Privacy Policy

1. Introduction

This Privacy Policy explains how ReDrivo ("ReDrivo," "we," "us," or "our"), a Micro Enterprise registered under the Ministry of Micro, Small and Medium Enterprises, Government of India (Udyam Registration No. UDYAM-WB-10-0222498), with a registered address at 405, Sukhobristi Complex, SP Sukhobristi Lane, Shapoorji, New Town, Kolkata, West Bengal 700135, India ("Registered Address"), collects, uses, stores, shares, and protects personal data when you use our mobile applications, websites, and related services (collectively, the "Platform").

ReDrivo operates a three-sided marketplace connecting:

• Customers seeking on-demand drivers, vehicle pickup/drop, and car rental services;
• Drivers/Marshals offering driving and vehicle-handling services; and
• Garage Partners (workshop owners and their staff) offering vehicle servicing and repair.

This Policy is published in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act") and its associated Rules, and applies to all users of the Platform in India. Under the DPDP Act, ReDrivo acts as a "Data Fiduciary" and you, as a user, are a "Data Principal."

By using the Platform, you agree to the collection and use of your personal data as described in this Policy. If you do not agree, please do not use the Platform.

2. Personal Data We Collect

The data we collect depends on which role you use the Platform in:

3. How and Why We Use Your Data

We process personal data only on a lawful basis under the DPDP Act — primarily your consent, or as necessary to perform a contract with you (i.e., to provide the ride, service, or platform feature you have requested). We use your data to:

• Create and manage your account, and verify your identity for safety and regulatory compliance
• Match customers with available drivers or garages, and coordinate bookings
• Process payments, driver payouts, and garage settlements
• Communicate with you about your bookings, account, and support requests (via SMS, WhatsApp, push notification, or email)
• Maintain safety and trust on the Platform, including fraud prevention and dispute resolution
• Comply with legal obligations, including tax, KYC, and motor vehicle aggregator record-keeping requirements
• Improve the Platform through aggregated, non-identifying analysis of usage patterns

4. Third Parties We Share Data With

We work with the following service providers, each bound to process your data only for the purpose we have engaged them for:

Garage Partner Privacy Safeguard: When a Customer books a garage service, Garage Partners receive only the vehicle details (registration number, brand, model, photos), structured Order ID, and service/job-card details — we do not share the Customer's name, phone number, or email address with garages.

We may also disclose personal data where required by law, in response to a valid legal process, or to protect the rights, property, or safety of ReDrivo, our users, or the public.

5. How We Protect Your Data

• PAN and Driving Licence numbers are encrypted at rest using AES-256-GCM. Full Aadhaar numbers are never stored; only the last 4 digits and a one-way fingerprint are kept.
• KYC document images and selfie photographs are stored in Cloudflare R2, which applies server-side encryption at rest by default.
• Passwords are stored using industry-standard one-way cryptographic hashing (bcrypt) and are never visible to ReDrivo staff.
• Access to KYC and identity data within our systems is restricted to authorized personnel on a need-to-know basis, and sensitive fields are masked from view for non-administrative staff.
• We maintain access logs and audit trails for changes to sensitive account and financial data.
• Bank account details are used only for payouts and are visible only to authorised ReDrivo staff.

While we take reasonable and appropriate technical and organizational measures to protect your data, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

6. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Policy, or as required by law:

• KYC documents, identity numbers, and selfie photographs (for drivers, marshals, garage owners, and garage workers): When you delete your account, or when a KYC submission is rejected or left incomplete, your account is immediately deactivated (for deletions), all active login sessions are revoked, and a mandatory 90-day retention timer is set. Once the 90-day period expires, our DPDP retention purge process permanently deletes uploaded KYC document images and selfies from Cloudflare R2 storage and scrubs encrypted PAN numbers, encrypted Driving Licence numbers, and KYC hashes from our database.
• Financial and tax records (invoices, transaction ledgers, payout records) are retained for the period required under applicable Indian tax law (currently up to 8 years), even after account deletion, as this is a statutory obligation that overrides general erasure.
• Trip and telematics data (trip logs, route stops, and digital vehicle inspection records) is retained in line with applicable motor vehicle aggregator record-keeping and safety/dispute audit requirements.
• Account and profile information is retained while your account is active. Upon account deletion, your profile is immediately marked inactive and login tokens are revoked; non-KYC transaction and audit references are retained only as required for statutory tax and safety compliance.

7. Your Rights

Under the DPDP Act, 2023, Customers, Drivers/Marshals, and Garage Partners have the right to:

• Access a summary of the personal data and KYC verification records we hold about you, and the third parties with whom your data has been shared.
• Correct or update inaccurate or incomplete personal data, or request re-verification if your KYC details change.
• Erase your personal data by deleting your account — either instantly within the mobile app (Profile → Delete Account) or via our public web page at redrivo.com/delete-account. Once deletion is initiated, your sessions are revoked immediately and your KYC documents and ID numbers are permanently purged after 90 days as described in Section 6.
• Withdraw consent at any time for processing based on consent (such as foreground location access via your device settings or KYC verification prior to approval), without affecting the lawfulness of processing carried out before withdrawal.
• Nominate another individual to exercise your data rights on your behalf in the event of your death or incapacity.
• Raise a grievance regarding how your data is handled — see Section 10 below.

To exercise any of these rights, use the in-app account settings where available, visit redrivo.com/delete-account, or contact our Grievance Officer using the details in Section 10.

8. Children's Data

The Platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. Drivers and marshals are inherently required to hold a valid driving licence, which restricts this role to adults. If we become aware that we have inadvertently collected data from a minor without appropriate parental consent, we will take steps to delete it promptly.

9. Cookies and Website Tracking

Marketing Website (redrivo.com / redrivo.in): Our public website uses Google Analytics 4 (gtag.js) to understand aggregate visitor traffic and measure interactions such as app download clicks and partner inquiry submissions. Google Analytics sets first-party cookies (_ga, _ga_*) that collect your IP address, browser type, device information, and pages visited. We do not use advertising pixels or cross-site tracking cookies. You can control or disable cookies at any time through your browser settings.

Mobile Apps & Web Portals (Customer App, Driver App, Garage Portal, CRM): Our mobile applications and web portals do not use browser tracking cookies or advertising trackers. They use on-device localStorage strictly for essential functionality — such as keeping you signed in (redrivo_token), remembering your location and camera consent choices (redrivo_gps_consent, redrivo_media_consent), and saving address presets or KYC drafts — and use Sentry (with automatic PII scrubbing) solely for crash and error reporting as described in Section 4.

10. Grievance Redressal

If you have any questions, concerns, or complaints about how we handle your personal data, please contact:

If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India, once operational.

11. Data Breach Notification

In the unlikely event of a personal data breach that affects you, we will notify you and the Data Protection Board of India without undue delay, in accordance with the DPDP Act and Rules, including details of the nature of the breach and steps we are taking to address it.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will post the updated Policy on this page with a revised "Last updated" date. Significant changes will be communicated via in-app notification or email where appropriate.

13. Governing Law

This Privacy Policy is governed by the laws of India. Any disputes arising from this Policy shall be subject to the exclusive jurisdiction of the courts in Kolkata, West Bengal.

14. Contact Us

For any questions about this Privacy Policy that are not covered above, please write to us at grievance@redrivo.in.