Privacy policy

What we collect, and why

• Your name, mobile number and email address, so we can create your account, sign you in with a one-time password, and send you service messages.
• Your business profile: business name and contact details, vehicle model and number, driving licence number, tax identifier, UPI ID and logo. We hold these only to print them on the invoices you generate, and you choose which of them to fill in.
• Your records: the trips, invoices, expenses and customers you enter. These are the substance of the service, backed up so you do not lose your billing history when you lose your phone.
• Payment references from Razorpay, the amount, and the state of your subscription. We never see or store your card number, UPI PIN, CVV or bank credentials.
• Support messages you send us, kept so we can answer you and refer back to the conversation.
• Technical data collected automatically: your IP address, device and app version, the screens you open, and the time. Used to run the service, diagnose faults and prevent abuse.

We collect nothing beyond what those purposes need. We do not ask for Aadhaar, PAN, biometric data or your bank account number, and you should not send them to us.

One part works the other way round. When you save a passenger’s name or phone number, you decide why you are collecting it, so for that data you are the Data Fiduciary and we are only your Data Processor. We store it and hand it back to you, we never use it for anything of our own, and your own obligations to that passenger stay with you.

Who else processes it

A small number of providers run parts of YathraBook for us. They act on our instructions under contract, may use your data only to provide their service to us, and may never sell it: Razorpay for subscription payments and refunds, Amazon Web Services for the application servers, Neon for the database holding your backed-up records, Upstash for the cache and rate limits, Cloudflare for traffic filtering and file storage, and an SMS provider to deliver your one-time passwords.

Some of them store or process data on servers outside India, which section 16 of the DPDP Act permits except to countries the Central Government has notified as restricted. We transfer nothing to a restricted country, and the same safeguards apply wherever the data sits.

We do not sell your personal data. We do not share your trips, invoices, expenses or passenger records with advertisers, data brokers, or anyone building a profile of you. We disclose data to a government agency, court or law-enforcement body only where a valid legal order requires it.

How long we keep it

• Your account, profile and records: for as long as your account is open.
• After you ask us to delete your account: we hold the request for 30 days so you can undo it, then erase everything permanently.
• Payment references: kept after erasure, because we have to account for money we received. They carry no name, mobile number, email address or trip data.
• Support tickets: up to 24 months after the ticket is closed. Server and security logs: 180 days. One-time password records: up to 7 days.

The local copy on your phone is separate. Signing out clears it from that device, and uninstalling removes it. Anything you recorded offline and have not yet synced is lost when you sign out, so connect once before you do, and download the invoices you want to keep before your account is erased.

Your rights

Under the DPDP Act you can ask us for a summary of the personal data we hold about you and who we shared it with, have it corrected or completed, have it erased, nominate someone to exercise these rights if you cannot, and complain about how we handled any of it. Most of this you can do yourself in Settings inside the app, straight away.

For anything else, write to support@yathrabook.com from the mobile number or email address on your account, so we know it is you. We acknowledge within 48 hours and finish within 30 days. There is no charge.

We process your data on your consent, given when you create an account. You can withdraw it at any time by deleting your account or writing to us. Withdrawal does not undo processing that already happened lawfully, and it ends your use of the service, because there is no version of YathraBook that works without holding your account data. Some processing continues where the law allows it, such as records we must keep for tax.

The Act places duties on you too. Do not impersonate someone else when giving us data, and do not file a false or frivolous complaint. If we do not resolve a complaint to your satisfaction, you may escalate it to the Data Protection Board of India. Raise it with us first.

How we protect it

Everything travels over HTTPS, and data at rest is encrypted by our database and storage providers. Sign-in is a one-time password to your verified mobile number, rate limited, with a short code lifetime and a cap on failed attempts. Administrator accounts require a second factor, and every administrative action on a driver account is written to an audit log. Every query for driver data is scoped to that driver, so one driver’s records cannot be returned to another. Payment credentials never reach our servers.

If personal data we hold is breached, section 8(6) of the DPDP Act requires us to tell both the Data Protection Board of India and every affected person. We will do that without delay, and the notice will say what happened, what data was involved, what we have done and what you should do.

No system is perfectly secure. Keep your phone locked, never share a one-time password with anyone including anyone claiming to be from YathraBook, and tell us at once if you think your account has been used by someone else.

Children, cookies and tracking

YathraBook is a business tool for working drivers. You must be 18 or older to hold an account, and we do not knowingly process the personal data of a child. We do no behavioural monitoring and no targeted advertising, at anyone.

The app uses local storage on your device to keep you signed in and to hold your offline records. That is essential to the service working and cannot be switched off without breaking it. This website counts visits to see which pages are read. We run no advertising cookies and let no advertising network track you from here.

Changes, and how to reach us

We may update this policy. The date at the top always shows the current version, and if a change materially affects how we process your personal data we will tell you in the app or by email before it takes effect.

Any question, request or complaint about your data: support@yathrabook.com, or the contact form at yathrabook.com/contact. We reply within one working day.