🔒 Privacy Policy

Last Updated: July 18, 2026

1. Information We Collect

1.1 Information You Provide Directly

Data Type	Examples	Purpose
Account Information	Name, email, phone number, password	Create and manage your account
Profile Information	Profile photo, gender, date of birth, bio	Display your profile to other users
Verification Documents	Aadhaar card, PAN card, Driving License	Verify your identity and enable ✓ badge
Vehicle Information	Make, model, year, photos, license plate	Display vehicle listings
Payment Information	Card last 4 digits, UPI ID, bank details	Process payments (full card data handled by Razorpay/Stripe)
Communication Data	Messages, reviews, ratings, support tickets	Enable user communication and support

1.2 Information Collected Automatically

• Location Data: GPS coordinates during active bookings for navigation, verification, and safety
• Device Information: Device type, OS version, app version, unique device ID
• Usage Data: Pages viewed, features used, time spent, search queries
• Log Data: IP address, browser type, access times, crash reports
• Cookies: Session cookies for authentication and preferences

1.3 Information from Third Parties

• Payment Processors: Transaction status, payment method from Razorpay/Stripe
• Social Media: Profile data if you sign in via Google/Facebook (optional)
• Public Sources: Verification of government IDs (Aadhaar, PAN)

2. How We Use Your Information

2.1 Core Services

• Create and manage your account
• Process bookings and payments
• Enable communication between Customers and Providers
• Verify identity and documents for safety
• Track GPS location during trips for navigation and proof
• Send booking confirmations, OTPs, and trip updates

2.2 Safety & Security

• Detect and prevent fraud, abuse, and illegal activity
• Verify OTP and GPS data for refund decisions
• Monitor service quality (punctuality, vehicle condition)
• Investigate disputes and provide customer support
• Comply with legal obligations and law enforcement requests

2.3 Improvement & Personalization

• Analyze usage patterns to improve the Platform
• Personalize search results and recommendations
• Send relevant notifications (nearby rides, price drops)
• Develop new features based on user feedback

2.4 Communication

• Send transactional emails (booking confirmations, receipts)
• Send service updates (new features, policy changes)
• Send promotional offers (opt-out anytime)
• Respond to support inquiries

3. How We Share Your Information

3.1 With Other Users

Shared With	What They See	When
Providers (when you book)	Name, phone, profile photo, pickup location	After booking confirmed
Customers (when they book your vehicle)	Name, phone, profile photo, ratings	After booking confirmed
Public (vehicle listings)	Vehicle photos, description, pricing, Provider first name only	When vehicle is listed

3.2 With Service Providers

We share data with trusted third parties who help us operate the Platform:

• Payment Processors: Razorpay (India), Stripe (International) - for payment processing
• Cloud Hosting: Firebase, Supabase - for data storage and app functionality
• SMS Providers: For sending OTPs and booking notifications
• Email Services: For transactional and promotional emails
• Analytics: Firebase Analytics (anonymized usage data)

These providers are bound by confidentiality agreements and can only use your data as instructed by us.

3.3 For Legal Reasons

We may disclose your information if required to:

• Comply with laws, regulations, or court orders
• Respond to government or law enforcement requests
• Enforce our Terms & Conditions
• Protect our rights, property, or safety
• Prevent fraud or illegal activity
• Protect user safety in emergencies

3.4 Business Transfers

If VaultWheels is acquired, merged, or sold, your information may be transferred to the new owner. We will notify you before this happens.

4. Data Security

4.1 How We Protect Your Data

• Encryption: Data encrypted in transit (HTTPS/TLS) and at rest (AES-256)
• Access Control: Only authorized employees can access personal data
• Payment Security: PCI-DSS compliant payment processing (we don't store full card details)
• Password Hashing: Passwords stored using bcrypt hashing
• Secure Servers: Hosted on Firebase and Supabase with enterprise-grade security
• Regular Audits: Security reviews and vulnerability scans

4.2 Your Responsibility

• Keep your password secure and don't share it
• Log out from shared devices
• Enable two-factor authentication (if available)
• Notify us immediately if you suspect unauthorized access

