: surkles.in uses Cloudflare Web Analytics to count page views. It uses no cookies and does not track you across other sites.
No advertising SDK, no third-party advertising cookies, no contact-list upload, no background location for travellers, no location for workers outside a shift.
If you buy a plan: the plan, the amount, the date, the payment status and Razorpay's reference numbers for the payment and any subscription. We use them to switch your plan on and off, send reminders, handle refunds and keep the tax records the law requires. We never receive your full card number or your UPI PIN.
These service providers process data for us, only to run SurkleS. Some of them process data outside India, only for the purpose shown.
| Provider | What it receives | Why |
|---|---|---|
| Supabase (Mumbai region) | All stored data | Database, sign-in, file storage |
| Cloudflare | Your requests to surkles.in and app.surkles.in (IP address, browser); on surkles.in, each page view (the page, the site you came from, your browser, country and load time) | Hosting the website and the app; security; counting website visits |
| Razorpay | Your name, email, phone and the payment details you enter in its checkout; the plan and amount | Taking payments, UPI AutoPay and card mandates, receipts and refunds. Card numbers and UPI PINs go to Razorpay and your bank, never to us |
| Lovable | The traveller app build; AI requests in transit | Hosting the traveller app; routing AI requests |
| Google Gemini (through the Lovable AI gateway) | The city for a brief, trip details for an estimate, assistant questions | AI features |
| Google Maps Platform (Routes, Geocoding, Places) | Addresses, place names and coordinates you search or add | Planner, route map, nearest services, worker routes |
| OpenFreeMap | Your IP address and the map area you view | Map tiles |
| OpenStreetMap services (Nominatim, OSRM) | An address or coordinates being looked up; the start and end of a road segment | Finding places on the map; drawing worker routes along roads |
| Google (sign-in) | Your Google identity, if you choose it | Sign-in |
| GoDaddy (email) | Your email address and the message | Sign-up, sign-in and password emails |
| Google Fonts, Unsplash | Your IP address when a page loads a font or a picture | Typography and photos |
No data is sold. No data is shared with advertisers. Agencies and hotels see only the travellers who linked to them; circles see only what a member shared with that circle. We disclose data to authorities only when Indian law requires it.
You can access, correct and erase your data, withdraw consent, nominate someone to act for you, and raise a grievance.
| Data | Kept for |
|---|---|
| Account and profile | Until you delete the account (backups: up to 7 more days) |
| Activity events | 90 days |
| Payment records and invoices | As long as Indian tax and accounting law requires, even after the account is deleted |
| Worker route points | The employer's setting, 30 to 365 days |
| Document access log, worker access log | 1 year |
| Live and Trail shares | Until the time you chose or until you stop; trail points are deleted after 48 hours |
| Messages and community posts | Until deleted by you or the account is deleted |
| Cached map and AI results (not personal) | Up to 90 days |
SurkleS is for people aged 18 and over. We do not knowingly collect data from anyone younger; if you think we have, write to us and we will delete it.
Row-level security in the database, secrets kept on the server, private file storage, documents masked on screen, access logged. No system is perfectly secure. If a breach affects you, we will tell you and the Data Protection Board of India as the law requires.
Changes are announced in the app and on this page, with a new version and date. Write to contact@surkles.in.