Privacy Policy

Effective from April 9, 2026

1. Introduction

CAARVN is a ridesharing platform operated by Veebhaka Industries ("we", "us", or "our"). Veebhaka Industries is the legal entity responsible for the Platform and acts as the data controller for all personal data processed through CAARVN.

This Privacy Policy applies to all individuals who access or use the Platform, including registered users ("Members") and individuals browsing the Platform with limited access ("Users").

References to "CAARVN" in this Policy refer to the platform operated by Veebhaka Industries.

CAARVN operates solely as a technology platform facilitating connections between users and does not provide transportation services.

We are committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy explains how we collect, use, process, store, and share your information in connection with your use of the Platform, including account creation, identity verification, Trip booking, and other related Services.

This Privacy Policy should be read together with our Terms and Conditions. By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy and agree to the processing of your data as described herein.

Access to core functionalities of the Platform requires user registration and authentication.

2. Information We Collect

We may collect and process the following categories of information depending on your use of the Platform, including whether you are browsing, registering, booking, or offering a Trip:

We collect only the data necessary for providing, improving, and securing the Platform.

2.1 Information You Provide

When you create an Account or interact with the Platform, you may provide:

• Full name
• Email address (used for OTP-based login)
• Phone number
• Gender (optional)
• Home and work addresses (optional)
• Profile details and other information you choose to provide related to your account

Certain information is optional and may not be required for accessing limited features of the Platform.

2.2 Identity Verification Data

To access specific Services (such as booking or offering a Trip), we may collect:

• Government-issued identification documents (such as Aadhaar, PAN, or similar ID)
• Driving licence (for Drivers)
• Any additional documents voluntarily uploaded by Users for verification or profile purposes

This data is collected solely for identity verification, safety, fraud prevention, and compliance purposes.

Such data may be stored and reviewed by authorized personnel and may, in the future, be processed using automated systems where applicable.

Important:

Verification does not guarantee the identity, authenticity, or safety of any User, nor does it constitute background verification.

Such data may be considered sensitive in nature and is handled with additional care and restricted access.

Device Permissions:

To facilitate identity verification and document submission, the Platform may request access to your device's Camera and Photo Library/Storage.

• Camera access is used to capture images of identity documents such as government-issued IDs and driving licences.
• Photo Library/Storage access is used to upload existing images of such documents.

This access is used solely for verification purposes and is not used for any other purpose.

2.3 Trip and Platform Data

We collect data related to your activity on the Platform, including:

• Trip bookings and Trip history
• Carpooling Adverts created or interacted with
• Check-in status and Trip progression
• Ratings, reviews, and feedback
• Interactions and communications between Users

2.4 Location Data

We may collect and process location-related data, including:

• Real-time or approximate location
• Route and trip-related data
• Pickup and destination points

Location data may be collected:

• When searching for Trips
• When viewing suggested or recommended rides
• During active Trips
• For improving matching and platform functionality

Used for:

• Trip matching and recommendations
• Suggested rides and relevance-based results
• Estimated arrival times and Trip coordination
• Platform optimization and analytics

By enabling location services on your device, you consent to the collection and processing of location data as described in this section.

Note: Location data may be inaccurate, delayed, or incomplete.

Location data is not collected when the application is not actively in use, unless explicitly permitted by the User through device or application settings.

2.5 Automatically Collected Data

We may automatically collect:

• IP address
• Device information and identifiers
• Operating system and application version
• Usage logs, session activity, and interaction data

2.6 Derived and Inferred Data

We may generate or infer additional data based on your activity, including:

• Ride preferences
• Frequently searched routes
• Suggested or recommended Trips
• Usage patterns and behaviour

Such data is used to improve the functionality and performance of the Platform.

2.7 Data Accuracy Disclaimer

While reasonable efforts are made to maintain accurate data, CAARVN relies on user-provided information and cannot guarantee complete accuracy.

