Privacy Policy

Effective date: 9 June 2026

Last updated: 9 June 2026

1. About This Policy

This Privacy Policy applies to all users of VahanTag's products and services, including vehicle owners who register with us, and third parties (such as QR code scanners) who interact with our service. This policy is published in accordance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 (DPDP Act).

Entity: VahanTag is operated by VahanTag Technologies (Sole Proprietorship), located at A-505, Silver Coin, Lane 30/31, Ganesh Nagar, Dhayari, Pune, Maharashtra — 411041, India.

2. Information We Collect

We collect information based on how you interact with VahanTag:

2.1 From Registered Users (Vehicle Owners)

• Mobile phone number (for OTP authentication, WhatsApp/SMS notifications)
• Full name and delivery address (for order fulfilment and shipping)
• Vehicle registration number and owner name (for sticker activation)
• Emergency contact details — names and mobile numbers of up to 3 third parties you designate
• Order and payment transaction records
• Communication preferences
• Support ticket content

2.2 From QR Code Scanners (Third Parties)

• GPS location (latitude/longitude) — if you grant permission when prompted
• Issue category and optional note describing the vehicle issue
• Session identifier (randomly generated, not linked to your identity)
• Timestamp of the scan

Note: We do not collect the scanner's phone number, name, or any personally identifiable information. Scanning is anonymous.

2.3 Automatically Collected Data

• Device and browser information via cookies and analytics tools (see Section 6)
• IP address (used for approximate geolocation and security)
• Pages visited, time spent, and interaction data

3. Legal Basis for Processing

We process your data on the following grounds under the DPDP Act, 2023:

• Consent: When you sign up, place an order, or activate a sticker, you provide consent by proceeding with the action. You may withdraw consent at any time by contacting us.
• Contract performance: To fulfil your order, deliver stickers, send alert notifications, and provide customer support.
• Legitimate interest: To prevent fraud, ensure service security, and improve our product.
• Legal obligation: To maintain transaction records as required under Indian tax and commerce laws.

4. How We Use Your Information

• Send WhatsApp/SMS notifications when someone scans your QR code or triggers an SOS
• Process and deliver your orders
• Authenticate your identity via OTP
• Provide customer support and resolve disputes
• Improve our service, fix bugs, and analyse usage patterns
• Comply with legal obligations (tax records, fraud prevention)

5. Third-Party Data Sharing

We share your data only with the following categories of service providers, solely to operate VahanTag:

• Razorpay (Payment Gateway): Receives your name, mobile number, and payment details to process transactions. We never store your card or UPI details on our servers.
• WhatsApp / SMS Gateway (Messaging Provider): Receives mobile numbers to deliver OTPs and alert notifications.
• Shipping/Courier Partners: Receive your name, address, mobile number, and order ID for delivery.
• Google Analytics: Receives anonymised browsing data (pages visited, device type, approximate location) to help us understand usage. See Section 6 for details.
• Cloud Infrastructure (Hosting): Our servers are hosted on cloud infrastructure located within India. All data is stored domestically.

We do not sell, rent, or trade your personal data to any third party for marketing purposes.

6. Cookies & Tracking Technologies

We use the following tracking technologies:

• Google Analytics: Uses cookies to collect anonymised data about page views, session duration, device type, and geographic region. This helps us improve the website.
• Browser Storage: Used to store authentication tokens and session data locally on your device. This is essential for the service to function.

We do not use advertising cookies or third-party tracking pixels.

7. Data Retention

• Account data (name, mobile, vehicle details): Retained for as long as your account is active. Deleted within 90 days of account deletion request.
• Order and payment records: Retained for 7 years as required under Indian tax regulations (GST Act).
• Scan/alert logs: Retained for 90 days, then automatically deleted.
• Support tickets: Retained for 1 year after resolution.
• Analytics data: Retained as per Google Analytics default retention settings (14 months).

8. Data Protection & Security

• All data transmitted between your device and our servers is encrypted using TLS/HTTPS
• Authentication tokens are securely stored and expire after a defined period
• Payment processing is handled entirely by Razorpay (PCI-DSS compliant); we never see or store card details
• Access to production data is restricted to authorised personnel only
• We conduct periodic security reviews of our infrastructure

9. Data Storage Location

All your personal data is stored exclusively on servers located within India. We do not transfer or store any personal data outside the territory of India.

10. Your Privacy Rights (Data Principal Rights)

Under the DPDP Act, 2023 and applicable Indian laws, you have the following rights:

• Right to Access: Request a summary of the personal data we hold about you.
• Right to Correction: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your data (subject to legal retention obligations).
• Right to Withdraw Consent: Withdraw consent at any time. This will not affect the lawfulness of processing done before withdrawal.
• Right to Nominate: Nominate another person to exercise your rights on your behalf in the event of death or incapacity.
• Right to Grievance Redressal: File a complaint with our Grievance Officer (see Section 13).

To exercise any of these rights, email us at [email protected] with the subject line "Data Principal Rights Request". We will respond within 30 days.

11. Emergency Contacts & Third-Party Data

When you add emergency contacts during sticker activation, you are sharing their names and mobile numbers with us. By providing this data, you confirm that:

• You have informed these individuals that their details are being shared with VahanTag.
• They are aware they may receive SOS alert messages on behalf of your vehicle.
• They may contact us at [email protected] to request removal of their data at any time.

12. Children's Privacy

VahanTag is not intended for use by individuals under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected data from a minor, we will delete it promptly. If you believe a minor has provided us with personal data, please contact us at [email protected].

13. Grievance Officer

In accordance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, the designated Grievance Officer for VahanTag is:

14. Contact Information

For any privacy-related questions or concerns, please contact us:

15. Changes to This Policy

We may update this privacy policy from time to time. When we make material changes, we will notify registered users via WhatsApp/SMS and update the "Last updated" date at the top of this page. Continued use of VahanTag after changes constitutes acceptance of the revised policy.