Privacy Policy

1. Overview

MyTourCab (“we”, “our”, “us”) operates the website mytourcab.com and related mobile applications (collectively, the “Platform”). We are committed to protecting the privacy of every person who visits, registers with, or makes a booking through the Platform.

This Privacy Policy describes how we collect, use, store, share, and protect your personal data. It is published in compliance with the Information Technology Act, 2000, the IT (SPDI) Rules, 2011, and the Digital Personal Data Protection Act, 2023 (DPDP Act).

By using our Platform you consent to the practices described in this policy. If you do not agree, please discontinue use of the Platform.

2. Information We Collect

2.1 Information you provide directly

• Account data: name, email address, mobile number, password (hashed).
• Booking data: travel dates, destinations, passenger count, vehicle preferences, special requests, pickup address.
• Payment data: billing name and address. Card numbers are handled exclusively by Razorpay and are never stored on our servers.
• Identity documents: uploaded only where required for vendor or driver verification.
• Communications: messages sent via our support system or contact form.

2.2 Information we collect automatically

• IP address, browser type, device identifiers, operating system.
• Pages visited, search queries, referral URLs, session duration.
• Approximate geolocation (city/region level, derived from IP).

2.3 Information from third parties

If you register or log in via a third-party service (e.g., Google), we receive the name and email address authorised by you through that service.

3. How We Use Your Data

We process your personal data for the following purposes:

• Fulfil bookings — confirm reservations, assign drivers, coordinate pickups.
• Transactional communications — booking confirmations, payment receipts, itinerary updates, trip reminders.
• Customer support — respond to queries, disputes, and complaints.
• Platform improvement — analyse usage patterns to improve features and personalise your experience.
• Legal compliance — meet obligations under applicable Indian law (tax records, court orders, regulatory requests).
• Fraud prevention and security — detect and prevent fraudulent transactions and unauthorised access.
• Marketing — send promotional emails only where you have opted in. You may opt out at any time.

4. Data Sharing

We do not sell your personal data. We share data only as follows:

• Vendor partners and drivers — booking details (name, phone, pickup point, travel dates) are shared with the assigned cab operator solely to fulfil your trip.
• Payment processors — Razorpay processes all payments; your financial data is subject to Razorpay's privacy policy.
• Cloud and infrastructure providers — AWS (data hosting), Cloudinary (image storage), and email service providers operate under strict data processing agreements.
• Legal authorities — we disclose data when required by law, court order, or to protect the rights and safety of users and the public.

5. Payments

All payment transactions on the Platform are processed by Razorpay Software Private Limited, a PCI-DSS compliant payment gateway. We do not receive, transmit, or store full card numbers or CVV codes. We retain only the transaction reference ID and masked card information (last four digits and card type) for booking records.

For information on how Razorpay handles your payment data, please refer to Razorpay's Privacy Policy.

6. Cookies

We use the following categories of cookies:

• Strictly necessary: session authentication, CSRF protection. These cannot be disabled without breaking the Platform.
• Functional: remember your language and search preferences.
• Analytics: aggregate, anonymised usage statistics to understand how the Platform is used.

We do not use third-party advertising or tracking cookies. You may disable cookies in your browser settings; however, some features of the Platform may not function correctly.

7. Data Retention

• Account data: retained for the duration of your account. Upon deletion, personal identifiers are removed within 30 days, subject to legal hold obligations.
• Booking and payment records: retained for a minimum of 7 years to satisfy requirements under the Income Tax Act, 1961 and GST legislation.
• Support communications: retained for 3 years.
• Server logs: retained for 90 days.

8. Your Rights

Under the DPDP Act, 2023, and applicable Indian law, you have the right to:

• Access: request a copy of the personal data we hold about you.
• Correction: ask us to correct inaccurate or incomplete data.
• Erasure: request deletion of your data, subject to legal retention obligations.
• Grievance redressal: raise a complaint with our Grievance Officer (see Section 13).
• Nominate: nominate another individual to exercise your rights in the event of your death or incapacity.
• Withdraw consent: opt out of non-essential processing (e.g., marketing emails) at any time via your account settings or by emailing us.

To exercise any of the above rights, email [email protected]. We will respond within 30 days of receiving a verifiable request.

9. Security

We implement reasonable security practices as prescribed under the IT (SPDI) Rules, 2011, including:

• HTTPS encryption for all data in transit.
• AES-256 encryption for sensitive fields at rest.
• Bcrypt hashing for passwords (minimum cost factor 12).
• Role-based access controls and audit logging.
• Regular vulnerability assessments.

No method of electronic transmission or storage is 100% secure. In the event of a data breach affecting your rights, we will notify you as required by law.

10. Children's Privacy

The Platform is not directed at children under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data without parental consent, please contact us immediately at [email protected] and we will take steps to delete such data.

11. Cross-Border Transfers

Your data is primarily stored on servers located in India (AWS Asia Pacific — Mumbai region). Certain third-party service providers may process data outside India. Where such transfers occur, we ensure that appropriate contractual safeguards are in place consistent with applicable data protection law.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the “Last updated” date at the top of this page.
• Notify registered users by email at least 7 days before the change takes effect.
• Display a notice on the Platform.

Continued use of the Platform after the effective date constitutes your acceptance of the changes.

13. Grievance Officer

In accordance with the IT Act, 2000 and DPDP Act, 2023, we have appointed a Grievance Officer to address any concerns regarding the processing of your personal data.

If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India once constituted under the DPDP Act, 2023.

14. Contact Us

For general privacy questions, data access requests, or to report a concern:

• Email: [email protected]
• Support: [email protected]
• Contact form: mytourcab.com/contact