Privacy Policy

Who we are

This policy covers two mobile apps: CarKey Partner (for driver partners) and CarKey: Hire a Driver (for customers), and this website. The partner app launches first. The customer app is coming soon.

The apps are operated by R Nithin (trading as CarKey), 10, 13th Cross, Vigneshwara Nagar, Sunkadakatte, Bengaluru 560091 ("CarKey", "we", "us"). For the personal data we collect through the apps, we are the "data fiduciary" under India's Digital Personal Data Protection Act, 2023 ("DPDP Act").

What we collect

Partner app

When you sign up:

• Name and phone number (used for one-time-password login)
• Profile photo
• Driving licence number and date of birth
• A photo of your driving licence
• A copy of your police verification certificate
• A proof-of-address document
• Your experience
• Blood group (optional)
• Emergency contacts
• Your referral code

While you use the app:

• Your location while you are on duty
• Trip records, ratings and comments, and chat messages
• Earnings and wallet records
• Verification status and review notes
• Your device notification token
• Crash data

Later, when you set up payouts:

• Your PAN
• Your UPI QR and bank or UPI payout details

Customer app (coming soon)

• Phone number (used for one-time-password login) and name
• Approximate and precise location during a booking
• Saved addresses
• Vehicle details
• Booking and payment records

Location

We collect location only while the app is open. The partner app records your location only while you are on duty, and clears your last location when you go off duty or request deletion. We do not collect location in the background.

Why we use your data

• To create your account and log you in.
• To create, match, carry out and support bookings.
• To check a partner's eligibility and identity before their account is activated.
• To record earnings, wallet balances and payouts.
• To send notifications about your account and bookings.
• To keep the apps secure, fix crashes and prevent fraud and misuse.
• To meet legal obligations and respond to lawful requests.

Legal basis

We process your personal data on the basis of your consent, which you give when you sign up and use features such as location. You can withdraw consent at any time, though some features may then stop working. We also process data for the "legitimate uses" the DPDP Act allows, such as complying with the law and responding to emergencies.

Partner verification and documents

Before we activate a partner account, CarKey reviews three things: the partner's driving licence details, a police verification certificate and one proof of address. CarKey checks a partner's driving licence details on the government Parivahan portal. Partners obtain the police verification certificate and provide the proof of address themselves; CarKey does not carry out police verification.

Why we collect each item

• Date of birth, driving licence number and licence photo: to check eligibility to drive and to confirm the licence is valid.
• PAN: to check identity, prevent fraud and meet tax obligations.
• Police verification certificate: to help keep customers safe and to check a partner's identity.
• Proof of address: to confirm identity and where a partner lives.
• Earnings and wallet records, and payout details: to pay partners.
• Verification status and review notes: to record our decision, and to prevent fraud and repeat sign-ups.

Your documents are used by CarKey to verify you. Customers see only your name, photo, rating and, during a trip, your live location.

Who we share data with

We do not sell your personal data. We share it only as needed to run the service:

• Between customer and partner: during a booking, the customer sees the partner's name, photo and location, and the partner sees the customer's name, booking details and pickup location. Your documents are used by CarKey to verify you.
• Service providers who process data on our behalf for the partner app:
  • Supabase: hosting, database, login and file storage. Our Supabase project is hosted in Singapore, so data is processed outside India.
  • Fast2SMS: sending one-time-password SMS.
  • Google Firebase: push notifications and crash reports.
• Authorities where required by law or to protect safety.

We do not use a payment provider yet.

How long we keep data

We keep personal data only as long as needed for the purposes above.

• Account data: Deleted when your account deletion is completed
• Trip and payment records: We keep trip and payment records only for as long as accounting, tax and legal requirements need, then delete them.
• Partner documents: Deleted when your account deletion is completed
• Crash data: Up to 90 days

When you delete your account, see Delete account for what is removed and what is kept.

Security

Data is sent over encrypted connections. No system is completely secure, so we cannot guarantee absolute security. If a personal data breach affects you, we will notify you and the authorities as the law requires.

Your rights

Under the DPDP Act you have the right to:

• access a summary of the personal data we hold about you;
• correct inaccurate or incomplete data;
• ask us to erase your data (see Delete account);
• get your grievances addressed;
• nominate another person to exercise your rights if you die or become incapacitated.

To use these rights, email support@getcarkey.in. If you are not satisfied, contact our grievance officer below. You may also complain to the Data Protection Board of India.

Children

Our apps are only for people aged 18 or over. We do not knowingly collect data from anyone under 18. If you believe a child has given us data, write to us and we will delete it.

Changes to this policy

We may update this policy. The "Last updated" date at the top shows the latest version. For material changes we will tell you in the app or by another suitable means.

Support & contact

Questions: support@getcarkey.in

Grievance officer: Gokul Krishna, grievance@getcarkey.in

Address: R Nithin (trading as CarKey), 10, 13th Cross, Vigneshwara Nagar, Sunkadakatte, Bengaluru 560091