Privacy Policy

VAHANA Privacy Policy 1. Introduction and Scope This Privacy Policy explains how VAHANA (“Vahana”, “we”, “us”) collects, uses, shares, and protects personal data in connection with the Vahana platform (vahana.cloud), a software-as-a-service application for transport and logistics companies. It applies to Tenants, their Authorized Users, and individuals whose data is entered into the Platform by a Tenant. 2. Our Roles: Data Fiduciary and Data Processor Vahana acts as a Data Fiduciary under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) in respect of the personal data of Authorized Users who create accounts or log in to the Platform directly — for example, a Tenant’s Super Admin, Admin, Dispatcher, or Accountant. Vahana acts as a Data Processor in respect of personal data that a Tenant enters into the Platform about individuals who do not themselves access the Platform — most commonly, driver personal details (such as name, phone number, and license or identity references) entered by a Tenant’s own staff. In these cases, the Tenant is the Data Fiduciary responsible for the lawfulness of that processing, including obtaining consent from the individual concerned, and Vahana processes that data only on the Tenant’s instructions and for the purpose of providing the Platform. 3. Personal Data We Collect 3.1 Account and User Data (collected directly from Authorized Users) • Name, email address, phone number, and role (e.g., Super Admin, Admin, Dispatcher, Accountant, Driver, Viewer). • Login credentials and authentication data. • Company details provided at onboarding, including company name, GSTIN, PAN, and registered address. 3.2 Tenant Business Data (entered by a Tenant, about the Tenant’s own operations and third parties) • Vehicle records: registration number, permit, insurance, fitness, and pollution certificate details. • Driver records: name, contact details, license number, and identity references. • Trip, consignment, invoice, and payment records, including customer and consignee details. • Fuel and toll transaction records. 3.3 Technical and Usage Data • IP address, browser and device information, and log data generated through use of the Platform. • Usage patterns within the Platform, used for security, support, and service improvement. 3.4 Payment Data Subscription payments are processed by our payment gateway partner. We do not store full payment card or bank account details; these are handled directly by the payment processor in accordance with its own security standards. 4. Purposes of Processing We process personal data to: • Provide, operate, and maintain the Platform, including generating GST-compliant invoices and compliance alerts. • Authenticate Authorized Users and enforce access controls between Tenants. • Process subscription payments and communicate about billing. • Send notifications, including expiry alerts for permits, insurance, fitness certificates, and other compliance items, via email, SMS, or WhatsApp where enabled. • Maintain security, detect and prevent fraud or misuse, and comply with legal obligations. • Improve and develop the Platform’s features. 5. Consent Where Vahana acts as Data Fiduciary (Section 2), we obtain consent directly from each Authorized User at first login, through a clear notice describing what data is collected and why, before that user can access the Platform. Consent can be withdrawn at any time by contacting us at the details in Section 12, though withdrawing consent may mean we are no longer able to provide the Platform to that user. Where Vahana acts as Data Processor in respect of data about individuals who do not use the Platform directly (Section 2), the responsibility for obtaining consent from those individuals rests with the Tenant, as set out in our Terms and Conditions. 6. Cookies and Similar Technologies We use essential cookies and similar technologies necessary for authentication and session management, and may use basic analytics to understand how the Platform is used. We do not use third-party advertising trackers. 7. How We Share Personal Data We do not sell personal data. We share personal data only with: • Sub-processors who host and operate the Platform’s infrastructure (database, authentication, and file storage). • Our payment gateway partner, to process subscription payments. • Communication providers used to deliver email, SMS, and WhatsApp notifications, where enabled by a Tenant. • Government or regulatory authorities, where required by law or a valid legal process. • A successor entity in connection with a merger, acquisition, or sale of business assets, subject to equivalent protections. 8. Cross-Border Data Transfer Our Platform’s data is hosted with our infrastructure provider in Lovable and Supabase. Where personal data is transferred outside India, we take steps to ensure it continues to receive an appropriate level of protection, consistent with the DPDP Act and applicable rules on cross-border data transfer. 9. Data Retention We retain personal data in an actively accessible state for a default period, after which it may be moved to an archived (but still retrievable) storage tier for performance and cost reasons. We do not delete data relevant to GST or income tax compliance before the minimum retention periods required under the Central Goods and Services Tax Act, 2017 (currently 72 months from the due date of the relevant annual return) and the Income Tax Act, 1961, or any longer period required due to ongoing legal proceedings. Tenants may configure archiving and deletion periods for their own account within these limits. 10. Data Security We apply role-based access control and tenant-level data isolation so that one Tenant cannot access another Tenant’s data, encryption of data in transit and at rest through our infrastructure provider, and audit logging of key account and administrative actions. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. 11. Your Rights as a Data Principal Subject to applicable law, you have the right to: • Obtain a summary of the personal data we hold about you and how it is being processed. • Request correction or completion of inaccurate or incomplete personal data. • Request erasure of personal data that is no longer necessary for the purpose it was collected, subject to our legal retention obligations described in Section 9. • Withdraw consent at any time, as easily as it was given. • Raise a grievance regarding the processing of your personal data and receive a response within the timelines prescribed under applicable law. • Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity. 12. How to Exercise Your Rights / Grievance Officer To exercise any of the rights above, or to raise a grievance, please contact our Grievance Officer: • Name and designation: [GRIEVANCE OFFICER NAME AND DESIGNATION] -- will be rolled out soon • Email: [GRIEVANCE OFFICER EMAIL] -- will be rolled out soon • Address: [REGISTERED ADDRESS] -- will be rolled out soon We will endeavour to acknowledge and resolve grievances within the timelines prescribed under applicable law. 13. Children’s Data The Platform is intended for business use by adults and is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. 14. Changes to This Policy We may update this Privacy Policy from time to time. Where changes are material, we will notify affected users and, as described in our in-app acceptance process, require them to review and accept the updated policy before continuing to use the Platform. Prior versions will be retained for our records. 15. Contact Us If you have questions about this Privacy Policy, please contact us at support@vahana.cloud or write to us at [REGISTERED ADDRESS] -- will be rolled out soon.