2.8 Cookies and Tracking Technologies

Cookies and similar technologies are used to enhance functionality, analyse usage, and improve user experience. Where required, user consent will be obtained through device or application settings.

Such technologies may collect information such as device identifiers, usage patterns, and session data.

Users may control certain tracking preferences through device or application settings where applicable.

3. How We Use Your Data

We use your data for the following purposes:

• To create, manage, and maintain your Account
• To authenticate login via OTP and ensure secure access
• To verify identity, eligibility, and compliance with Platform requirements
• To enable Trip creation, booking, matching, and participation
• To provide search results and suggested or recommended Trips based on relevance, location, and activity
• To facilitate communication and coordination between Users
• To manage Trip lifecycle, including check-in, Trip status, and completion processes
• To enforce our Terms and Conditions, including restricting access, suspending Accounts, or taking other necessary actions
• To detect, prevent, and investigate fraud, abuse, misuse, or unauthorized activity
• To provide customer support and respond to user requests
• To operate, maintain, and improve Platform functionality, performance, and user experience

We may monitor and analyse user activity, interactions, communications, and behavioural patterns on the Platform for safety, fraud prevention, compliance, and system optimization purposes.

Certain processes may involve automated systems, including:

• Trip matching and ride recommendations
• Suggested rides and relevance-based search results
• Pricing calculations and cost estimations
• Check-in validation and Trip status updates
• Fraud detection and risk assessment

These automated systems operate based on predefined logic and available data and do not guarantee accuracy, reliability, or specific outcomes.

Such automated processes do not produce legally binding decisions and are used solely to support platform functionality. Users may request manual review where such processes significantly affect their experience.

We may also use anonymised, aggregated, or non-identifiable data for analytics, research, service improvement, and operational insights.

Processing of data is limited to what is necessary for the functioning of the Platform and the provision of Services.

4. Legal Basis for Processing

We process personal data in accordance with applicable laws, including the Digital Personal Data Protection Act, 2023.

The legal basis for processing includes:

• User Consent: Personal data is processed based on your consent, which is obtained through explicit user actions such as account registration, login, uploading information, enabling permissions, or using the Platform. You may withdraw your consent at any time, subject to applicable limitations.
• Contractual Necessity: Processing is necessary to provide the Services requested by you, including account creation, identity verification, Trip creation, booking, and participation.
• Legal Obligations: Processing may be required to comply with applicable laws, regulations, or lawful requests from authorities.
• Legitimate Use for Platform Operations: Processing is necessary for the operation, security, and improvement of the Platform, including fraud prevention, system monitoring, enforcement of Terms, and service optimization.

5. Sharing of Information

We share personal data only to the extent necessary for the operation of the Platform and the provision of Services.

5.1 With Other Users

To facilitate Trips and coordination, certain information may be shared between Drivers and Passengers, including:

• Limited profile information (such as name and basic details)
• Trip-related information (such as pickup and destination details)
• Contact details where necessary for coordination

Users acknowledge that any information shared with other Users may be accessed or used by them, and CAARVN provides such information solely to facilitate coordination between Users and does not control or monitor interactions outside the Platform. Users are advised to exercise caution when sharing personal information. Users interact with each other at their own discretion and risk.

5.2 With Service Providers

We engage third-party service providers to support the operation of the Platform, including:

• Amazon Web Services (AWS) for hosting and storage
• Backend and infrastructure service providers
• Analytics and system monitoring tools
• Email delivery and communication service providers (for OTPs and notifications)

These providers process data on our behalf and are required to handle such data in accordance with applicable data protection standards.

Your data may be stored and processed on secure cloud infrastructure managed by such providers.

5.3 With Legal Authorities

We may disclose personal data where necessary:

• To comply with applicable laws or legal obligations
• To respond to lawful requests or legal processes
• To investigate, prevent, or take action against fraud or illegal activities
• To protect the rights, safety, and security of Users, CAARVN, or third parties

5.4 Business Transfers

In the event of a merger, acquisition, restructuring, or transfer of assets, personal data may be transferred as part of such transaction, subject to applicable legal requirements.

