Privacy Policy

This notice explains how AdVahan Digital Technologies Private Limited ("AdVahan", "we") processes personal data when you use advahan.in, our rider and advertiser accounts, and our EV rental and Digital Box services. It is designed with the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the rules in force on the date of use in mind.

1. Data we collect and why

• Enquiries: name, mobile, email, city and your message — to respond to your request.
• Account: email and/or mobile number and login records — to authenticate you and keep your account secure.
• Rider verification (KYC): legal name, date of birth, city/operating area, driving licence images and masked licence number, and address only where the rental requires it — to confirm eligibility and comply with vehicle-rental obligations.
• Rentals: bookings, handover inspection records and photos, maintenance and incident reports — to provide and manage the rental.
• Payments: payment status and references from our payment partner. We do not store card numbers, CVV or UPI PINs.
• Vehicle & device location: GPS data from fleet vehicles and Digital Box devices — for fleet safety, theft recovery and advertising delivery reporting. Location is tied to the vehicle/device; access is restricted and retention-limited.
• Advertisers: business details, contacts, GSTIN and creatives — to verify accounts, review content and invoice.

We do not ask for your Aadhaar number. We do not collect data merely because it may be useful in future.

2. Legal basis

We process data on the basis of your consent where required, or for legitimate uses permitted under the DPDP Act (for example, where you voluntarily provide data for a specified purpose, or to comply with law). Where we rely on consent you can withdraw it at any time; withdrawal does not affect processing already done, and may mean we cannot continue a service that depends on it.

3. Sharing

We share data only with processors that help us run the service — hosting and database (Supabase, Vercel), payments (Razorpay), messaging (email/SMS providers) and, where applicable, identity-verification providers — under contracts requiring appropriate safeguards; and with authorities where required by law.

4. Retention

KYC documents are kept for the duration of your relationship with us and thereafter only as long as required by law or to resolve disputes. Enquiries without a resulting account are deleted after 12 months. Device location telemetry is retained for a limited period set in our retention schedule. Financial records are kept as required by tax law.

5. Your rights

You may request access to a summary of your data, correction, completion, update or erasure, withdraw consent, nominate another person, and raise a grievance — from your account's Privacy section or by contacting our Grievance Officer. If you are not satisfied with our response you may approach the Data Protection Board of India.

6. Security

We use encryption in transit and at rest, row-level access controls, private storage with short-lived links for documents, audit logs for sensitive actions, and multi-factor authentication for administrators. No system is completely secure; we will notify affected users and the Board of personal-data breaches as required by law.

7. Children

Our services are for adults. We do not knowingly process data of persons under 18.

8. Changes

We will post updates here with a new version number and, where changes are material, notify account holders.