Privacy Policy

The short version

• We collect what we need to run bookings, payments and payouts, and to keep people safe.
• We never sell your personal data, and we don't use advertising trackers.
• A space's exact address is shared only with parkers who have paid for a booking.
• Your location is used only around your bookings, and only with your permission.
• You can ask us to show, correct or delete your data at any time: privacy@drivay.com.

Who is responsible for your data

DrivayHQ LLP (Flat No. 1506, Sargam Apartments, Kursi Road, Jankipuram, Lucknow, Uttar Pradesh 226021, India) decides how your personal data is used, and is the "Data Fiduciary" under India's data protection law.

What we collect

• Account details: name, email address, mobile number, date of birth, city, profile photo, and your sign-in method.
• Vehicles: make, model, colour and registration number.
• Bookings and plans: spaces, dates, times, prices, check-in records, extensions, cancellations, reviews and messages.
• Guests you add to a booking: their name, mobile number and how they relate to you.
• Payments: amounts, status and the payment method type (for example the last 4 digits of a card or a UPI ID). Full card details are handled by our payment partner, Cashfree Payments, not by us.
• If you host: your space's address, exact location, photos and arrival instructions; payout details (bank account and IFSC, or UPI ID); and, if you choose to verify your identity, the result of a government-approved identity check.
• Location: your device's location around your bookings, if you allow it (see below).
• Device and usage data: IP address, browser or device type, app version, notification token, the pages you visit and errors you run into.
• Support: what you tell us when you contact us.

How we use location

Before you pay, we show spaces only by area, using locations rounded to about a kilometre. After payment, the parker gets the exact location and directions.

With your permission, the Drivay app shares your location from 60 minutes before a booking starts until it ends, including while the app is in the background. We use it to show your host when you'll arrive, to confirm arrival, and to help settle disputes about whether a space was used. We keep only your latest position, for about 5 minutes; the stored location is cleared when the booking ends, and only a record of whether you arrived is kept with the booking. You can turn location off in your device settings at any time; booking still works, but we can't share your arrival time with your host.

Why we use your data

We process your data on the basis of the consent you give when you sign up (which you can withdraw at any time), and for the legitimate uses the law allows, such as providing a service you asked for and meeting legal obligations.

• To create and secure your account, and verify your email and phone.
• To show spaces, take bookings and payments, pay hosts and issue receipts and refunds.
• To send booking updates, reminders and support replies by email, SMS and push notification.
• To keep Drivay safe: block fake accounts and bots, warn you about unusual sign-ins, and look into fraud, disputes and broken rules.
• To fix problems and improve Drivay, using aggregated usage figures.
• To send you news and offers, only if you opt in. You can opt out at any time.
• To meet legal duties, such as tax records and lawful requests from authorities.

Who sees your data

We never sell your personal data.

• Hosts see the name, photo and vehicle of parkers who book their space, and the parker's phone number once a booking is confirmed. Parkers see the host's name, photo and rating, and the exact address after payment.
• Service providers who help us run Drivay, under contracts that limit their use of the data to that work: Cashfree Payments (payments, refunds and payouts), MSG91 (phone verification codes), Google Maps (maps and directions) and Cloudflare (photo storage), plus providers for emails, push notifications, identity checks for hosts and error monitoring.
• Maps on Drivay are provided by Google Maps. Using them also means agreeing to the Google Maps/Google Earth Additional Terms of Service (https://maps.google.com/help/terms_maps/) and Google's Privacy Policy (https://policies.google.com/privacy).
• We check new passwords against lists of passwords exposed in known data breaches, in a way that never lets your password leave our systems.
• Authorities, when the law requires it, and others where needed to protect people's safety or our rights.
• A buyer or successor, if Drivay's business is ever sold or merged, under this same policy.

How long we keep it

• Account details: for as long as your account is open.
• Sign-in sessions: 7 days, renewed while you use Drivay. Verification codes: 10 minutes.
• Live location: about 5 minutes; the location stored for a booking is cleared when it ends.
• Approximate sign-in locations (worked out from your IP address): 30 days, to spot unusual sign-ins.
• Bookings, payments, invoices and payouts: up to 8 years, as Indian tax and accounting laws require, even after you close your account.
• When we no longer need data, we delete it or remove what identifies you.

Your rights

To use any of these rights, email privacy@drivay.com from the address on your account. We reply within 30 days.

• See the personal data we hold about you and how we use it.
• Correct or update it. Most details can be edited in your profile.
• Ask us to delete it and close your account. We'll do this within 30 days, except records the law requires us to keep.
• Withdraw your consent. This may mean we can no longer provide some or all of Drivay.
• Nominate someone to exercise these rights for you if you die or become unable to.
• Complain to us, and if you're not satisfied with our answer, to the Data Protection Board of India.

Keeping your data safe

Data is sent over encrypted connections (HTTPS), passwords are stored only in hashed form, card details stay with our payment partner, Cashfree Payments, payout bank account numbers and UPI IDs are stored encrypted, and only staff who need data for their job can access it. No system is perfectly secure, but if a breach affects you, we'll tell you and the authorities as the law requires. Our Security page has the details.

Children

Drivay is only for people aged 18 or over. We don't knowingly collect data from children; if you think a child has given us data, contact us and we'll delete it.

Where your data is stored

Our servers and some of our service providers may store data outside India. When that happens, we only transfer data as Indian law permits, and it stays protected by this policy.

Cookies

We use only the cookies needed to keep you signed in, and privacy-friendly analytics that don't use cookies. See our Cookie Policy.

Changes to this policy

We'll update the date at the top of this page whenever we change this policy, and tell you by email or in the app before a significant change.

Grievance Officer

If you have a complaint about Drivay, including about your personal data or anything on the platform, write to our Grievance Officer: Sujay Shukla, Designated Partner, DrivayHQ LLP, Flat No. 1506, Sargam Apartments, Kursi Road, Jankipuram, Lucknow, Uttar Pradesh 226021, India. Email: grievance@drivay.com.

We acknowledge every complaint within 24 hours and aim to resolve it within 15 days. If we need more time, we will tell you why and when to expect an answer.