5.5 No Sale of Data

We do not sell, rent, or trade your personal data to third parties for commercial purposes.

6. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes outlined in this Privacy Policy and to comply with applicable legal obligations.

• Account Data: Personal data associated with your Account is retained for as long as your Account remains active.
• Account Deletion: Upon initiation of account deletion, your data may be retained for a period of up to 14 days to allow for account recovery or reversal of deletion.
• Post-Deletion Retention: After the deletion period, personal data may be deleted, anonymised, or retained where necessary for:
  • fraud prevention and detection
  • dispute resolution and enforcement of Terms
  • compliance with legal or regulatory obligations

Personal data is deleted or anonymised using industry-standard methods designed to prevent recovery or reconstruction, unless retention is required by law or for legitimate operational purposes.

• Operational and Technical Data: Certain data, including logs, system records, and backup data, may be retained for operational, security, or auditing purposes for a limited period.
• Legal Retention: Certain data may be retained for longer periods where required by applicable law or where necessary to protect the rights, safety, or integrity of the Platform.

CAARVN reserves the right to retain data to the extent necessary for legitimate operational, security, and legal purposes.

Residual copies of data may remain in backup systems for a limited duration and will be securely handled in accordance with applicable practices.

CAARVN is not obligated to retain personal data for longer than necessary for the purposes outlined in this Privacy Policy.

Retention periods may vary depending on the nature of the data, operational requirements, and applicable legal obligations.

For greater clarity, indicative retention periods may include:

• Verification documents: retained for the duration of Account activity and deleted within 30 days of account closure, unless retention is required for legal or compliance purposes
• Logs and technical data: typically retained for up to 90 days for security, debugging, and system integrity
• Backup data: may be retained for up to 60 days before secure deletion
• Data related to fraud prevention, disputes, or legal matters: may be retained for up to 3 years from the relevant event, where necessary

7. User Rights

Subject to applicable law, including the Digital Personal Data Protection Act, 2023, you have the following rights:

• To access your personal data held by CAARVN
• To request correction of inaccurate or incomplete data
• To request deletion of your personal data
• To withdraw consent for processing
• To request restriction or limitation of processing, where applicable

To exercise these rights, you may contact us using the details provided in this Privacy Policy.

Requests may be subject to verification of identity and may be processed only upon confirmation of sufficient information.

CAARVN may review, accept, or decline requests where permitted under applicable law, including where:

• Data is required for legal compliance
• Data is necessary for fraud prevention or security purposes
• Data is required for enforcement of Terms and resolution of disputes

Where an automated system significantly affects your Account or access to the Platform, you may request a manual review of such action by contacting CAARVN. CAARVN will review such requests within a reasonable timeframe, typically within 7 business days.

Note:

Withdrawal of consent or deletion of data may result in restricted access to the Platform or inability to use certain Services.

Users may withdraw consent by contacting CAARVN at support@caarvn.com or through available in-app controls where such functionality is provided. Requests will be processed within 7 business days, subject to verification and applicable legal requirements.

Certain data may be retained in accordance with the Data Retention section of this Privacy Policy.

Where applicable, these rights may also extend to data derived or inferred from your activity on the Platform, to the extent such data is associated with your Account.

8. Data Security

CAARVN implements appropriate technical and organizational measures to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure.

These measures include:

• Secure cloud infrastructure, including services provided by Amazon Web Services (AWS)
• Access control mechanisms to restrict data access to authorized personnel only
• Data protection and security practices designed to safeguard information

Access to personal data is limited to personnel, service providers, or systems that require such access for operational, security, or support purposes.

However:

• No method of transmission over the internet or electronic storage is completely secure
• While we implement appropriate security measures, no system can guarantee absolute security.

Users are responsible for maintaining the confidentiality of their Account credentials and for activities conducted through their Account.

