In short: we collect what we need to verify people, run bookings and payments, and keep trips safe. We don't sell your data. Location is used only during an active trip. You can see, correct and delete your data, and delete your account from the app's Settings.
1. Who we are
Drivzz ("Drivzz", "we", "us") runs the Drivzz mobile app and this website (drivzz.com), a marketplace where people who own cars ("owners") rent them to people who need one ("renters"). This policy is published by Drivzz.
For the personal data we process to run Drivzz, we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), and we follow the Information Technology Act, 2000 and the rules made under it. This policy explains what we collect, why, who we share it with, how long we keep it and how you can use your rights. By creating an account and giving the consents asked for in the app, you agree to the processing described here.
2. What we collect
You give us
- Account details: name, mobile number, email address (optional), profile photo (optional), and your role (renter, owner or both).
- Identity (KYC): for renters and owners, an image of your Aadhaar card (we recommend the masked Aadhaar, which shows only the last 4 digits) and the details read from it (name, year or date of birth, gender). We store only the last 4 digits of the Aadhaar number as data, never the full number. Document images are read automatically by text recognition (Google Cloud Vision) and checked against the rules for Indian IDs; anything uncertain is reviewed by a member of our team.
- Driving licence: for self-drive renters, the licence image and details (licence number, name, validity, vehicle classes) so we can check you are licensed to drive the car.
- Vehicle documents (owners): registration certificate (RC), insurance policy, PUC certificate and, where needed, permits; car details, photos, prices, availability and pickup points.
- Payout details (owners): bank account or UPI ID used to pay you.
- Trip records: handover and return photos, odometer and fuel readings, and notes you add.
- Messages: chats with the other party of a booking and with Drivzz support, and emails you send us.
- Ratings and reviews you give.
Collected when you use Drivzz
- Bookings: dates, cars, choices (self-drive, driver, chauffeur), prices, cancellations, refunds and disputes.
- Payments: payments are processed by Cashfree Payments. We receive the order and transaction reference, amount, method type (for example UPI or card), and status. We never receive or store your full card number, CVV, UPI PIN or net-banking password.
- Location: the device's location while a trip is active (see section 4). Location while searching is used only if you allow it, to show cars near you, and is not stored.
- Device and technical data: device model, operating system, app version, a push-notification token, app-integrity signals (Firebase App Check), IP address, and logs of requests and errors. Logs never contain your passwords, tokens or payment credentials.
From others
- Confirmation of your mobile number from Firebase Authentication (Google), which sends the one-time sign-in code by SMS.
- Payment status from Cashfree, and information an owner or renter gives about a trip you were part of (for example a damage report).
3. How we use it
| Purpose | Data used | Basis |
|---|---|---|
| Create and secure your account; sign you in | Account, device and technical data | Consent; performing the service you asked for |
| Verify identity and driving licence; prevent fraud and fake listings | KYC, licence, vehicle documents | Consent; legitimate use for safety and fraud prevention |
| Show listings, handle requests, bookings, handovers and returns | Account, vehicle, booking, trip records | Consent; performing the service |
| Take payments, refund, pay owners, keep accounts | Payment and payout data, bookings | Consent; legal obligations (tax, accounting) |
| Safety during a trip, recovering a car, settling disputes and claims | Trip location, trip records, messages | Consent; legitimate use for safety |
| Support and service messages (booking updates, receipts, security alerts) | Contact details, messages | Performing the service |
| Keep the service reliable and fast; find and fix problems | Technical data and logs | Legitimate use |
| Meet legal duties and lawful requests from authorities | As required | Legal obligation (DPDP Act s. 7) |
| Offers and news about Drivzz | Contact details | Only with your consent; switch off in Settings any time |
We do not sell personal data, and we do not use it for advertising profiles. We don't make decisions about you based only on automated processing that have legal or similarly significant effects; automated checks on documents are reviewed by a person when they flag a problem.
4. Location during trips
- The app records the car's location only while a trip is active, from pickup until the return is completed, including in the background during the trip. It stops when the trip ends.
