Last updated: June 2026 · Effective immediately upon use of the platform

1. Identity of the Data Fiduciary

This Privacy Policy describes how Green Rides (“Data Fiduciary”, “we”, “us”), operating from Koraput, Odisha, India, processes personal data of users (“Data Principals”) in accordance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the Information Technology Act, 2000, and other applicable Indian law.

By using the Green Rides Platform, you provide free, specific, informed, and unambiguous consent to the processing of your personal data as described herein, in accordance with Section 6 of the DPDP Act.

2. Personal Data We Collect

We collect only the minimum data necessary for the stated purposes:

Identity & Contact

Mobile phone number — for OTP-based login and account security
Name — optionally provided, used for personalisation and driver communication

Trip Data

Origin and destination city
Travel date and time
Fare agreed
Trip status and OTP (for ride verification)
Notes you voluntarily provide

Device & Usage Data

Approximate location — detected from IP address at session start to suggest your nearest city. Not tracked continuously. Not stored.
Anonymised usage events — page views, button clicks, booking funnel steps — collected via PostHog analytics to improve the Platform

Drivers & Fleet Owners Only

Driving licence number
Vehicle registration number, model, insurance details
PAN / Aadhaar (for KYC and tax purposes)
Scanned copies of identity and vehicle documents
Bank account details (for payouts)
Telegram user ID (optional, for dispatch notifications)

3. Purposes of Processing

We process your personal data only for the following specified, lawful purposes under Section 4 and 7 of the DPDP Act:

Service provision: Matching passengers with drivers, confirming bookings, and managing the trip lifecycle.
Communication: Sending booking confirmation, trip updates, and driver contact details via WhatsApp (through Interakt) or SMS.
Safety: Maintaining trip records for dispute resolution and passenger safety.
Driver onboarding: Verifying driver identity, vehicle compliance, and KYC documentation as required under the Motor Vehicles Act.
Payments: Processing online payments via Razorpay and managing driver payouts.
Legal compliance: Maintaining records as required under applicable tax, transport, and consumer protection laws.
Platform improvement: Analysing anonymised usage data to improve features and performance.

We do not process your personal data for profiling, targeted advertising, or sale to third parties.

4. Data Sharing and Third Parties

We share your personal data only where necessary, with the following categories of recipients:

Assigned Driver

Your name and phone number are shared with the driver assigned to your trip, solely for trip coordination.

Supabase Inc. (USA)

Our database and authentication infrastructure provider. Data is stored on AWS servers (ap-southeast-1 region). Supabase acts as a Data Processor under our instructions. Transfer is made under standard contractual clauses.

Razorpay Software Pvt. Ltd. (India)

Payment processing for online transactions. Razorpay is PCI-DSS compliant. We share only the transaction amount and booking reference, not your card details.

Interakt (Jio Haptik Technologies)

WhatsApp Business API provider for trip notifications. Your phone number and booking details are shared for message delivery only.

PostHog Inc. (USA)

Analytics platform. Usage data is anonymised and does not include your phone number or personal identifiers.

We do not sell, rent, or trade your personal data with any other party. We do not share data with law enforcement except in response to lawful orders or as required to prevent imminent harm.

5. Data Retention

Trip records: Retained for 24 months for dispute resolution and legal compliance under the Consumer Protection Act, 2019.
Driver KYC documents: Retained for the duration of the driver's engagement plus 5 years, as required under applicable financial and transport regulations.
Account data: Retained until you request deletion, subject to legal hold obligations.
Anonymised analytics: May be retained indefinitely as they contain no personal identifiers.

On expiry of retention periods, data is deleted or irreversibly anonymised.

6. Your Rights as a Data Principal

Under the DPDP Act, 2023, you have the following rights:

Right to Access (Section 11)

Request a summary of the personal data we hold about you and the purposes for which it is processed.

Right to Correction and Erasure (Section 12)

Request correction of inaccurate data or erasure of data where processing is no longer necessary, subject to legal retention obligations.

Right to Withdraw Consent (Section 6)

Withdraw consent for processing at any time. Withdrawal does not affect prior lawful processing. Withdrawal may prevent you from using the Platform.

Right to Grievance Redressal (Section 13)

Raise a complaint with our Grievance Officer (details below) and, if unsatisfied, with the Data Protection Board of India.

Right of Nomination (Section 14)

Nominate a person to exercise your rights in the event of your death or incapacity.

To exercise any of these rights, contact our Grievance Officer at support@greenrides.co.in. We will respond within 30 days.

7. Security Measures

All data is transmitted over TLS 1.2+ encrypted connections.
Database access is protected by Supabase Row-Level Security (RLS) policies, ensuring each user can only access their own data.
Authentication uses OTP-only login; no passwords are stored.
Sensitive driver documents are stored in private, access-controlled Supabase Storage buckets.
Admin access requires a separate secret token and is not accessible to the public.
We conduct periodic reviews of access controls and data handling practices.

Despite these measures, no data transmission over the internet can be guaranteed to be 100% secure. If you suspect a data breach, please contact us immediately at support@greenrides.co.in.

8. Children's Privacy

The Platform is not intended for children under 18. We do not knowingly collect personal data from minors. If a parent or guardian believes a minor has provided personal data, they should contact us for immediate deletion. Under the DPDP Act, we will obtain verifiable parental consent before processing personal data of children.

9. Cross-Border Data Transfer

Your data is stored on Supabase infrastructure located in the AWS ap-southeast-1 (Singapore) region. Such transfer is necessary for the provision of our services. We ensure appropriate safeguards through data processing agreements with Supabase. Transfers outside India are made in compliance with Section 16 of the DPDP Act and applicable Government notifications.

10. Cookies and Analytics

The Green Rides web application uses local storage for authentication session management. We use PostHog for anonymised behavioural analytics. PostHog is configured to anonymise all event data and does not track personal identifiers. You may opt out of analytics by using a browser with privacy mode enabled.

11. Grievance Officer

In accordance with Section 13 of the DPDP Act and Rule 5 of the IT (Intermediary Guidelines) Rules, our Grievance Officer is:

Grievance Officer: Green Rides Support

Email: support@greenrides.co.in

Address: Green Rides, Koraput, Odisha – 764020, India

Acknowledgement: Within 24 hours of receipt

Resolution: Within 30 days as mandated by law

If your complaint is not resolved satisfactorily, you may escalate to the Data Protection Board of India (once operational) or approach the appropriate Consumer Disputes Redressal Commission.

12. Changes to This Policy

We will notify you of material changes to this Privacy Policy through the Platform or by SMS/WhatsApp to your registered number at least 7 days before changes take effect. Your continued use of the Platform after the effective date constitutes acceptance of the revised Policy.

Privacy Policy

DPDP Act 2023 Compliant