Privacy Policy

• Account data: name, email, mobile number, password (stored as a secure hash), profile picture (Google sign-in).
• Seller verification data: RC book photo(s), RC owner name, vehicle registration number; for Guardian Sellers — shop photo, trade licence, business proof, GST details.
• Listing data: vehicle details, photos, price, location (state/city), and package selection.
• Location data: approximate location only if you allow GPS, or the city/state you pick manually — used to show nearby cars.
• Usage data: chats on the platform, favourites, searches, AI assistant conversations, and technical logs (IP, device, browser) for security.
• Payment data (when payments are enabled): processed by payment gateways (Razorpay/Stripe). We never store your card/UPI credentials.

• Verifying sellers (RC/document checks, including automated OCR reading of your RC to fill car details).
• Operating the marketplace: listings, search, location filtering, chat, favourites, notifications.
• Fraud prevention: duplicate registration-number detection, moderation, and platform safety.
• Customer support, including our AI assistant.
• Legal compliance and responding to lawful requests from authorities.

• RC photos are stored in restricted private storage — never displayed publicly, never sold, never used for any purpose other than verification.
• Access is limited to you (the uploader) and our verification team/admin.
• Automatic deletion: RC photos are permanently deleted from storage once your ad is completed — when you delete the ad, or after it expires beyond the reactivation window.
• Your registration number is stored privately for duplicate-fraud checks and is never shown in public listings.

• Public listings show your car details, photos, city and a masked version of your name.
• Your phone number and full name are shared only after you approve a buyer's contact/chat request.
• Chats are private between the two participants (and accessible to us for safety/moderation and legal compliance).

We do not sell your personal data. We share data only with:

• Service providers strictly needed to run the Platform (cloud hosting, object storage, AI processing for RC OCR and the assistant, payment gateways when enabled, WhatsApp/Meta for OTP delivery when enabled).
• Law enforcement or regulators when legally required.
• A successor entity in case of merger/acquisition, under the same protections.

We use encrypted transport (HTTPS), hashed passwords, token-based sessions, access-controlled private storage for documents, and role-restricted admin access. No system is 100% secure — please use a strong, unique password and never share OTPs or credentials.

• Account data: kept while your account is active; deleted or anonymised on account deletion, except where law requires retention.
• RC photos: auto-deleted after ad completion (see Section 3).
• Expired listings and chats: retained for a limited period for dispute resolution and fraud prevention, then removed.

• Access and correction of your personal data (via Profile, or by writing to us).
• Withdrawal of consent and account/data deletion (subject to legal retention duties).
• Grievance redressal: contact our Grievance Officer at info@directownercars.com — UUTU TECHNOLOGY PRIVATE LIMITED, No.13435-E18, Tramway Square, Old Highway Road, Chalakudi, Thrissur, Kerala, India - 680307. If unsatisfied, you may approach the Data Protection Board of India.
• Nomination: you may nominate a person to exercise your rights in case of death or incapacity.

Essential storage. We use essential browser storage (e.g., session tokens, your chosen location, assistant session ID) to keep you signed in and personalise results. This is required for the Platform to function and does not need consent.

Analytics & advertising (consent-based). With your permission — asked via the cookie banner — we use analytics cookies (e.g., Google Analytics) to understand how the Platform is used, and advertising cookies/pixels (e.g., Meta Pixel, Google Ads) to measure the effectiveness of our ad campaigns. Where you consent, we may also send conversion confirmations server-side to these partners using hashed (SHA-256) identifiers; we never share your password, OTPs, RC documents, raw phone number or raw email address with analytics or advertising partners.

Campaign attribution. If you arrive via an advertising link, we store the campaign parameters (such as utm_source and click identifiers) in your browser and against your account/listing to measure which campaigns work. This data identifies the campaign, not you personally.

Your choice. You can accept, reject or customise non-essential tracking at any time via "Cookie preferences" in the footer. Rejecting it never affects sign-in, OTP verification, listing or payment functionality.

The Platform is intended for users aged 18 and above. We do not knowingly collect children's data.

We may update this Policy; the Effective date will change and material updates may be notified in-app. Questions? Write to info@directownercars.com.