Privacy Policy for Vallo

1. Introduction and Scope

This Privacy Policy explains how Vallo ("we," "us," or "our") collects, stores, uses, shares, and protects your personal data when you interact with the Vallo Platform. This policy applies universally to all Users, including Passengers, Drivers, Carpool Givers, and Co-Travellers. By accessing or using the Platform, you consent to the data practices outlined in this document, which are strictly formulated to comply with the Digital Personal Data Protection (DPDP) Act, 2023, and applicable Indian regulations.

2. Data Provided Directly by You

We collect information you explicitly provide when you create an account, request services, or contact support. This includes:

• Account Registration Details: Your legal name, mobile phone number, email address, profile picture, and designated emergency contact information.
• KYC and Verification Documents: Government-issued identification (including Aadhaar and PAN), active Driving Licenses, Vehicle Registration Certificates (RC), Vehicle Fitness Certificates, and live verification selfies.
• Financial and Payment Information: Bank account details, UPI IDs, credit/debit card tokens, and digital wallet information necessary to process trip fares or disburse driver earnings.
• User Communications: Data provided when you contact Vallo customer support, submit ratings, leave reviews, or communicate with other Users through the in-app chat or calling features.

3. Data Collected Automatically

To provide a functional and secure service, the Platform automatically collects specific data points from your device:

• Location Data: We collect precise real-time location data (GPS coordinates) from your mobile device. For Drivers and Carpool Givers, this is collected in the foreground and background when the app is active to facilitate matching and routing. For Passengers and Co-Travellers, this is collected from the moment a ride is requested until it is completed.
• Device Information: We log your hardware model, operating system version, software file names, unique device identifiers (IMEI/MAC address), mobile advertising IDs, and mobile network operator information.
• Usage Logs and Trip Metadata: We automatically record details regarding how you interact with the Platform, including access dates and times, app features viewed, system crashes, IP addresses, search queries, booking timestamps, exact trip routes, and travel distances.

4. Data Acquired from Third Parties

We may occasionally supplement the data we collect directly with information from trusted third-party partners:

• Background Verification Agencies: We receive reports regarding document authenticity, driving history, and criminal background checks required to onboard Drivers and Carpool Givers safely.
• Financial Gateways: We receive transaction statuses, payment confirmations, and fraud-risk assessments from our integrated third-party payment processors.
• Referral Programs: If you are invited to the Platform by another User, we receive the basic information required to attribute the referral bonus to the correct accounts.

5. Core Service Provision

We process your personal and automatically collected data fundamentally to provide, operate, and maintain the Platform. This includes:

• Matchmaking and Routing: Utilizing GPS data and algorithms to match Passengers with Drivers/Carpool Givers, providing accurate ETAs, and navigating trips.
• Fare and Payment Processing: Calculating estimates, finalizing surge pricing, processing secure payments via third-party gateways, and disbursing driver earnings.
• Account Management: Creating, updating, and maintaining your User profile, verifying eligibility, and processing loyalty rewards.
• Customer Support: Accessing trip logs and communications to investigate complaints, process refunds, and resolve user issues promptly.

6. Safety, Security, and Fraud Prevention

Ensuring physical safety and digital security is a core operational necessity. We process data to:

• Identity Verification: Screening Drivers and Carpool Givers against criminal databases, and verifying government IDs (Aadhaar/PAN) to prevent platform access by unauthorized or banned individuals.
• Trip Monitoring: Tracking real-time locations and enabling the SOS button to assist during emergencies, route deviations, or prolonged stops.
• Fraud Detection: Analyzing device data, usage patterns, and IP addresses to detect and prevent GPS spoofing, account takeovers, referral abuse, and payment fraud.

7. Communications and Marketing

We utilize your contact information to keep you informed:

• Transactional Updates (Mandatory): Sending critical trip updates, OTPs, receipts, and policy changes via SMS, email, or push notifications. These are essential for platform functionality.
• Marketing (Optional): Sending promotional offers, new feature announcements, and referral codes. Under the DPDP Act, you reserve the right to withdraw your consent for marketing communications at any time via the in-app privacy settings. Withdrawing consent for marketing does not affect your ability to use the core Platform services.

