Data Fiduciary: Axxoraa Private Limited, H.no 70, Near Ram Mandir Main Road, Barajamda, West Singhbhum, Jharkhand 833221, India
CIN: U62099JH2025PTC026425
Website: www.bookkaro.co.in
Grievance Officer: Sidharth Kumar Prasad | Phone: +91 92631 33158 | Email: grievance@bookkaro.co.in
1. Introduction and Scope
Axxoraa Private Limited ("Company", "we", "us", "our") operates BookKaro, a software directory connecting Customers with independent Vehicle Owners ("Captains"). This Privacy Policy explains how we collect, use, store, share, and protect personal data through the BookKaro website at www.bookkaro.co.in, the BookKaro Android application, and related services (collectively, the "Platform").
This Policy applies to all Users — Customers (persons who search for vehicles and contact Captains) and Captains (Vehicle Owners who list vehicles). It is drafted to comply with:
- The Digital Personal Data Protection Act, 2023 ("DPDP Act").
- The Information Technology Act, 2000 and rules thereunder.
- Google Play Developer Program Policies, including the Data Safety section requirements.
- Applicable Indian consumer protection and transport regulations.
By using the Platform, you consent to the practices described in this Policy. If you do not agree, you must not use the Platform.
2. Data We Collect (Google Play Data Safety Disclosure)
We collect the following categories of personal and sensitive user data. This list is intended to align with the declarations you must make in Google Play Console's Data Safety form.
2.1 Location Data (Customers and Captains)
Who: Collected from both Customers and Captains.
What we collect: Approximate location (city-level) and precise location (GPS-based) while the app is in use.
How: With your permission through Android location permissions (ACCESS_COARSE_LOCATION and/or ACCESS_FINE_LOCATION). Location is requested once on the landing screen. We do not access background location.
Why: To show nearby vehicles to Customers, set accurate pickup points, calculate distances, and support safety features for both roles.
Optional/Required: Required for core functionality (vehicle discovery and pickup coordination). You may deny permission, but the Platform will not function as intended.
2.2 Phone Number and Account Data
What we collect: Mobile phone number, name, email address, OTP verification status, profile photo (optional), and user role (Customer or Captain).
Why: Account creation, verification, communication, and safety.
2.3 Vehicle and KYC Documents (Captains Only)
What we collect: Registration Certificate (RC), Driving Licence (DL), Insurance certificate, Aadhaar, vehicle type (Bike, Auto, Pickup, Car, Ertiga, Bolero, Suzuki, Three Wheeler), registration number, and vehicle photographs.
Why: Captain verification, safety, and compliance with applicable transport regulations.
Collection method: Uploaded by Captains through the App or Website using the device camera or photo gallery. These are sensitive documents; access is restricted to authorized verification personnel.
2.4 Camera and Photo Gallery Access (Captains Only)
Who: Requested only from Captains, at the moment of uploading vehicle photos or KYC documents.
Permissions used: CAMERA, READ_MEDIA_IMAGES (Android 13+), READ_EXTERNAL_STORAGE (Android 12 and below).
What we collect: Only the images you explicitly capture with your camera or select from your gallery for the purpose of uploading to your vehicle or document records. We do not scan, read, or upload any other media on your device.
Why: To let Captains photograph their vehicle, RC, DL, insurance, or Aadhaar directly from the App, or choose an existing image from their gallery.
Customers: The Customer experience does not request camera or gallery permissions. Customers can browse, book, and contact Captains without granting these permissions.
2.5 Communication Data (Chat and Call Logs)
What we collect: In-app chat messages (content and metadata), call records (metadata such as time, duration, and parties), and WhatsApp routing records.
Why: To facilitate booking confirmation, ensure safety, resolve disputes, and comply with legal requests.
Retention: Stored for a limited safety and dispute-resolution window (see Section 7).
2.6 Payment Data (Captains — Subscriptions Only)
What we collect: Subscription status, transaction identifiers, and purchase history.
What we do NOT collect: Full card numbers, bank account details, or UPI credentials. These are handled entirely by Razorpay (Website) or Google Play Billing (App).
Important: BookKaro does not process ride payments. Ride payments (Cash/UPI) are physical, off-platform settlements between Customer and Captain. The Platform does not collect ride payment data.
2.7 Usage and Device Data
What we collect: App version, device identifiers, operating system, IP address, crash logs, and analytics data.
Why: Platform security, fraud prevention, troubleshooting, and improvement.
- Location (approximate & precise) — collected from all users, foreground only, for app functionality.
- Photos / Videos — collected only from Captains, only when they choose to upload, for account verification and vehicle listing.
- Camera — accessed only by Captains to capture vehicle/document photos.
- Personal info, messages, and app activity as described above.
- No background location. No data sold. No advertising use.
3. How We Use Your Data
We use personal data for the following specified purposes:
- Operating the software directory and enabling Customers to discover and contact Captains.
- Verifying Captains and vehicles through document checks.
- Enabling communication between Customers and Captains via In-App Chat, Call routing, and WhatsApp routing.
- Ensuring safety, investigating complaints, and resolving disputes.