- For each booking, the renter chooses what the owner sees: the live map and route, or only the towns the trip passes through, never exact coordinates.
- The renter always sees their own full map. A renter can also share a trip link with family; anyone with the link sees the trip until it ends or the link is revoked.
- Drivzz staff use trip location only for safety, support, recovering a car and resolving disputes, and access is limited to the people who need it.
5. Who we share it with
- The other party of your booking: what they need for the trip. Owners see the renter's name, photo, rating, verification status and, during a booking, contact details. Renters see the owner's name, photo, rating, the car, pickup point and, during the trip, the car's RC and insurance (view-only). We do not show anyone your Aadhaar image or licence image.
- Service providers (Data Processors) who process data for us under contract and only on our instructions:
- Google Cloud and Firebase (hosting, SMS sign-in, app integrity, notifications, and text recognition of documents);
- Neon (managed PostgreSQL database);
- Cashfree Payments India Pvt. Ltd. (payments, refunds and payouts);
- Brevo (sending service emails);
- Cloudflare (website hosting, DNS and protection against attacks).
- Authorities: police, courts, transport departments or other government bodies when Indian law requires it or to protect someone's safety, after checking that the request is lawful.
- A buyer or successor of Drivzz's business, bound by this policy.
Our providers may store data on servers in India or in other countries. We transfer personal data outside India only as the DPDP Act allows, and never to a country the Government of India has restricted.
6. How long we keep it
| Data | How long |
|---|---|
| Account and profile | While your account is open; erased when you delete it |
| KYC and licence images | While your account is open; erased on deletion, or earlier once no longer needed for verification |
| Trip location | As long as needed to settle the trip and any dispute or claim about it, then erased |
| Bookings, invoices, payments, refunds and payouts | As long as tax and accounting laws require (generally up to 8 years), then erased |
| Technical logs and events | About 180 days |
| Security and audit records of account actions | As long as needed to protect the service and meet legal duties |
When you delete your account, we keep only what the law requires, in a form that is no longer used for anything else.
7. Your rights
Under the DPDP Act you can:
- Access: ask for a summary of the personal data we hold about you and how we process it, and who we've shared it with;
- Correct and update: fix your details in the app's Profile, or ask us;
- Erase: delete your account from Settings → Delete account in the app, or ask us (how);
- Withdraw consent at any time, as easily as you gave it, for example by switching off location or marketing in your phone or app settings. Withdrawing doesn't affect processing already done, and some features (like self-drive) need certain data to work;
- Nominate someone to use these rights for you in case of death or incapacity;
- Grievance redressal: complain to us (section 12), and if you're not satisfied, to the Data Protection Board of India.
To use a right, write to support@drivzz.com from the email or mobile number on your account. We may ask you to confirm it's you. We reply as soon as we can, and within the time the law sets.
8. Security
We use encryption in transit (HTTPS/TLS) and at rest, strict access controls with the least access each person and system needs, app-integrity checks, separate test and live systems, and an append-only audit log of sensitive actions. Payment details are handled by Cashfree, which is PCI DSS compliant. No system is perfectly secure; if a personal data breach affects you, we will tell you and the Data Protection Board as the law requires.
9. Children
Drivzz is for adults only. You must be at least 18 years old to create an account. We don't knowingly process the personal data of anyone under 18; if we learn that we have, we delete it.
10. This website
This website does not use advertising or analytics cookies, does not load third-party trackers and does not ask for any personal data. It is served through Cloudflare, which processes your IP address and basic request data to deliver the site and protect it from attacks. If you email us, we use your email only to reply.
11. Changes to this policy
We may update this policy as Drivzz or the law changes. We'll show the new date at the top, and for important changes we'll tell you in the app or by email before they take effect.
12. Contact and grievances
For any question or complaint about your personal data, contact our Grievance Officer:
- Email: support@drivzz.com (subject "Privacy grievance")
We acknowledge complaints within 24 hours and aim to resolve them within 15 days. If you're not satisfied with our answer, you can complain to the Data Protection Board of India.