5. GPS & Location Tracking

5.1 When We Track Your Location

• During Active Bookings: GPS tracked for navigation, safety, and verification
• For Search: Current location used to show nearby vehicles (optional)
• For Photos: Location embedded in photos for refund verification

5.2 When We DON'T Track

• When you're not using the app (no background tracking)
• When you're logged out
• When location permissions are disabled

5.3 Control Your Location

• Deny location permission (some features may not work)
• Enable only while using the app
• View location history in account settings
• Request deletion of location data

6. Cookies & Tracking Technologies

6.1 What Cookies We Use

Cookie Type	Purpose	Duration
Essential Cookies	Authentication, session management	Session/Persistent
Analytics Cookies	Usage statistics, performance monitoring	Persistent (1 year)
Preference Cookies	Remember your settings (language, currency)	Persistent (1 year)

6.2 Control Cookies

• Manage cookies in your browser settings
• Disable non-essential cookies in app settings
• Note: Disabling essential cookies may break functionality

7. Your Rights & Choices

7.1 Access & Portability

• View Your Data: Access your profile, bookings, and activity from account settings
• Download Your Data: Request a copy of all your data (JSON format)
• Response Time: Within 30 days of request

7.2 Correction & Update

• Update profile information anytime from account settings
• Contact support to correct inaccurate data

7.3 Deletion

• Delete Account: Request account deletion from settings
• What Happens: Profile deleted, personal data anonymized
• What Stays: Transaction records (required by law for 7 years), anonymized analytics
• Note: Deletion is permanent and cannot be undone

7.4 Marketing Communications

• Opt out of promotional emails (unsubscribe link in every email)
• Disable push notifications in app settings
• You'll still receive transactional messages (booking confirmations, receipts)

7.5 Restrict Processing

• Request that we limit how we use your data
• May affect your ability to use certain features

8. Children's Privacy

VaultWheels is not intended for users under 18 years of age. We do not knowingly collect information from children.

• If we discover a child's account, we will delete it immediately
• Parents: Contact us if you believe your child has provided information

9. Data Retention

9.1 How Long We Keep Your Data

Data Type	Retention Period	Reason
Account Information	Until account deletion	Provide service
Transaction Records	7 years	Legal requirement (tax, audit)
GPS Location Data	90 days after trip	Dispute resolution
Photos (Trip Verification)	180 days after trip	Refund verification
Chat Messages	1 year after trip	Support and disputes
Log Data	90 days	Security and debugging
Analytics (Anonymized)	2 years	Product improvement

9.2 After Retention Period

• Data is automatically deleted or anonymized
• Anonymized data cannot be linked back to you

10. Third-Party Links

VaultWheels may contain links to external websites (e.g., social media, payment processors). We are not responsible for their privacy practices. Review their policies before providing information.

11. International Data Transfers

Your data is primarily stored in India (Firebase Asia-South, Supabase Mumbai). If you access VaultWheels from outside India:

• Your data may be transferred to servers in India
• We comply with applicable data protection laws
• Standard Contractual Clauses (SCCs) used for EU transfers

12. Changes to This Privacy Policy

• We may update this Privacy Policy to reflect changes in our practices or laws
• Material changes will be notified via email or in-app notification
• Continued use after changes = acceptance
• Last Updated date shown at the top

13. Your Rights Under Indian Law

Under the Digital Personal Data Protection Act, 2023 (DPDP Act), you have the right to:

• Access your personal data
• Correct inaccurate data
• Request erasure (subject to legal retention requirements)
• Withdraw consent for data processing
• Nominate someone to exercise your rights after death
• File a complaint with the Data Protection Board of India

14. Your Rights Under GDPR (EU Users)

If you're in the European Union, you have additional rights under GDPR:

• Right to be forgotten
• Right to data portability
• Right to object to processing
• Right to restrict processing
• Right to lodge a complaint with your local Data Protection Authority

15. California Privacy Rights (CCPA)

If you're a California resident, you have the right to:

• Know what personal information we collect and how it's used
• Request deletion of your personal information
• Opt out of sale of personal information (we don't sell data)
• Non-discrimination for exercising your rights