Privacy Policy | CarYatri

In short

We collect only what is needed to run carpooling safely: your profile, verification details, rides, bookings and chats.
We never sell your personal data, and we do not process or store any payment.
Other users see your name, photo and rating, and your mobile number only after a confirmed booking (you can hide it).
You can delete your account from the app at any time. You get 30 days to change your mind, then your data is deleted.

1. About this Policy

This Privacy Policy explains how CarYatri ("CarYatri", "we", "us") collects, uses, shares and protects your personal data when you use the CarYatri mobile app (the "App") and the website caryatri.in (the "Website").
For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act"), CarYatri is the Data Fiduciary for the personal data described here. This Policy is also published under the Information Technology Act, 2000 and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
This Policy forms part of our Terms and Conditions. Words defined in the Terms (such as Driver, Rider, Ride and Booking) have the same meaning here.
By using the App you consent to the processing described in this Policy. You can withdraw consent at any time (see Section 9), though some features may then stop working.

2. Information we collect

Account details you give us:
- name, salutation and date of birth;
- email address and mobile number, both verified by a one-time code;
- profile photo and home city, if you add them;
- your password, which is handled by Firebase Authentication. We never see or store it in readable form.
Identity verification (KYC), with your explicit consent:
- details read from your Driving Licence or Aadhaar: name, date of birth, guardian's name, address and document number;
- for Aadhaar, we keep only the last 4 digits of the number, never the full 12 digits;
- the photo of the document is used only to read these details and is then deleted immediately;
- giving Aadhaar is voluntary. You can always use your Driving Licence instead.
Vehicle details, if you drive:
- vehicle brand, model, colour and registration number, and an optional photo of the vehicle.
Rides and bookings:
- rides you publish (route, stop cities, date, time, seats and cost-share), weekly repeat schedules, bookings you request or accept, cancellations and ride history.
Payment QR code, if you add one:
- the QR image and the UPI ID read from it, so Riders can pay you directly. We do not collect bank account, card or UPI PIN details, and we never handle the money.
Messages, ratings and reports:
- in-app chat messages between a Driver and Rider, ratings and reviews, reports you file, and users you block.
Location:
- if you allow it, your device location is used only while the App is open, so nearby cities appear first when you pick a pickup or drop city;
- we do not track your location in the background, and the App works without location access.
Device and usage information:
- a push notification token, so we can send ride updates and reminders;
- app usage events (for example, a search or a booking being made) through Firebase Analytics. Names, phone numbers, emails and document details are never included in these events;
- crash reports through Firebase Crashlytics, so we can find and fix errors;
- basic technical data such as app version, device model and operating system.
Support requests: what you write to us at our support email, and our replies.
The Website does not use cookies, does not run analytics, and does not ask you for personal data. Our hosting provider may keep standard server logs (such as IP address and browser type) for security.

3. How we use your information

To create and manage your account, and to log you in securely.
To verify identity documents and vehicle details, and to show a "Verified" badge where verification is complete.
To match Drivers and Riders, show rides in search, handle bookings, and publish weekly repeat rides you have set up.
To let a Driver and Rider with a confirmed booking chat and, subject to their communication preferences, call each other.
To send service messages: verification codes, booking updates, ride reminders and account notices, by push notification, email, SMS or WhatsApp.
To keep the platform safe: preventing fraud and fake accounts, reviewing reports, and moderating chat (for example, blocking messages that share phone numbers, links or payment IDs before a booking).
To understand how the App is used and to fix crashes, so we can improve it.
To meet our legal obligations and respond to lawful requests from authorities.
We do not use your personal data for advertising, and we do not make automated decisions that have legal effects on you.

4. What other users can see

Your name, profile photo and rating are visible to users who view your published ride or are matched with you through a booking.
A published ride's route, cities, date, time, seats and cost-share are visible to anyone searching for a matching ride.
Your vehicle details are shown to Riders on your ride, so they can recognise the car.
Your mobile number is shared only between a Driver and Rider whose booking is confirmed, and only until the ride is completed or cancelled. You can hide your number or WhatsApp in the App under Manage your Account → Communication preference.
A Driver's payment QR code is shown to their Rider only after the ride's departure time.
Your email address, date of birth and identity document details are never shown to other users.

5. Who we share it with

We do not sell, rent or trade your personal data.
We share data only with service providers who help us run the App, under contracts that limit how they may use it:
- Google Cloud Platform, for servers, databases and file storage;
- Google Firebase, for sign-in, push notifications, analytics and crash reports;
- Google Maps Platform, for city search, routes and travel times;
- WhatsApp Business Platform (Meta), for verification and service messages;
- email delivery providers, for verification and account emails.
We may disclose data when required by law, a court order or a lawful request from a government agency, or where needed to protect the safety of a user or the public.
If CarYatri is merged, acquired or reorganised, your data may be transferred to the new operator, who must continue to protect it under this Policy.

6. Where your data is stored

Your data is stored on secure cloud servers. Some of our service providers (such as Google and Meta) may process data on servers outside India.
Any such transfer is made only to countries not restricted by the Government of India under Section 16 of the DPDP Act, and with safeguards at least as protective as this Policy.

7. How long we keep it

We keep your data for as long as your account is active.
If you delete your account, it is first scheduled for deletion. You have 30 days to reactivate it by logging in again.
After 30 days, your profile, chats, document details, vehicle details and contact details are permanently deleted. Past trips appear to your co-travellers as "Deleted User".
To answer legal or fraud-prevention questions, we keep only a scrambled (hashed) form of your email and mobile number for up to 365 days after deletion. It cannot be turned back into your details.
Some records may be kept longer only where a law requires it, for example for an ongoing investigation or legal claim.

8. How we protect it

All data travelling between the App and our servers is encrypted (HTTPS).
Access to personal data is limited to people and systems that need it to run the service.
Identity document photos are deleted right after their details are read, and only the last 4 digits of an Aadhaar number are kept.
Uploaded files are kept in private storage and are not publicly listed.
No method of storage or transmission is completely secure. If a personal data breach occurs, we will inform affected users and the Data Protection Board of India as the law requires.

9. Your rights

Under the DPDP Act, you have the right to:
- get a summary of the personal data we hold about you and how it is processed;
- correct, complete or update your data. Most details can be edited directly in the App;
- erase your data, by deleting your account in the App (Manage your Account → Delete my account; see our account deletion guide) or by writing to us;
- withdraw consent you gave earlier, as easily as you gave it;
- nominate another person to exercise these rights if you die or become unable to;
- have your grievance addressed by our Grievance Officer (Section 12).
You can turn off location access and notifications at any time in your phone settings, and control calls and WhatsApp in the App under Communication preference.
We will respond to a request within the time set by law. We may need to confirm your identity first.
If you are not satisfied with our response, you may complain to the Data Protection Board of India.

10. Children

CarYatri is only for people aged 18 or over. We do not knowingly collect data from anyone under 18. If we learn that we have, we will delete it.

11. Changes to this Policy

We may update this Policy when the App or the law changes. The latest date is shown at the top of this page.
If a change is significant, we will tell you in the App before it takes effect.

12. Grievance Officer and contact

For any question, request or complaint about your personal data, contact our Grievance Officer, appointed under the IT Rules, 2021 and the DPDP Act, 2023:
Grievance Officer: Shivam Gupta
Email: support.caryatri@gmail.com
Address: Ward No. 8, Badri Prashad Colony, Bisauli, Budaun, Uttar Pradesh – 243720
We acknowledge complaints within 24 hours and aim to resolve them within 15 days, or any shorter period set by law.