Privacy Policy

Last updated: October 13, 2026 • Compliant with Indian DPDP Act, Google Play & Apple App Store Guidelines

Privacy Commitment: GIFT City Carpool is committed to protecting your personal data and maintaining confidentiality. We collect only what is strictly necessary to verify GIFT City commuters, coordinate rides, process token settlements, and ensure safety.

1. Overview & Scope

This Privacy Policy explains how GIFT City Carpool ("we", "us", or "our") collects, uses, stores, discloses, and protects your information when you access or use our mobile applications and website.

By using the Platform, you consent to the collection and use of information in accordance with this Privacy Policy. If you do not agree with this policy, please do not use our services.

2. Information We Collect

We collect several types of information from and about users of our Platform:

2.1 Personal & Verification Information (Closed Corporate Network)

Phone Number: Used for secure OTP-based mobile authentication via Firebase Authentication.
Profile Information: Full name, profile photograph, and contact email address.
Closed Corporate Employment Verification Details: Corporate work email address, company name, employee code/ID, and uploaded photographs of company ID card (front and back). This verification is mandatory to maintain a closed, trusted community of verified corporate commuters and serves as statutory evidence under RTO / MoRTH guidelines that the platform is restricted to bona fide employees sharing commute journeys rather than operating as an open commercial taxi service.
Driver Documents (for drivers/hosts): Driving license number, registration certificate (RC book), vehicle photos, and vehicle details (make, model, manufacturing year, fuel type, seating capacity). This information ensures private vehicle ownership, roadworthiness, and calculation of precise fuel cost-sharing token values.

2.2 Location & Trip Information

Pickup and Drop-off Points: Geolocation coordinates and landmarks selected for booking and scheduling rides.
Real-time Geolocation: When you participate in an active ride (as a driver or passenger), the app collects real-time location data to provide live ride tracking, route coordination, and estimated arrival updates. Location tracking stops when the ride is completed or cancelled.

2.3 Financial & Token Transaction Data

Payment details processed securely through Razorpay (payment ID, order ID, amount, timestamp, and payment status). We do not store raw credit card numbers or UPI PINs on our servers.
Token balance ledger, reservation logs, and ride redemption transactions.
Bank/UPI details submitted strictly for processing eligible token buyback refunds or driver payout reimbursements via Razorpay.

2.4 Technical & Device Data

Firebase Cloud Messaging (FCM) device tokens for push notifications regarding booking updates, ride departures, and completion alerts.
IP address, device model, operating system version, and anonymous diagnostic crash logs.

3. How We Use Your Information

We use the collected information for the following specific purposes:

To verify corporate employment and maintain a trusted, closed-community commuter carpool network in GIFT City.
To enforce non-commercial commuter protections under RTO carpooling regulations, including daily ride limits (max 2 rides/day) and fuel cost split calculations.
To match passengers with drivers travelling along compatible routes.
To coordinate rides, show live location during trips, and enable essential communications between co-riders.
To manage the token ledger, process token purchases, handle cancellations, and execute buyback refunds.
To prevent fraud, verify identity, and ensure commuter safety.
To comply with statutory obligations, tax laws, and lawful police requests.

4. Data Sharing & Third-Party Service Providers

We do not sell, rent, or trade your personal data. We only share necessary data with trusted service providers to operate our application:

Google Firebase: Cloud infrastructure for telephone OTP authentication, Cloud Messaging push alerts, and secure cloud storage.
Supabase: Cloud database with Row Level Security (RLS) ensuring strict isolation of user records.
Razorpay: Payment gateway and merchant services for processing token purchases, buybacks, and driver bank payouts.
Google Maps Platform: Mapping, location autocomplete, and route visualization.
Co-riders: When a ride is confirmed, drivers and passengers see the pickup/drop-off point and non-sensitive commute details. Phone call initiation is available only during active confirmed rides.
Law Enforcement & Regulators: If required by Indian law, court order, or formal investigation into safety or criminal matters.

5. In-App Account Deletion & Data Retention

In full compliance with Google Play Store and Apple App Store mandates:

In-App Deletion: Any user can initiate permanent account deletion at any time directly from the Profile page in the application.
Erasure of Personal Identity: Upon deletion, your personal identifiable information (name, phone number, personal email, company ID card photos, driver licenses, and FCM device tokens) is permanently erased from active storage and decoupled.
Preservation of Anonymized Records: Completed ride records and financial ledgers are retained with an anonymized label (Deleted User) to preserve driver earnings, transaction reconciliation, and statutory accounting records without exposing your personal identity.
Deletion Preconditions: Account deletion requires that all active rides are completed or cancelled, and token wallet balances are zero or fully settled through refund.

6. Data Security

We implement industry-standard security safeguards to protect your personal data:

All network transmissions use TLS/HTTPS encryption with strict transport security.
Database access is enforced using Supabase Row Level Security (RLS), ensuring that users can only access their authorized data.
Uploaded ID cards and verification files are stored in access-controlled cloud storage.

7. Your Rights under Indian Law

Under the Digital Personal Data Protection Act, 2023 (DPDP Act) and applicable regulations, you have the right to:

Access a summary of your personal data processed by us.
Request correction or updating of inaccurate personal data.
Request erasure of personal data through our in-app account deletion workflow.
File a grievance with our designated Grievance Officer.

8. Grievance Officer & Contact Information

In accordance with the Information Technology Act, 2000 and the DPDP Act, 2023, the details of our Grievance Officer are:

Grievance Officer: Compliance & Privacy Desk
Entity: GIFT City Carpool
Email: giftcitycarpool@gmail.com