8. Research and Platform Improvement

To ensure the Platform remains efficient and user-friendly, we analyze aggregated and anonymized data for:

• Algorithmic Optimization: Reviewing historical traffic patterns, trip durations, and cancellation rates to refine our routing logic and surge pricing models.
• Troubleshooting: Analyzing crash logs, device compatibility reports, and bug submissions to maintain app stability.
• Feature Development: Understanding user behavior and feature engagement to design and launch new mobility products or app functionalities.

9. Sharing Between Users

• Trip Facilitation: To facilitate a Ride, necessary personal data is temporarily shared between the Passenger/Co-Traveller and the Driver/Carpool Giver.
• Passenger Information: Drivers receive the Passenger’s first name, pickup and drop-off locations, and platform rating.
• Driver Information: Passengers receive the Driver’s first name, profile photo, vehicle make/model, vehicle registration number, and platform rating.
• Communication Privacy: Vallo utilizes call-masking technology. When Users call each other through the Platform during an Active Trip, their actual phone numbers remain anonymized and are not visible to the other party.

10. Third-Party Service Providers (Data Processors)

• Valid Contracts: In strict accordance with the DPDP Act, Vallo acts as a Data Fiduciary and only shares personal data with third-party Data Processors under legally binding Data Sharing Agreements (DSAs).
• Categories of Processors: We share data with localized cloud hosting services, secure payment gateways (for processing transactions), background verification agencies (for driver screening), insurance providers (for in-trip coverage), and communication APIs (for SMS/email OTP delivery).
• Right to Identity: Upon verifiable request, Users have the legal right to obtain a summary of their personal data being processed and the identities of all third-party Data Processors with whom their personal data has been shared, along with a description of the data shared.

11. Legal and Regulatory Compliance

• Law Enforcement: Vallo may disclose personal data to law enforcement, government authorities, tax departments, or regulatory bodies (e.g., the Data Protection Board of India) if explicitly required to do so by Applicable Law, legal process, or valid court order.
• Protection of Rights: We reserve the right to share data to investigate, prevent, or take action regarding suspected fraud, network abuse, physical safety threats, or material violations of our Terms and Conditions.

12. Corporate Transactions

• Asset Transfers: In the event Vallo undergoes a merger, acquisition, corporate restructuring, bankruptcy, or sale of all or a portion of its assets, User personal data may be transferred as part of the transaction.
• Notice of Transfer: Users will be notified via email or a prominent notice on the Platform of any change in ownership or changes in the Data Fiduciary controlling their personal information, prior to the data being subjected to a different privacy policy.

13. Data Localization and Cross-Border Transfers

• Domestic Storage Priority: While the Digital Personal Data Protection (DPDP) Act, 2023 permits cross-border data transfers to jurisdictions not explicitly restricted by the Central Government, Vallo prioritizes domestic data sovereignty. All critical User, Passenger, and Driver data—including KYC documents, trip histories, and live location logs—is hosted securely on cloud servers physically located within the Republic of India.
• Restricted Transfers: In compliance with potential restrictions on Significant Data Fiduciaries (SDFs) and specific data categories, Vallo does not transfer sensitive personal data (such as biometric verification or financial instruments) outside of Indian jurisdiction. Any data processed externally is strictly limited to anonymized analytics or routing queries handled by globally compliant third-party processors under legally binding Data Sharing Agreements.

14. Data Security Protocols

• Reasonable Security Safeguards: As mandated by the DPDPA and the DPDP Rules, Vallo implements robust, industry-standard technical and organizational measures to prevent personal data breaches, unauthorized access, or accidental data loss.
• Encryption and Authentication: All data transmitted between the User's device and our servers is secured using SSL/TLS encryption. Access to user accounts requires secure authentication mechanisms, including SMS-based One-Time Passwords (OTPs) to prevent unauthorized account takeovers.
• Internal Access Controls: Vallo strictly limits internal access to personal data. Only authorized personnel whose roles require processing the data (e.g., customer support agents handling a specific ticket or safety response teams during an active SOS) are granted access, and all such access is continuously logged and audited.

