Privacy Policy

Last updated: 9 September 2026

This Privacy Policy describes how GaadiMate ("we," "us," or "our") collects, uses, and protects your personal data when you use the GaadiMate mobile application and website (collectively, the "Service"). It is issued in compliance with the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Information Technology Act, 2000.

1. Who we are

GaadiMate is operated by Shweta Chaudhary as a sole proprietorship based in India. For the purposes of the DPDP Act, we are the "Data Fiduciary" responsible for processing your personal data. You, the user, are the "Data Principal."

2. Data we collect

We collect only the minimum data needed to provide the Service.

2.1 Vehicle information

• Vehicle Registration Number (e.g. DL3CAB1234)
• RC details: make, model, variant, fuel type, registration date, owner name as it appears on the RC, chassis and engine numbers (only the last 4 digits are stored; the rest is masked)
• Insurance details: insurer name, policy number, expiry date
• Pollution Under Control (PUC) certificate validity
• Traffic challan (e-challan) records, fetched against your registration number when you ask for them
• Service history you enter or upload (dates, kilometres, work performed)
• Photographs of service center bills you choose to scan

2.2 Account and contact information

• Phone number (optional, for OTP-based sign-in). Signing in establishes an identity and nothing more: your vehicles, service history, bills, and reminders stay on your device and are not uploaded to an account.

2.3 Optional data

• Vendor contacts you save yourself (name, phone number, address, opening hours) — kept on your device so your mechanic, tyre shop, or towing contact is at hand, including on the emergency screen

2.4 Technical data

• App version and the advisor's prompt revision — sent only with the optional advisor quality records described in Section 4

3. How we use your data

• To track renewal dates (PUC, insurance, scheduled service) and remind you before they expire
• To suggest service intervals based on your vehicle's manufacturer recommendations
• To analyse service center bills you upload, comparing line items against typical service schedules and flagging items that may not be necessary
• To answer questions you ask the in-app advisor about your vehicle, using the records you already hold in the app
• To show you the vendor contacts you have saved, including from the emergency screen
• To improve the advisor using de-identified records of advisor questions and answers — only if you turn on “Help improve GaadiMate” in Settings, which is off by default

4. Where your data is stored

The vast majority of your vehicle data lives on your device, not on our servers. A local SQLite database on your phone holds your vehicle records, service history, reminders, and uploaded bill images.

Data is transmitted off your device only in the following situations:

• Vehicle verification: When you add a vehicle, your registration number is sent to GaadiMate's backend, which forwards it to our vehicle-records provider to fetch the official RC, insurance, and PUC details. The same route is used when you ask for your traffic challan records. Our provider credentials are held by the backend; the app never holds them.
• Bill analysis: If you choose to scan a service bill, the bill image itself is sent to GaadiMate's backend, which forwards it to our AI provider to read and analyse. Every scan works this way — a single photo, a multi-page bill, or a PDF — and pages are resized before they are sent. Your device also reads the photo on its own to suggest which of your vehicles the bill belongs to; that on-device reading is not sent anywhere. GaadiMate's backend does not store bill images or the text read from them; only minimal request metadata (timestamp, response time, token counts, error kind, and a hashed device identifier) is logged for operational purposes. Under our provider terms, this data is not retained for model training.
• Advisor and monthly report: When you ask the in-app advisor a question or open a monthly report, a de-identified summary of that vehicle's records is sent to GaadiMate's backend and on to our AI provider. The summary is assembled so that it carries no owner name, no full registration number, no chassis or engine number, no phone number, no address, and no policy number. Your typed question is scrubbed the same way before it is sent. Apart from the request metadata described above, the optional quality records described next, and — during the testing period only — the advisor transcripts described below, the content of these conversations is not stored on GaadiMate's backend.
• Advisor quality records (optional, off by default): If you turn on “Help improve GaadiMate” in Settings, a de-identified record of the question, the answer, and the vehicle's make, model, year, and fuel type is stored on GaadiMate's backend and used to improve the advisor. It carries no registration number, owner name, phone number, address, or location.
• Advisor transcripts during the testing period: While GaadiMate is in testing, the question you asked the advisor and the answer it gave are stored on GaadiMate's backend so we can find and fix bad answers. This is separate from the optional quality records above and is not controlled by that switch: during testing it applies to every advisor conversation. The text is de-identified before it is stored — it carries no owner name, no full registration number, and no chassis or engine number — and it is keyed to a hashed device identifier, not to your name. These transcripts are deleted, and this collection stops, when GaadiMate leaves testing. You can ask us to delete yours sooner at privacy@gaadimate.in.
• Sign-in (optional): If you choose to sign in, your phone number is sent to GaadiMate's backend and held there to establish your sign-in identity. No vehicle, bill, or reminder data is uploaded with it.
• Diagnostics: We record processing timings and error categories for scans and advisor requests — no bill contents, amounts, or personal details — so we can find and fix failures.

GaadiMate's backend runs on a third-party hosting and database provider, which processes the data described above on our behalf. We use no third-party crash-reporting or analytics SDK inside the app. The app does send GaadiMate's own crash records, which carry the error type and the screen it happened on but never the error message or the stack — only a one-way fingerprint of the message, computed on your device, so two reports of the same fault can be grouped without carrying what either of them said.

5. Sharing of personal data

We do not sell your personal data. We do not share it with insurers, dealers, advertisers, or marketers. Personal data is shared only with the third-party processors listed in Section 4, and only to the extent necessary to provide the Service.

6. Your rights as a Data Principal

Under the DPDP Act, you have the following rights:

• Right to access: Request a summary of the personal data we hold about you and the processors with whom it has been shared.
• Right to correction and completion: Request correction of inaccurate or incomplete data.
• Right to erasure: Request deletion of your data. Since most data is on your device, you can also delete it directly by uninstalling the app or clearing app data from your device settings.
• Right of grievance redressal: Raise concerns with our Grievance Officer (see Section 11).
• Right to nominate: Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.

To exercise any of these rights, email privacy@gaadimate.in. We will respond within 30 days.

7. Withdrawal of consent

Where processing is based on your consent, you may withdraw it at any time. Withdrawing consent for vehicle verification will not affect data already fetched, but it will prevent further verification calls. You can turn off “Help improve GaadiMate” in Settings at any time, and you can sign out to stop using the optional account.

8. Children's data

The Service is not intended for users under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at privacy@gaadimate.in and we will delete it.

9. Data retention

On-device data is retained until you delete it or uninstall the app. Data sent to our vehicle-records provider and to our AI provider is governed by their respective retention policies. On GaadiMate's backend we retain the request metadata described in Section 4, your sign-in identity for as long as you keep the account, and — only if you switched it on — the de-identified advisor quality records.

10. Security

The app holds no vendor API keys at all — the credentials for our vehicle-records and AI providers live on GaadiMate's backend. Your device's secure keystore (iOS Keychain / Android Keystore) holds the app's own per-device token and, if you sign in, your sign-in session. All network communication uses HTTPS. Despite our efforts, no system is completely secure; we will notify affected users and the Data Protection Board of India in the event of a personal data breach as required by law.

11. Grievance Officer

12. Cross-border data transfer

Some processors handle data outside India: GaadiMate's backend runs on our hosting provider's infrastructure in Singapore, and our AI provider may process data outside India. We rely on contractual safeguards with these processors. As of the date of this policy, no country has been notified by the Government of India under Section 16 of the DPDP Act as restricted for transfer.

13. Changes to this policy

We may update this policy from time to time. Material changes will be notified within the app and by email at least 14 days before they take effect.

14. Contact

For any questions about this Privacy Policy, contact us at privacy@gaadimate.in.