Privacy Policy

# Privacy Policy — Courier Sarathi ## 1. Introduction and Data Fiduciary Courier Sarathi ("we," "us," or "our") is committed to protecting the privacy of its Members. This Privacy Policy explains how we collect, use, and share your personal data when you use our mobile application (the "Platform"). **1.1 Data Fiduciary.** For the purposes of the Digital Personal Data Protection (DPDP) Act, 2023, the operator of Courier Sarathi acts as the "Data Fiduciary," determining the purpose and means of processing your personal data. **1.2 Consent.** By creating an account and using the Platform, you provide your informed and voluntary consent to the processing of your personal data for the specific purposes outlined in this policy. You have the right to withdraw this consent at any time by deleting your account, subject to the retention rules defined in Article 5. --- ## 2. The Data We Collect We collect data to provide a safe, peer-to-peer matching service. This collection is categorized as follows: ### 2.1 Information You Provide Directly - **Account Data:** Your name, mobile number (verified via SMS OTP), and optional email address. - **Profile Data:** Your profile photograph and, if you are a Sarathi, your vehicle type and fuel type. - **Verification Data (KYC):** A photograph of your Driving Licence and a "Liveness Selfie" (holding your ID) for identity confirmation. - **Mission Data:** Details about the Parcel (type, weight, and Declared Value) and the Receiver's contact information. ### 2.2 Information Collected via App Permissions To function correctly, the Platform requests the following permissions. We do not use these permissions for any purpose other than those stated: - **Location (`ACCESS_FINE_LOCATION`):** Used to match you with nearby Adverts, calculate Trip distances, and provide real-time status updates during an Active Mission. - **Camera (`CAMERA`):** Used for setting your profile picture, capturing mandatory Parcel Photos at pickup/delivery, and uploading KYC documents. - **Notifications (`POST_NOTIFICATIONS`):** Used to send critical mission updates (e.g., "Sarathi has arrived") and security alerts. ### 2.3 Automatically Collected Technical Data We use Firebase and Google Cloud infrastructure to collect technical identifiers such as your Device ID, IP address, and FCM Token (for notifications) to ensure account security and platform stability. --- ## 3. How We Use Your Data (Purpose Limitation) In accordance with the "Purpose Limitation" principle of the DPDP Act, we process your data only for the following specified purposes: - **Service Provision:** To create and manage your account, facilitate matching between Sarathis and Senders, and calculate suggested cost-sharing fees. - **Identity Verification:** To process your KYC documents (Driving Licence and Selfie) to ensure the safety of the platform and its members. - **Mission Execution:** To generate and verify Handshake OTPs and store Parcel Photos as digital proof of pickup and delivery. - **Safety & Security:** To monitor for fraudulent activity, unauthorized account access, or the transport of prohibited items. - **Communication:** To send you mission status updates, safety alerts, and respond to your queries through our support channels. - **Dispute Resolution:** To utilize stored mission data (logs, photos, and timestamps) to facilitate the resolution of disputes raised via the app. --- ## 4. Data Sharing and Disclosure Courier Sarathi does not sell your personal data to third parties. We only share data in the following limited circumstances: - **With Other Members:** Once a Sarathi accepts a Booking, we share your name, mobile number, and the designated Meeting Point with the other party (and the Receiver) to coordinate the mission. - **Service Providers:** We share data with trusted third-party service providers who assist in operating the Platform, such as Google Firebase (for database, auth, and hosting) and Google Maps API (for location services). These providers are contractually bound to protect your data. - **Legal Requirements:** We may disclose your data to law enforcement, government authorities, or courts in Maharashtra or elsewhere in India if required by law or to protect the safety of our Members. --- ## 5. Data Retention and Purge Policy - **Active Data:** We retain your account and profile data for as long as your account is active. - **KYC Document Retention:** As a specific safety measure, images of your Driving Licence and Liveness Selfie are retained for a period of 90 days from the date of submission or the completion of your last mission. This allows a window for safety audits and investigating reported issues. - **Purge and Anonymization:** When you delete your account: - Your profile photo, identity documents, and contact details are permanently deleted. - Historical mission records are anonymized. We remove all links to your legal identity, replacing them with a "Deleted User" tag to maintain the integrity of our transaction logs for tax and audit purposes. --- ## 6. Your Rights under the DPDP Act, 2023 You have full control over your data. You may exercise these rights through the app settings or by contacting our Grievance Officer: - **Right to Access:** You can view your personal data and mission history at any time within the app. - **Right to Correction:** You can update your profile information via the "Edit Profile" screen. - **Right to Erasure:** You can request the deletion of your account. - **Right to Withdraw Consent:** You may withdraw your consent for data processing at any time by deleting your account, though this does not affect the legality of processing performed prior to the withdrawal. --- ## 7. Data Security We utilize industry-standard security measures provided by Google Cloud and Firebase, including SSL/TLS encryption for data in transit and AES-256 encryption for data at rest. While we take every precaution, no method of electronic storage or transmission is 100% secure, and you use the Platform at your own risk. --- ## 8. Grievance Redressal If you have any questions about this Privacy Policy or how your data is handled, you may contact our designated Grievance Officer: - **Officer Name:** Kartik Kurhade - **Email:** kartikkurhade@couriersarathi.com - **Address:** Maharashtra, India. We will acknowledge your grievance within 48 hours and seek to resolve it within 30 days.