15. Data Retention Periods

• Purpose-Based Retention: In direct adherence to Section 8(7) of the DPDP Act 2023, Vallo retains your personal data only for as long as it is necessary to fulfill the purpose for which it was collected, or until you explicitly withdraw your consent, whichever occurs earlier.
• Statutory Minimums: Certain records must be retained to satisfy Indian regulatory mandates, even if you delete your account. This includes:
  • Access Logs and Processing Records: Retained for a mandatory minimum of one (1) year from the date of processing, as required by the DPDP Rules.
  • Financial and Transactional Records: GST invoices, payment logs, and driver payout histories are retained for up to six (6) years to comply with the Goods and Services Tax Act and Reserve Bank of India (RBI) guidelines.
• Inactivity Erasure: For prolonged inactivity, Vallo enforces a mandatory data erasure policy. If a User account remains entirely inactive (no logins, ride requests, or interactions) for a consecutive period of three (3) years, the account and its associated personal data will be permanently deleted, preceded by a mandatory 48-hour pre-erasure notification.

16. User Privacy Rights

Under the Digital Personal Data Protection (DPDP) Act, 2023, Users (referred to legally as "Data Principals") possess specific, enforceable rights regarding their personal data:

• Right to Access: You have the right to request a summary of your personal data being processed by Vallo and the identities of all third-party Data Processors with whom it has been shared.
• Right to Correction and Erasure: You may request the correction of inaccurate data, the completion of incomplete data, and the erasure of personal data that is no longer necessary for the purpose it was collected.
• Right to Withdraw Consent: You retain the right to withdraw your consent for data processing at any time with the same ease with which it was given. Note that withdrawing consent for core functional data (e.g., location tracking during a ride) will necessitate the termination of platform services.
• Right to Nominate: You possess the right to nominate another individual who shall, in the event of your death or physical/mental incapacity, exercise your data privacy rights on your behalf.
• Duties of the User: The DPDP Act legally obligates Users to not provide false particulars, suppress material information during KYC verification, or register false/frivolous grievances. Violating these duties may result in account termination and statutory penalties.

17. Location Tracking Controls

• Device-Level Permissions: Users retain full control over location tracking via their mobile device operating system settings (e.g., iOS or Android permissions).
• Impact of Revocation: Passengers may revoke location access at any time; however, they will be required to manually enter their pickup coordinates for every ride. Drivers and Carpool Givers cannot operate on the Platform without granting "Always On" or "While Using the App" location permissions, as real-time tracking is a fundamental requirement of the matchmaking and routing engine.

18. Children's Privacy

• Age Restriction: The Vallo Platform is strictly not intended for, nor directed at, individuals under the age of eighteen (18). We do not knowingly collect personal data from minors.
• Mandatory Deletion: If we discover that a minor has bypassed our age-gating mechanisms to create an account and submit personal data without verifiable parental consent, we will immediately suspend the account and permanently delete all associated data from our servers, except as required by law to prevent future registrations.

19. Modifications to the Privacy Policy

• Vallo reserves the right to periodically update this Privacy Policy to reflect changes in our data practices, algorithmic updates, or evolving legal frameworks.
• If we make material changes to how we collect, use, or share your personal data, we will provide explicit notice through the Platform (e.g., an un-dismissible pop-up) or via email before the changes take effect. Your continued use of the Platform following such notice constitutes your consent to the revised Privacy Policy.

20. Grievance Officer Details

In strict compliance with the DPDP Act, 2023, and the Information Technology Act, 2000, Vallo has appointed a designated Grievance Officer (acting as our Data Protection Officer) to address privacy concerns and data rights requests.

• First Tier Redressal: All privacy-related complaints must first be submitted to the Vallo Grievance Officer. You can expect an acknowledgment within 24 to 48 hours, and a full resolution within the statutory maximum timeframe (typically 7 to 30 days depending on the nature of the request).
• Contact Details:
  • Email: vallo@vallo.in
• Escalation to the Data Protection Board: If you are entirely unsatisfied with the resolution provided by our Grievance Officer, or if you do not receive a response within the legally prescribed timeframe, you retain the statutory right to escalate your complaint directly to the Data Protection Board of India.