Privacy Policy
Last updated: 27 October 2026 (v2)
GoSarthik is operated by SVNIX Solutions Private Limited ("GoSarthik", "we", "us"), Innov8, 3rd Floor, Orchid Centre, Rapid Metro Station, Sector 53, Gurugram, Haryana 122022, India. We are the Data Fiduciary for the personal data processed through the GoSarthik customer app, the GoSarthik Driver app and gosarthik.com, under the Digital Personal Data Protection Act, 2023 ("DPDP Act"). This policy explains what we collect, why, how long we keep it, who we share it with, and the rights you have.
1. What we collect and why
We collect only what the service needs. Nothing below is sold or used for advertising.
| Data | Who | Purpose | Kept for |
|---|---|---|---|
| Mobile number, name, email (optional) | Customers, drivers | Account creation, OTP login, booking communication | While your account exists and up to 5 years after it is closed (dispute resolution, fraud prevention, lawful requests) |
| Your car: registration number, brand, model, fuel and gearbox type | Customers | So the driver finds the right car and knows what they will drive; saved to your account so you need not type it again. The registration number may later be used to fetch public vehicle registration details from a government-authorised service, which we will tell you about before we start | Until you remove the car in the app or close your account; booking records keep the number for 8 years |
| Business name and GSTIN (optional) | Customers | Printing a GST invoice for business bookings when you switch that on | Until you change them; invoices 8 years (tax law) |
| Pickup / drop addresses, saved places | Customers | Fulfilling your bookings | Booking records: 8 years (tax law); saved places: until you remove them in the app |
| Precise location while checked in or on a trip | Drivers | Sending nearby bookings, live tracking for the customer, safety. Shared in the background only while you are checked in or on a trip | Only your latest position is stored and overwritten on each update; trip records keep pickup and drop points, not the route |
| Live location (optional) | Customers | Family Safety sharing you start yourself | Until the share ends (max 8 hours) |
| Identity documents — driving licence (photos, number and date of issue, which must show at least two years of driving), Aadhaar, PAN (photos and document numbers) | Drivers | Verifying that you may drive and who you are; fraud prevention; answering lawful requests from police or courts | While you are a driver and up to 5 years after your account is closed. Aadhaar numbers are stored masked (last 4 digits only) |
| Selfie photo and a short self-introduction video (your face and voice) | Drivers | Confirming the person signing up is the person on the documents (manual review by our team); fraud prevention; lawful requests. Face detection runs on your phone only to check a face is visible — no biometric template is created or stored | While you are a driver and up to 5 years after your account is closed |
| Check-in / check-out selfies | Drivers | Attendance and safety (the customer meets the verified driver); fraud prevention; lawful requests | While you are a driver and up to 5 years after your account is closed |
| Bank account / UPI details | Drivers | Paying your earnings | Until you change them; payout records 8 years |
| Payment details | Customers | Collecting fares, wallet top-ups and refunds. Card/UPI details are entered on Razorpay's pages and never stored by us; we keep the transaction reference, amount and status | 8 years (tax law) |
| Ratings, reviews, support messages, in-app chat | Both | Service quality, dispute resolution | Kept with the booking record (8 years) for dispute resolution and lawful requests |
| Device token, device model, OS version, app version | Both | Push notifications, crash fixes, update prompts | Until you log out or delete your account |
| Crash reports and app-usage events (screens opened, errors), with a device identifier and your account id — never your phone number | Both | Finding and fixing crashes, understanding which features are used (Firebase Crashlytics / Analytics). Not used for advertising | 90 days (crash data), 14 months (usage events) |
- Data about you from others: ratings and reports from the other party to a booking; a referral code entered at signup links you to the person who referred you.
- Automated matching: bookings are offered to drivers automatically, ranked by distance to the pickup, service zone, vehicle qualification and the driver's score (ratings, cancellations, punctuality, compliance). No automated decision uses your data for advertising or profiling beyond this; you may ask the Grievance Officer to review a matching or scoring outcome.
- Website: gosarthik.com sets no tracking cookies; only the session needed for the admin login.
2. Legal basis and consent
- Creating an account and using the service is based on your consent, given when you sign up and shown again at the step where sensitive data (documents, selfie, video, background location) is collected. You can withdraw consent at any time by closing your account; we then stop all active processing (no bookings, messages or notifications), but the records listed above are retained for the stated periods for accounting, fraud prevention and lawful requests.
- The apps ask you to tick "I agree to the Terms & Conditions and Privacy Policy" before an OTP is sent. We record the date and time of your acceptance against your account as proof of consent, and keep it for as long as we keep your account records.
- Some processing is a legal obligation (tax records, responding to lawful requests from police or courts) or is needed to deliver the booking you asked for.
- We record the time you accepted these terms and, for drivers, the time you agreed to the identity-verification capture.
3. Who we share data with (Data Processors)
Only what each needs, under contract, never for their own marketing:
- Supabase (database, authentication, file storage; hosted on AWS, Mumbai region).
- Razorpay (payments, refunds and payouts; RBI-regulated).
- MSG91 (OTP and transactional SMS, TRAI-DLT registered).
- Google Firebase (push notifications, Crashlytics crash reports and Analytics usage events — no advertising features enabled); Google ML Kit runs on your device only.
- Netlify (website and admin hosting).
- The other party to your booking: the customer sees the driver's name, photo, rating, vehicle qualification and live location during the trip; the driver sees the customer's name, phone number and pickup/drop address.
- Police, courts and regulators: on a lawful request, and on our own initiative when a user is reported for a crime (fraud, theft, harassment, sexual misconduct, assault, dangerous driving), we share that user's identity, verification records, trip, location and chat records with the authorities, without notice to the user where notice could prejudice the investigation. Professional advisers receive data under confidentiality.
Data is stored in India. We do not transfer personal data outside India except where a processor above routes traffic through global infrastructure under equivalent safeguards.
4. Your rights
- Access and correction: see and edit your profile in the app (Account › Edit profile). For a copy of other data, write to us.
- Closing your account: Account › Delete my account in either app, or the steps at gosarthik.com/delete-account. Your login is disabled and push tokens are removed immediately, and we stop all active processing. We do not erase your records: profile, booking, payment and payout records are retained as tax law requires, and driver identity documents, selfie and video are kept for up to 5 years after closure solely for fraud prevention and lawful requests. We do not delete data on request where this retention applies; you may still ask us to correct inaccurate data.
- Withdraw consent: stop location sharing from the app at any time; revoke app permissions in your phone settings (some features will stop working).
- Grievance: contact the Grievance Officer below. We acknowledge within 48 hours and resolve within 15 days. If unresolved you may approach the Data Protection Board of India.
- Nominate a person to exercise these rights for you, as the DPDP Act allows, by writing to us.
5. Security
All traffic is encrypted (TLS). Databases use row-level security so each account can read only its own records; document, selfie and video files live in private storage buckets and are served only through short-lived signed links to our verification staff. Payment credentials never touch our systems. Access by staff is role-based and logged. We will notify you and the Data Protection Board of a personal data breach as the DPDP Act requires.
6. Children
Our services are for adults. Drivers must be 18 or older (date of birth is checked at signup). We do not knowingly collect data from children; if you believe a child has created an account, contact us and we will delete it.
7. Changes
We will notify you in the app before material changes take effect. The date at the top shows the current version.
8. Grievance Officer and contact
Grievance Officer, SVNIX Solutions Private Limited
Innov8, 3rd Floor, Orchid Centre, Rapid Metro Station, Sector 53, Gurugram, Haryana 122022
Phone: +91 88008 97727
Email: contact@gosarthik.com · contact@gosarthik.com (general support)