Privacy Policy

The Ride Sharing (the "Platform") is operated by Swenid Private Limited ("Swenid", "we", "us", "our"), a company incorporated under the Companies Act, 2013, having its registered office at 5, Krishna Park Society, Berna Road, Balwantpura, Himatnagar, Sabarkantha, Gujarat - 383001, India (CIN: U62099GJ2026PTC173653).

This Privacy Policy explains how Swenid collects, uses, shares, retains, and protects personal data when you access the Platform as a Driver, Passenger, or visitor. It is published in compliance with:

• The Information Technology Act, 2000 (Section 43A) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules");
• The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021;
• The Digital Personal Data Protection Act, 2023 ("DPDP Act");
• The Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 and the Aadhaar (Authentication and Offline Verification) Regulations, 2021;
• The Consumer Protection (E-Commerce) Rules, 2020;
• The Motor Vehicles Act, 1988 and rules thereunder, to the extent applicable.

By using the Platform, you confirm you have read and understood this Policy and consent to the processing of your data as described.

• Personal Data: Data about an individual who is identifiable by or in relation to such data.
• Data Principal: The individual to whom the Personal Data relates.
• Data Fiduciary: Swenid Private Limited.
• Sensitive Personal Data or Information (SPDI): As defined in Rule 3 of the SPDI Rules, 2011.
• API Setu: The Government of India's API exchange platform operated by NeGD/MeitY (apisetu.gov.in).
• DigiLocker: The digital document service operated by DigiLocker Authority under MeitY.

3.1 Information you provide directly

• Identity & contact: Name, gender, date of birth, mobile number, email, profile photograph, emergency contact.
• Account credentials: Password (stored only as a salted hash), MPIN/biometric unlock token (if you enable it; the token is stored on your device, not on our servers).
• Driver-specific: Driving Licence number and validity, vehicle registration number, RC details, third-party motor insurance details, PUC certificate, vehicle make/model/colour, bank account details for settlement (account number stored in tokenised form by our payment processor).
• Government ID for verification (Driving Licence, Aadhaar via DigiLocker, RC): See Section 7 for our zero-storage commitments.
• Trip data: Pickup and drop locations, route, timestamps, fellow co-travellers (for matching), in-app messages with the matched party.
• Communications & support: Messages you send to support, ratings, reviews, feedback, complaint records.

3.2 Information collected automatically

• Device & technical data: Device model, OS version, IP address, app version, language, time zone, crash logs, push-notification token.
• Location data: With your explicit, granular consent, real-time GPS location while the app is running and during an active Ride. Background-location collection (if you enable it) is used solely for live trip tracking and SOS, never for advertising. You may revoke location permission at any time from your device settings.
• Usage analytics: Pages/screens viewed, features used, error events. We use first-party analytics; we do not enable cross-site advertising profiling.
• Cookies & similar technologies: See Section 12.

3.3 Information from third parties

• API Setu / DigiLocker: The verification result and the minimal demographic fields specified in Section 7.
• Payment gateway (our Payment Aggregator): Transaction status, masked instrument details, dispute/chargeback notifications.
• SMS / Email providers: Delivery status of OTPs and notifications.

Where we rely on consent we ask for it through a clear affirmative action (an unticked checkbox or "I Agree" button) before collection begins, in plain English (with Hindi/Gujarati translations available in-app). Consent is itemised: location, contacts (if requested), camera (for KYC selfie), microphone (only if you initiate a call), notifications, and identity verification each have their own consent.

You may withdraw consent at any time through the in-app Privacy Centre or by writing to our Grievance Officer (Section 15). Withdrawal does not affect lawfulness of processing carried out before withdrawal, and may limit our ability to provide certain services (for example, an unverified Driver cannot accept Rides).

We do not sell Personal Data. We share only as follows:

• Between matched Driver and Passenger: First name, profile photograph, rating, vehicle details (Driver only), masked phone number through a virtual-number proxy service. Full phone numbers are not exchanged.
• Service Providers (Data Processors), each under a written contract with DPDP-aligned safeguards:
  • Identity verification: API Setu / DigiLocker, Aadhaar User Agencies (AUAs), KYC User Agencies (KUAs), Authentication Service Agencies (ASAs) — only as authorised under the Aadhaar Act and only via Government-authorised channels;
  • Payments: our Payment Aggregator (PCI-DSS compliant);
  • SMS / Email: licensed Indian providers;
  • Cloud hosting: enterprise providers with data centres in India;
  • Mapping & routing: Google Maps / OpenStreetMap services;
  • Analytics & crash reporting: privacy-respecting first-party analytics; we disable advertising-ID collection.
• Legal disclosure: When required by law, court order, or a valid request from a competent government authority. We notify the Data Principal where lawful.
• Corporate transactions: In the event of a merger, acquisition, or asset sale, with notice to affected users.
• Safety: If we have a good-faith belief that disclosure is necessary to prevent imminent harm.

