Privacy Policy

Effective date: 9 June 2026

Last updated: 10 August 2026

1. About This Policy

This Privacy Policy applies to all users of VahanTag's products and services, including vehicle owners who register with us, and third parties (such as QR code scanners) who interact with our service. This policy is published in accordance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 (DPDP Act).

Entity: VahanTag is operated by VahanTag Technologies (Sole Proprietorship), located at A-505, Silver Coin, Lane 30/31, Ganesh Nagar, Dhayari, Pune, Maharashtra — 411041, India.

2. Information We Collect

We collect information based on how you interact with VahanTag:

2.1 From Registered Users (Vehicle Owners)

• Mobile phone number (for OTP authentication, WhatsApp/SMS notifications)
• Full name and delivery address (for order fulfilment and shipping)
• Vehicle registration number and owner name (for sticker activation)
• Emergency contact details — names and mobile numbers of up to 3 third parties you designate; optionally, one contact may be marked "public" so their name and mobile number are shown to anonymous QR scanners during an Emergency SOS
• Order and payment transaction records
• Communication preferences
• Support ticket content

2.2 From QR Code Scanners (Third Parties)

• GPS location (latitude/longitude) — if you grant permission when prompted
• Issue category and optional note describing the vehicle issue
• Session identifier (randomly generated, not linked to your identity)
• Timestamp of the scan

Note: We do not collect the scanner's phone number, name, or any personally identifiable information. Scanning is anonymous.

2.3 Automatically Collected Data

• Device and browser information via cookies and analytics tools (see Section 6)
• IP address (used for approximate geolocation and security)
• Pages visited, time spent, and interaction data

2.4 From Partner & Distributor Applicants

When you submit an application through our Partner Program or Distributor Program application forms, we collect:

• Your full name and mobile number
• Business name, type, and location
• PAN (for distributor applications)
• Any other details you voluntarily provide in the application form

This information is used solely to evaluate your application and contact you regarding the program. It is not shared with third parties or used for marketing. If your application is not taken forward, this data is retained for 12 months and then deleted.

3. Legal Basis for Processing

We process your data on the following grounds under the DPDP Act, 2023:

• Consent: When you sign up, place an order, or activate a sticker, you provide consent by proceeding with the action. You may withdraw consent at any time by contacting us.
• Contract performance: To fulfil your order, deliver stickers, send alert notifications, and provide customer support.
• Legitimate interest: To prevent fraud, ensure service security, and improve our product.
• Legal obligation: To maintain transaction records as required under Indian tax and commerce laws.

4. How We Use Your Information

• Send WhatsApp/SMS notifications when someone scans your QR code or triggers an SOS
• Process and deliver your orders
• Authenticate your identity via OTP
• Provide customer support and resolve disputes
• Improve our service, fix bugs, and analyse usage patterns
• Comply with legal obligations (tax records, fraud prevention)

5. Third-Party Data Sharing

We share your data only with the following categories of service providers, solely to operate VahanTag:

• Razorpay (Payment Gateway): Receives your name, mobile number, and payment details to process transactions. We never store your card or UPI details on our servers.
• WhatsApp / SMS Gateway (Messaging Provider): Receives mobile numbers to deliver OTPs and alert notifications.
• Shipping/Courier Partners: Receive your name, address, mobile number, and order ID for delivery.
• Google Analytics: Receives anonymised browsing data (pages visited, device type, approximate location) to help us understand usage. See Section 6 for details.
• Cloud Infrastructure (Hosting): Our servers are hosted on cloud infrastructure located within India. All data is stored domestically.

We do not sell, rent, or trade your personal data to any third party for marketing purposes.

6. Cookies & Tracking Technologies

We use the following tracking technologies:

• Google Analytics: Uses cookies to collect anonymised data about page views, session duration, device type, and geographic region. This helps us improve the website.
• Browser Storage: Used to store authentication tokens and session data locally on your device. This is essential for the service to function.

We do not use advertising cookies or third-party tracking pixels.

7. Data Retention

• Account data (name, mobile, vehicle details): Retained for as long as your account is active. Deleted within 90 days of account deletion request.
• Order and payment records: Retained for 7 years as required under Indian tax regulations (GST Act).
• Scan/alert logs: Retained for 90 days, then automatically deleted.
• Support tickets: Retained for 1 year after resolution.
• Analytics data: Retained as per Google Analytics default retention settings (14 months).

8. Data Protection & Security

• All data transmitted between your device and our servers is encrypted using TLS/HTTPS
• Authentication tokens are securely stored and expire after a defined period
• Payment processing is handled entirely by Razorpay (PCI-DSS compliant); we never see or store card details
• Access to production data is restricted to authorised personnel only
• We conduct periodic security reviews of our infrastructure

9. Data Storage Location

All your personal data is stored exclusively on servers located within India. We do not transfer or store any personal data outside the territory of India.

10. Your Privacy Rights (Data Principal Rights)

Under the DPDP Act, 2023 and applicable Indian laws, you have the following rights:

• Right to Access: Request a summary of the personal data we hold about you.
• Right to Correction: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your data (subject to legal retention obligations).
• Right to Withdraw Consent: Withdraw consent at any time. This will not affect the lawfulness of processing done before withdrawal.
• Right to Nominate: Nominate another person to exercise your rights on your behalf in the event of death or incapacity.
• Right to Grievance Redressal: File a complaint with our Grievance Officer (see Section 13).

To exercise any of these rights, email us at [email protected] with the subject line "Data Principal Rights Request". We will respond within 30 days.

11. Emergency Contacts & Third-Party Data

When you add emergency contacts during sticker activation, you are sharing their names and mobile numbers with us. The activation flow requires you to explicitly confirm, for each contact, that they have been informed and have agreed. VahanTag records a timestamped confirmation at the point of activation. By providing this data, you confirm that:

• You have informed these individuals that their details are being shared with VahanTag.
• They have agreed to receive emergency SOS alert messages from VahanTag on behalf of your vehicle.
• They may contact us at [email protected] to request removal of their data at any time.

11.1 Public Emergency Contact

During activation, you may optionally designate one emergency contact as "public". When this option is enabled, that contact's name and mobile number will be displayed to any anonymous third party who triggers an Emergency SOS by scanning your VahanTag QR code. This information is shown so the scanner can call them directly to report the situation.

Enabling the public contact option requires a separate explicit confirmation in the activation flow. VahanTag records a timestamped confirmation of this disclosure consent at the point of activation. By marking a contact as public, you confirm that:

• The contact has been explicitly informed that their name and mobile number may be shown to unknown third parties in an emergency context.
• They have consented to this public disclosure.
• VahanTag is not liable for any calls or contact attempts made to this person by third-party scanners acting in response to an SOS event.

12. Children's Privacy

VahanTag is not intended for use by individuals under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected data from a minor, we will delete it promptly. If you believe a minor has provided us with personal data, please contact us at [email protected].

13. Grievance Officer

In accordance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, the designated Grievance Officer for VahanTag is:

14. Contact Information

For any privacy-related questions or concerns, please contact us:

15. Changes to This Policy

We may update this privacy policy from time to time. When we make material changes, we will notify registered users via WhatsApp/SMS and update the "Last updated" date at the top of this page. Continued use of VahanTag after changes constitutes acceptance of the revised policy.