Privacy Policy

1. Data we collect

We collect information in three ways: information you provide directly, information collected automatically when you use the Service, and information received from service providers (such as your bank or your mobile carrier) where strictly necessary.

Account information: mobile number, display name, email (optional), profile photo (optional).

Provider information: role (car owner / bike rider), KYC documents (Aadhaar, PAN, driving licence, address proof), selfie, vehicle information (make, model, registration number, registration certificate, insurance, fitness, PUC and other legally required documents).

Commute information: routes you publish or purchase, pickup and drop points, days-of-week, attendance (Going / Delayed / Not Going), daily timestamps, ratings you give or receive.

Safety information: SOS events (pin, timestamp, status, response history), incident reports you submit, emergency contact details you choose to register.

Device & usage information: device model, OS version, app version, IP address, crash logs, Firebase notification token.

Payment information: transaction identifiers, amounts, GST components, last 4 digits of the payment instrument (where supported by the gateway), gateway status. We do not store full card numbers, CVV, full UPI IDs or bank account credentials.

Fraud & security information: failed login attempts, suspicious IP signals, suspension records, audit log entries. Retained as required to protect the Service and other users.

2. Why we collect it

We use this information to:

• Operate the Service — matching, Platform Fee subscriptions, Ride Wallet reservations, attendance, backup assignment.
• Verify provider identity, vehicle documents and KYC at onboarding and on renewal.
• Power safety features — SOS, emergency contact notifications, incident response.
• Detect and prevent fraud, abuse and security incidents.
• Comply with legal obligations under Indian law (IT Act, 2000, Consumer Protection (E-Commerce) Rules, 2020, GST law, applicable transport rules).
• Improve the Service via aggregated, de-identified analytics.
• Send you operational notifications (commute day, backup assignment, document expiry, payment receipt, safety alert).

3. Sensitive personal data

Under the IT (Reasonable Security Practices) Rules, 2011, certain identifiers are classified as "Sensitive Personal Data or Information" — including Aadhaar / PAN, biometric data, and precise location. We collect and use these only as needed for KYC verification and safety:

• Aadhaar / PAN: stored using a one-way salted hash. Original values are not retrievable by staff and are not displayed in the application.
• Selfie: compared against the uploaded ID document. Used only for verification and not retained after verification unless required by audit.
• Driving licence number: hashed in storage; only the masked form (e.g. DL-04-****1234) is shown.
• Precise location: collected only while a trip is active or an SOS is triggered. Background location is not requested.

Access to sensitive personal data is restricted to authorised personnel handling verification and fraud review, with every access recorded in the audit log.

4. Location data

With your permission, we collect precise location data only:

• while a trip is active — to display pickup, drop, live ETA and route tracking;
• during an SOS event — to share your live pin with the safety desk and your emergency contacts;
• during provider-side attendance confirmation — to validate the pickup point.

Background location is not requested. You can disable location permission at any time in your device settings, though doing so may limit ride-tracking and SOS functionality.

5. Payment data

Payments are processed by Razorpay and Cashfree, both RBI-licensed payment aggregators. We do not store full card numbers, CVV, full UPI IDs or net-banking credentials. We store the transaction identifiers, amounts, GST components and last-4-digits returned by the gateway, sufficient for refunds, reconciliation and tax compliance.

6. Service providers (processors)

We share information only with the following categories of processors, each bound by appropriate contractual terms:

• Payment processors: Razorpay, Cashfree (transaction + amount + UPI/card token).
• Cloud infrastructure & storage: for application hosting and signed-URL document storage.
• Push notifications: Firebase Cloud Messaging (device token + alert payload only).
• Maps: for geocoding, route distance and ETA calculation. We send origin / destination / waypoint coordinates; we do not send your live trip location to maps providers beyond the active trip.
• SMS / OTP delivery: for one-time-password login and emergency-contact notifications.
• Audit / observability: for security monitoring; access limited to authorised engineers.

7. When we share

We do not sell your information. We share information only:

• with other platform users as needed to operate a trip (e.g. your driver sees your pickup name; co-riders see your first name and avatar only);
• with the payment gateways listed above;
• with cloud and storage providers under confidentiality and security terms;
• with law enforcement or regulators when required by valid legal process.

8. Cookies & analytics

The public marketing site uses minimal cookies / local storage: a theme-preference flag (light / dark mode) and standard CSRF tokens. The mobile application does not use third-party advertising trackers. We do not currently use third-party analytics on the marketing site; if introduced, we will update this policy and seek consent where required by law.

9. Security

We use reasonable security practices and procedures as defined under the IT (Reasonable Security Practices) Rules, 2011 — including TLS in transit, AES-256 encryption at rest for sensitive fields, salted hashing of identifiers (Aadhaar / PAN / driving licence), role-based access control, audit logging of all data access, and periodic third-party security review.

No system is perfectly secure. If we become aware of a breach affecting your data, we will notify you and the relevant authorities as required by Indian law.

10. Retention

We retain personal data for as long as your account is active plus the period required by applicable law — typically 7 years for financial records, longer where required by ongoing investigation or audit. KYC data is retained for the duration of the provider relationship plus the legally required period, then securely deleted. Audit-log entries are retained for at least 7 years.

11. Your rights

Subject to applicable law, you have the right to access, correct, port or delete your personal data, withdraw consent for optional processing, and file a complaint with our Grievance Officer (see Section 14) or the appropriate authority.

To exercise these rights, write to admin@travelsathi.online. We respond within 30 days. Identity verification may be required before disclosing sensitive personal data.

Account deletion: you may request account deletion at any time. We will delete personal data within 30 days, except records we are required to retain (financial, audit, fraud-investigation records).

12. Children

The Service is not directed at children under 18. We do not knowingly collect personal data from children. If you believe a child has registered, write to admin@travelsathi.online and we will delete the account.

13. Cross-border transfers

Personal data is primarily processed in India. Where a sub-processor stores data outside India (e.g. global cloud regions), we require equivalent contractual protection as required by Indian law.

14. Grievance officer

In accordance with the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the Consumer Protection (E-Commerce) Rules, 2020, our Grievance Officer can be contacted at grievance@travelsathi.online. Acknowledgement within 48 hours, resolution within 30 days.

15. Changes

We will update this Privacy Policy when we change our practices. Material changes will be notified by email or in-app at least 14 days in advance. The "Last updated" date at the top of this page reflects the most recent change.