We implement Reasonable Security Practices and Procedures as required under Section 43A of the IT Act, 2000 and align to ISO/IEC 27001 principles:

• TLS 1.2+ for all data in transit; AES-256 for sensitive fields at rest;
• Network segmentation, least-privilege IAM, multi-factor authentication for administrative access;
• Hashed and salted credentials; tokenised payment instruments;
• Centralised audit logs, intrusion-detection monitoring, regular vulnerability assessments and penetration testing;
• Confidentiality obligations and security training for all personnel;
• A documented incident-response plan with defined severity levels and escalation paths;
• Periodic third-party security audits.

Breach Notification. In the event of a Personal Data breach likely to result in risk to your rights, we will notify the Data Protection Board of India and the affected Data Principals in the form and within the timelines prescribed under the DPDP Act. Notification will include the nature of the breach, categories and approximate number of Data Principals affected, likely consequences, and the measures taken or proposed.

We retain Personal Data only for as long as necessary for the purposes for which it was collected, or as required by applicable law (whichever is longer). Indicative retention:

On expiry of the retention period or upon a verified erasure request (subject to statutory retention), data is securely deleted or irreversibly anonymised.

Subject to applicable law, you have the right to:

• Access: Obtain a summary of the Personal Data we process about you and the identities of Data Processors with whom it has been shared.
• Correction & Updation: Correct, complete, or update inaccurate or outdated data.
• Erasure: Request deletion of Personal Data that is no longer necessary for the purpose collected (subject to statutory retention obligations).
• Withdrawal of Consent: Withdraw any consent previously given.
• Grievance Redressal: Lodge a complaint with our Grievance Officer; if unresolved, escalate to the Data Protection Board of India and to the Grievance Appellate Committee under Rule 3A of the IT Rules 2021 at gac.gov.in.
• Nomination: Nominate another individual to exercise your rights in the event of death or incapacity.
• Account Deletion: Initiate account deletion through Settings > Privacy Centre > Delete Account, or by writing to the Grievance Officer.

To exercise any right, write to the Grievance Officer (Section 15). We respond within the timelines prescribed under the DPDP Act and, in any event, within 30 days. We may need to verify your identity before acting on a request.

The Platform is intended only for users aged 18 and above. We do not knowingly collect Personal Data of children. If we become aware that a child's data has been collected, we will delete it promptly. A parent or guardian who believes a child has provided data may contact the Grievance Officer.

The Platform uses strictly necessary first-party cookies for session management, security, and language preference. With your consent, we use first-party analytics cookies to understand usage patterns. We do not enable cross-site advertising profiling. You can disable non-essential cookies from the in-app Privacy Centre or your browser; this may affect functionality.

Personal Data is primarily stored on servers located in India. To the extent any data is processed by service providers in jurisdictions outside India, such transfer is carried out only to jurisdictions permitted under the DPDP Act and subject to contractual safeguards.

The Platform may integrate or link to third-party services (our payment processor, Google Maps, telecom virtual-number providers, etc.). Their handling of your data is governed by their own privacy notices. We carry out due diligence on each provider but are not responsible for their practices.

In compliance with Rule 3(2) and Rule 4 of the IT (Intermediary Guidelines) Rules 2021, the Consumer Protection (E-Commerce) Rules 2020, and the DPDP Act 2023:

We acknowledge complaints within 24 hours and resolve them within 15 days, except where law permits a longer period. If you are dissatisfied, you may approach the Data Protection Board of India or the Grievance Appellate Committee at gac.gov.in.

We may update this Policy from time to time. Material changes will be notified by in-app notice and email at least 7 days before they take effect. The "Last Updated" date at the top reflects the most recent revision. Continued use after the effective date constitutes acceptance.

For all privacy queries, support requests, and grievances:

Email: info@swenid.com  |  Phone: +91-7041325320