Privacy Policy

1. What We Collect

We collect the following categories of personal data when you use rentie:

• Identity: Full name, date of birth
• Contact: Mobile number, email address
• Document: Driving licence number; last 4 digits of Aadhaar only (see Section 5)
• Booking history: Vehicles rented, rental dates, shops visited, fare paid
• Payment: Razorpay transaction IDs, payment method type (no card numbers stored by us)
• Device & network: IP address, browser user-agent, device type — collected for fraud prevention and platform security only

We do not collect your full Aadhaar number, caste, religion, biometric data, or financial account credentials.

We do not knowingly collect personal data from individuals under 18. This platform is restricted to users aged 18 and above.

2. Why We Collect It

• Vehicle rental management: To process and manage your bookings, issue digital tickets, and communicate with rental shops
• KYC verification: As required by rental shops to verify your identity and driving eligibility before handing over a vehicle
• Payments: To process rentals fees securely via Razorpay
• Fraud prevention: To detect and prevent misuse, double-bookings, and stolen-identity bookings using device and IP data
• Notifications: To send booking confirmations, OTPs, and ride receipts via WhatsApp and SMS
• Service improvement: To improve platform reliability and rental shop quality (aggregated, anonymised analytics only)

3. Third-Party Services

We share your data with the following service providers only to the extent necessary for them to perform their function. They are prohibited from using your data for their own purposes.

• Supabase (Supabase Inc., USA) — our cloud database. Your data is stored on Supabase servers hosted in the ap-south-1 region. Supabase Privacy Policy
• Razorpay (Razorpay Software Pvt. Ltd., India) — payment processing. Your payment details are handled directly by Razorpay under RBI-regulated PCI-DSS standards. Razorpay Privacy Policy
• Meta WhatsApp (Meta Platforms Inc., USA) — transactional notifications (booking confirmations, ride receipts, OTPs). We use WhatsApp Business API via approved message templates only. WhatsApp Privacy Policy
• Surepass (Surepass Technologies Pvt. Ltd., India) — Aadhaar and driving licence KYC verification. Only the verification result is retained; raw document images are not stored by us. Surepass Privacy Policy
• Sentry (Functional Software Inc. dba Sentry, USA) — application error monitoring. Error logs may contain partial request data; they are retained for 90 days and are not used for any purpose other than debugging. Sentry Privacy Policy
• Rental shops — the tenant shops on our platform receive your name, phone number, driving licence number, and booking details for the specific booking you make with them. They do not receive data about bookings you have made at other shops.

We do not sell, rent, or trade your personal data to advertisers or data brokers.

4. Aadhaar Handling

In compliance with UIDAI guidelines and the DPDP Act 2023, rentie follows these strict rules for Aadhaar data:

• We store only the last 4 digits of your Aadhaar number after verification is complete.
• Your full 12-digit Aadhaar number is never retained by us after the KYC check is done. It is transmitted directly to Surepass over an encrypted connection for the verification API call only.
• We do not store Aadhaar XML, e-Aadhaar PDFs, or face-authentication data.
• Aadhaar-based verification is optional — shops may accept other government IDs (passport, voter ID, driving licence) in lieu of Aadhaar.

5. Data Retention

• Booking records: Retained for 3 years from the booking date, as required for financial and legal compliance.
• Personal data (non-booking): Deleted within 90 days of a valid deletion request being submitted via /account/delete, in accordance with DPDP Rules 2025, Rule 14.
• Refresh tokens: Automatically purged after 30 days of inactivity.
• Error logs (Sentry): Retained for 90 days.
• Device & IP data: Retained for 90 days for fraud prevention, then deleted.

6. Your Rights

Under the DPDP Act 2023, you have the following rights:

• Right to access: Request a copy of all personal data we hold about you at /account/export. We will deliver it in JSON format within 7 working days.
• Right to deletion: Request deletion of your personal data at /account/delete. Note: booking records required for legal compliance cannot be deleted before the 3-year retention period expires.
• Data portability: Your exported data at /account/export is in machine-readable JSON format, portable to any compatible service.
• Right to correction: Contact us at support.rentie.shop@gmail.com to correct inaccurate information.
• Right to grievance redress: Raise a complaint within our 30-day resolution window (see Section 9), or escalate directly to the Data Protection Board of India.

7. Consent

• Consent checkboxes in our booking flow are not pre-ticked. You must explicitly opt in.
• Marketing WhatsApp messages (promotional offers, new shops) require separate explicit opt-in and are never sent on the basis of booking consent alone.
• You may withdraw marketing consent at any time by replying "STOP" to any WhatsApp message or emailing support.rentie.shop@gmail.com.
• Withdrawal of marketing consent does not affect your ability to receive transactional messages (OTPs, booking confirmations, ride receipts), which are necessary for service delivery.

8. Cookies & Local Storage

We use session storage and HTTP-only cookies to maintain your login session securely. We do not use third-party advertising cookies, tracking pixels, or fingerprinting.

• auth_token (HTTP-only cookie): Authentication session. Expires in 15 minutes.
• refresh_token (HTTP-only cookie): Login persistence. Expires in 30 days.

These cookies are strictly necessary for the platform to function. No consent banner is shown for strictly necessary cookies under applicable law.

9. Governing Law & Grievance Officer

This Privacy Policy is governed by the laws of India, specifically the Digital Personal Data Protection Act, 2023 and applicable rules thereunder.

Grievance Officer:
VBH Studios — rentie Platform
Email: support.rentie.shop@gmail.com
Response time: within 30 days of receipt of complaint.

If your grievance is not resolved within 30 days, you may escalate to the Data Protection Board of India once constituted under the DPDP Act 2023.

10. Changes to This Policy

We may update this Privacy Policy when our practices change or when the law requires it. Material changes will be notified via WhatsApp or email at least 7 days before taking effect. Continued use of the platform after the effective date constitutes acceptance of the revised policy.