Privacy Policy

DPDP 2023 compliant · Version 1.0 · Last updated 9 July 2026

We do not collect Aadhaar in v1. We do not operate an in-app wallet — refunds return to your source UPI/account directly via our payment processor. We do not sell your personal data.

1. Who we are

This Policy describes how LalaCar ("we", "us"), operated by Rudraayaan AI Technologies Pvt Ltd, collects, uses, shares and protects your personal data when you use the LalaCar apps, lalacar.in and related services ("Services"). For the Digital Personal Data Protection Act, 2023 ("DPDP Act"), LalaCar acts as a Data Fiduciary.

2. Contact

Grievance Officer: grievance@lalacar.in — 24-hour acknowledgement + 15-day resolution (per IT Rules 2021).
Data Protection Officer: dpo@lalacar.in

3. Data we collect

Category	What	Lawful basis
Account	Phone, name, email, photo, gender, DOB	Consent / contract
Verification (drivers)	PAN (uniqueness only), DL, RC, selfie liveness	Consent + legal obligation
Location	Live + saved Home/Work	Consent
Trip	Origin, destination, route, timestamps, ratings, chat	Contract
Payments — none. Rides are cash at drop-off and shop orders are cash at the counter; no payment instrument is collected	Contract
Device	Model, OS, app version, IP, device fingerprint	Legitimate interest / consent

4. How we use data

Provide the Services — publish, search, request, book, in-trip safety, ratings, voucher discovery.
Process the ₹50 UPI reliability hold and release/refund it per the booking lifecycle.
Verify drivers and enforce one-account-per-person via a PAN hash.
Comply with law, prevent fraud, investigate safety incidents.
Send transactional messages; marketing only with your consent.

5. With whom we share

Other users (first name + initial + photo + rating), Dove (DLT SMS for login OTP), Telegram (merchant application review — brand, category, shop location and photo are sent to our reviewer bot), KYC vendors (PAN/DL/RC/selfie verification), Google Firebase/Maps (hosting, analytics, mapping), Sentry/PostHog (error monitoring, product analytics), and law enforcement upon valid legal process. We do not share with advertising networks for targeted advertising.

6. Cross-border transfers

Primary processing is in India (asia-south1). Limited error-monitoring and product-analytics data may transfer outside India where the processor has no India region; we rely on lawful bases and contractual safeguards consistent with DPDP §16.

7. Retention

Trip & booking history — 5 years after last trip (audit, dispute, regulatory).
Merchant order & voucher ledger — 8 years (Income Tax Act + audit).
KYC documents (encrypted) — 5 years after KYC expiry.
Safety incident records — 10 years (or longer if a legal matter is pending).
Chats — 90 days then archived 1 year. Crash & analytics — 13 months.

On account closure, identifiable data is anonymised or deleted within 30 days, except where retention is mandated by law.

8. Your rights under DPDP

Access — request a copy (within 7 days via app or dpo@lalacar.in).
Correction & erasure — fix or delete (within 30 days, subject to legal retention).
Nominate — appoint someone to exercise rights on your behalf.
Grievance redressal — Grievance Officer, then escalation to the Data Protection Board of India.
Withdraw consent — at any time, with consequences for features that require it.

9. Security

TLS 1.2+ in transit; AES-256 at rest. PAN is hashed (sha256 + project pepper) and masked — full PAN is not retained in v1. Aadhaar is not used. Strict role-based access; admin actions are audited. Annual third-party security testing. Breach reporting per DPDP §8(6) within statutory timelines.

10. Children

LalaCar is not for users under 18. We require date-of-birth at sign-up and verify age at the first KYC step. If we discover a user is under 18, we suspend the account and delete personal data, except as required by law.

11. Changes

We notify you of material changes via app + email at least 15 days before they take effect. Continued use after the effective date constitutes acceptance.