CAARVN shall not be liable for data breaches resulting from factors beyond its reasonable control, including failures of third-party infrastructure, cyber-attacks, or user negligence.

In the event of a data breach, CAARVN will take reasonable steps to investigate and mitigate the breach, and will notify affected Users and relevant authorities in accordance with applicable law. Users may contact support@caarvn.com for further information and assistance.

9. Children's Privacy

The Platform is intended for individuals aged 18 years or above. Registration or use of the Platform by minors is strictly prohibited.

CAARVN does not knowingly collect or process personal data from individuals under the age of 18.

If we become aware that personal data has been collected from a minor without appropriate authorization, we will take reasonable steps to delete such data and may suspend or terminate the associated Account.

If you believe that a minor has provided personal data on the Platform, you may contact us to request removal of such information.

10. Third-Party Services

The Platform relies on third-party services and infrastructure providers to support its functionality and operations.

These may include:

• Cloud hosting providers (such as Amazon Web Services (AWS))
• Mapping and location services (provided using OpenStreetMap data and Nominatim geocoding services)
• Push notification services (such as Firebase Cloud Messaging (FCM))
• Analytics, monitoring, and backend infrastructure tools
• Email delivery and communication service providers

These third-party providers may process personal data on our behalf for purposes such as hosting, data storage, system functionality, and performance monitoring.

For push notifications, device identifiers or tokens may be shared with Firebase Cloud Messaging (FCM) solely for the purpose of delivering notifications related to Platform activity.

While CAARVN selects service providers that implement appropriate security and data protection measures, such providers operate independently and may have their own privacy policies and practices.

CAARVN does not control and is not responsible for the privacy practices, policies, or actions of third-party services.

Certain Services may depend on third-party infrastructure, and availability or performance may be affected by such dependencies.

Users acknowledge that interactions with third-party services, including through integrations or external systems, are subject to the terms and privacy policies of those respective providers.

11. Data Transfers

Your personal data may be processed, stored, or transferred to locations outside your state or country, including through the use of cloud infrastructure and third-party service providers such as Amazon Web Services (AWS).

Such transfers may occur as part of the normal operation of the Platform, including data storage, processing, backup, and system functionality.

CAARVN takes reasonable steps to ensure that personal data is handled securely and in accordance with applicable data protection standards, including through the use of appropriate safeguards and contractual protections where applicable.

By using the Platform, you acknowledge and agree that your data may be transferred, processed, and stored in such locations.

While we take reasonable measures to protect your data, the data protection laws in such jurisdictions may differ from those in your location.

CAARVN primarily uses cloud infrastructure services such as Amazon Web Services (AWS), which may include data storage in regions outside India. Data transfers are conducted in accordance with applicable law, including permitted jurisdictions under the Digital Personal Data Protection Act, 2023.

12. Changes to This Privacy Policy

CAARVN reserves the right to modify or update this Privacy Policy at its sole discretion to reflect changes in the Platform, applicable laws, or operational requirements.

Any updates to this Privacy Policy will be published on the Platform along with the revised effective date.

Where required by applicable law, Users may be notified of material changes through appropriate means, including in-app notifications or other communication channels.

Continued access to or use of the Platform after such updates constitutes your acknowledgment and acceptance of the revised Privacy Policy.

Previous versions of this Privacy Policy may be retained for reference upon request.

13. Grievance Officer

In accordance with applicable law, including the Digital Personal Data Protection Act, 2023, CAARVN has appointed a Grievance Officer to address concerns related to personal data and privacy.

Grievance Officer

Name: SHREYAS.M

Email: shreyas.m@caarvn.com

CAARVN will:

• Acknowledge complaints within 24 hours of receipt
• Resolve complaints within 15 days, subject to the nature and complexity of the request

14. Contact

For any questions, requests, or concerns related to this Privacy Policy or your personal data, you may contact us at:

Email: support@caarvn.com