Account: name, email, mobile number, city, an optional profile photo, and your password (stored only as a secure hash). Location: an approximate location derived from your city; if you tap "near me", your device location is used for that search only and is not stored. Cab owners: driving licence number, PAN (optional), only the last 4 digits of your Aadhaar number (we never store the full number), the Aadhaar and driving-licence document images you upload, and your vehicle details, photo and document references. Activity: inquiries, fare offers, chat messages, bookings, notifications, and any users you block or report. Security and app data: IP address and login events (to protect accounts), your device's push-notification token if you allow notifications in the mobile app, and app-verification tokens (Firebase App Check) that confirm requests come from the genuine website or app.
To create and secure your account, show you relevant cabs, let you negotiate, chat and book, verify cab owners and vehicles before they go live, send you notifications about your inquiries and bookings, keep users safe (blocking, reporting, fraud prevention) and meet legal obligations. We do not sell your data and do not show ads based on it.
Firebase (Google): verifies your mobile number by OTP, delivers push notifications to the mobile app (it receives your device token and the notification title), and runs App Check (reCAPTCHA on the website, Play Integrity on Android). OpenStreetMap Nominatim: receives the city or area text you enter, to convert it into a location. Our email provider: sends account and security emails. Render and Neon: host the service and its database. These providers process data only to provide their service to us; some may process it outside India.
Before a booking, the other party sees only your name and city. Your phone number and email are shared only with the customer or cab owner you have a confirmed booking with. KYC documents are encrypted and visible only to you and to RideMitra admins reviewing them (every admin view is logged). If a message or user is reported, admins can read the reported message to review it.
Account, KYC and vehicle data: until you delete your account (replaced documents are deleted). Notifications: 15 days. Security logs: 180 days. Login sessions: up to 30 days, ending after 7 days of inactivity. Password-reset links: 30 minutes. When you delete your account, your profile, KYC documents, vehicles, inquiries, chat messages and blocks are deleted; if you have bookings, the other party keeps the booking record with your personal details removed. Reports about abuse or safety may be kept as long as needed to handle them and to meet legal requirements.
Data is encrypted in transit (HTTPS). Passwords are hashed and KYC documents are encrypted at rest. Admin access is restricted and every view of a KYC document is logged.
You can update your details in your profile, turn push notifications off in your phone's settings, and delete your account at any time from My profile (or see how to delete your account). To access or correct your data, withdraw consent, or raise a grievance, contact our Grievance Officer at support@myridemitra.in — we aim to respond within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India. RideMitra is for users aged 18 and over.