Privacy Policy

DPDP 2023 compliant · Version 2.0 · Last updated 26 August 2026 · Replaces Version 1.0 (9 July 2026)

We do not collect Aadhaar in v1. We take no ride or shop payment inside the app — rides and shop orders are paid in cash. The only balance we operate is a small prepaid contact-credit used solely for masked calls (see section 5). We do not sell your personal data and we do not share it with advertising networks.

1. Who we are

This Policy describes how LalaCar ("we", "us"), operated by Rudraayaan AI Technologies Private Limited, collects, uses, shares and protects your personal data when you use the LalaCar apps, lalacar.in and related services ("Services"). For the Digital Personal Data Protection Act, 2023 ("DPDP Act"), LalaCar acts as a Data Fiduciary. Our processors listed in section 7 act on our documented instructions.

2. Contact

Grievance Officer (IT Rules 2021): Sandeep Naredla — grievance@lalacar.in — 24-hour acknowledgement + 15-day resolution.
Data Protection Officer / DPDP contact: dpo@lalacar.in
On request, we will provide this notice in English or in any language of the Eighth Schedule to the Constitution of India (DPDP §5(3)).

3. Data we collect

Category	What	Lawful basis
Account	Phone, name, email, photo, gender, DOB	Consent / contract
Verification (drivers)	PAN (uniqueness only, stored as a salted hash), DL, RC, selfie liveness	Consent + legal obligation
Location	Live in-trip location (foreground only), searched routes, saved Home/Work	Consent
Trip	Origin, destination, route, timestamps, ratings, chat	Contract
Ride & shop payments	None. Rides are cash at drop-off and shop orders cash at the counter; no payment instrument is collected	—
Contact QR & masked calls	Your vehicle's QR/PIN, call metadata (caller and callee numbers, time, duration, status, cost). Calls are not recorded	Consent / contract
Contact-credit top-ups	UPI transaction reference (UTR) and amount, for crediting and audit	Contract + legal obligation
Device & analytics	Model, OS, app version, IP, device fingerprint, app-instance and advertising identifiers used by Firebase Analytics/Crashlytics	Legitimate use / consent

4. Callers who are not LalaCar users

If you scan a vehicle's Contact QR and place a masked call, we process your phone number and the call's metadata solely to connect the call, prevent abuse (rate-limiting) and account for its cost. Neither party is shown the other's number. We do not use a caller's number for marketing and we do not create a profile of non-registered callers. This section is the notice to such callers as Data Principals under the DPDP Act.

5. Contact-credit balance

Masked calls are paid from a prepaid contact-credit balance held against your account. We record every call debit and every top-up in an auditable ledger. Credits are a closed service credit for LalaCar features only — not a wallet or payment instrument — and the balance, ledger and top-up records are retained as financial records (section 8).

6. How we use data

Provide the Services — publish, search, request, book, in-trip safety, ratings, shop discovery, vouchers, masked calls.
Show your in-trip live location to the co-traveller on your booking and to our safety team while a ride is in progress.
Confirm bookings and keep a record of what each rider agreed to pay the driver in cash.
Verify drivers and enforce one-account-per-person via a PAN hash.
Comply with law, prevent fraud and abuse, investigate safety incidents.
Send transactional messages; marketing only with your consent. Banners shown in the app are our own or our merchants' first-party promotions — we do not serve third-party targeted advertising.

7. With whom we share

Other users (first name + initial + photo + rating; your booked co-traveller additionally sees in-trip live location), Dove (DLT SMS for login OTP), Exotel (cloud telephony — masked-call bridging; receives both phone numbers and call metadata to connect calls), Telegram (merchant application review — brand, category, shop location and photo are sent to our reviewer bot), KYC vendors (PAN/DL/RC/selfie verification), Google Firebase/Maps (hosting, analytics, crash reporting, mapping), Sentry/PostHog (error monitoring, product analytics), Razorpay (only if and when online contact-credit top-ups are enabled), and law enforcement upon valid legal process. We do not sell personal data and do not share it with advertising networks for targeted advertising.

8. Retention

Trip & booking history — 5 years after last trip (audit, dispute, regulatory).
Merchant order & voucher ledger — 8 years (Income Tax Act + audit).
Contact-credit ledger & top-up records — 8 years (financial records).
Masked-call metadata — 1 year, then aggregated; QR scan logs — 90 days.
KYC documents (encrypted) — 5 years after KYC expiry.
Safety incident records — 10 years (or longer if a legal matter is pending).
Chats — 90 days then archived 1 year. Crash & analytics — 13 months.

On account closure, identifiable data is anonymised or deleted within 30 days, except where retention is mandated by law. When a purpose is served and no legal retention applies, data is erased per DPDP §8(7).

9. Cross-border transfers

Primary processing is in India (asia-south1). Limited error-monitoring and product-analytics data may transfer outside India where the processor has no India region; we rely on lawful bases and contractual safeguards consistent with DPDP §16 and any government notification restricting transfer countries.

10. Your rights under DPDP

Access — request a summary of your data and processing (in-app "Download my data", or dpo@lalacar.in; answered within 7 days).
Correction & erasure — fix or delete (within 30 days, subject to legal retention). Account deletion: in-app or lalacar.in/delete-account.
Nominate — appoint someone to exercise your rights on your behalf.
Withdraw consent — at any time, as easily as it was given; features that need that consent stop working, and withdrawal does not affect processing already done.
Grievance redressal — Grievance Officer first; if unresolved, complain to the Data Protection Board of India.
Your duties (DPDP §15) — don't impersonate others, don't suppress material information, don't file false grievances.

11. Security

TLS 1.2+ in transit; AES-256 at rest. PAN is hashed (sha256 + project pepper) and masked — full PAN is not retained in v1. Aadhaar is not used. Masked calls are not recorded. Strict role-based access with server-side rules; admin actions require multi-factor authentication and are audited. Annual third-party security testing; coordinated vulnerability disclosure at security@lalacar.in. Personal-data breaches are reported to the Data Protection Board and affected users per DPDP §8(6).

12. Children

LalaCar is not for users under 18. We require date-of-birth at sign-up and verify age at the first KYC step. We do not knowingly process children's data; if we discover a user is under 18, we suspend the account and delete personal data, except as required by law.

13. App permissions & store disclosures

The app requests: location (while in use only — search, pickup, in-trip sharing; no background location), camera/photos (profile, KYC, shop and product photos; images are compressed on-device before upload), and notifications (booking, order and safety updates). Analytics uses the device advertising identifier only for aggregate product analytics — not for ad targeting. These disclosures match our Google Play Data Safety form and Apple App Privacy label; if they ever differ, this Policy prevails and we will correct the listing.

14. Changes

We notify you of material changes via app + email at least 15 days before they take effect. Continued use after the effective date constitutes acceptance.