- Processing Captain subscription payments via Razorpay (Web) or Google Play Billing (App).
- Preventing fraud, abuse, and unauthorized access.
- Complying with legal obligations and responding to lawful requests from law enforcement.
- Improving and securing the Platform, including analytics and crash reporting.
- Communicating service updates and policy changes.
4. Legal Basis for Processing
Under the DPDP Act, we process personal data based on:
- Your consent: For location, camera/gallery (Captains), KYC documents, and communication features. You may withdraw consent at any time, though this may affect your ability to use certain features.
- Performance of our service: To provide the directory and subscription services you request.
- Legitimate uses: For safety, fraud prevention, security, and legal compliance as permitted under the DPDP Act.
5. Consent and Withdrawal
When you register, you provide consent for the collection and processing described in this Policy through an explicit consent checkbox. Location is requested separately on the landing screen; camera and gallery are requested separately and only when a Captain initiates a photo upload.
How to withdraw consent: You may withdraw consent by:
- Disabling location permissions in your device settings.
- Disabling camera or photo permissions in your device settings (Captains).
- Writing to grievance@bookkaro.co.in with your registered mobile number and request.
- Using the account deletion option (see Section 12).
Withdrawal of consent does not affect the lawfulness of processing before withdrawal. It may result in loss of access to certain features.
6. Third-Party Sharing and Disclosure
We share limited personal data with the following categories of third parties. We do not sell your personal data.
| Third Party | Data Shared | Purpose |
|---|---|---|
| Google (Play Billing) | Subscription purchase data | Processing Android App subscription payments |
| Google (Maps/Firebase) | Location data, device data, crash logs, analytics | Maps and location services, crash reporting, analytics |
| Razorpay | Name, contact, subscription purchase data | Processing Website subscription payments |
| WhatsApp/Meta | Phone number, communication routing data | Routing communication between Users |
| Service providers | As necessary for hosting, analytics, support | Platform operations (bound by confidentiality) |
| Law enforcement/courts | As legally required | Compliance with valid legal requests (see Law Enforcement Guidelines) |
Google Play Data Safety note: For the purpose of Google Play's Data Safety section, transfers to service providers (entities processing data on our behalf) are not considered "sharing" and will be declared accordingly. Transfers for legal purposes are also treated separately.
7. Data Retention
We retain personal data only as long as necessary for the purposes described, for safety and dispute-resolution windows, and as required by law.
| Data Type | Retention Period |
|---|---|
| Account and profile data | While account is active + 90 days after deletion request (for dispute resolution), then deleted or anonymized |
| KYC documents and vehicle photos (Captains) | While listing is active + 3 years after termination (for legal/regulatory compliance), then deleted |
| Chat logs and call metadata | 180 days from the date of the communication, then deleted or anonymized unless required for an ongoing investigation |
| Subscription and payment identifiers | 7 years (as required under tax and accounting laws) |
| Location logs | 90 days from collection, then deleted or anonymized |
| Crash and device logs | 12 months, then deleted |
Where you request deletion (see Section 12), we will delete or anonymize data within the timelines stated, subject to legal retention obligations.
8. Data Security
We implement reasonable technical and organizational safeguards to protect personal data, including:
- Access controls restricting KYC document and vehicle photo access to authorized personnel only.
- Secure storage and transmission practices.
- Regular review of data collection and retention practices.
However, no system is completely secure. You share data at your own risk and are responsible for maintaining the confidentiality of your account credentials. If you suspect unauthorized access, contact us immediately at grievance@bookkaro.co.in.
9. Cross-Border Data Transfers
Some of our third-party service providers (including Google and Razorpay) may process data on servers located outside India. Where data is transferred outside India, we take reasonable steps to ensure that appropriate safeguards are in place consistent with applicable law. By using the Platform, you consent to such transfers as necessary for the services described.
10. Your Rights Under the DPDP Act
Subject to applicable law, you have the following rights:
- Right to Access: Request a summary of the personal data we process about you and the identity of the Data Fiduciary.
- Right to Correction: Request correction of inaccurate or incomplete personal data.
- Right to Erasure: Request erasure of personal data that is no longer necessary for the purpose for which it was collected, subject to legal retention obligations.
- Right to Withdraw Consent: Withdraw consent at any time (see Section 5).
- Right to Nominate: Nominate another person to exercise your rights in the event of death or incapacity.
- Right to Grievance Redressal: Lodge a complaint with our Grievance Officer (see Section 14).
- Right to Complain to the Data Protection Board: If unsatisfied with our response, you may complain to the Data Protection Board of India.
To exercise these rights, write to grievance@bookkaro.co.in with your registered mobile number and a clear description of your request. We will respond within the timelines prescribed by law.
11. Children's Privacy
The Platform is not intended for persons under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will delete it promptly. If you believe a child has provided us with personal data, contact us at grievance@bookkaro.co.in.
12. Account Deletion
You may request deletion of your account and associated personal data at any time by:
- Using the "Delete Account" option in the App or Website (see delete-account.html).
- Writing to grievance@bookkaro.co.in with your registered mobile number.
Upon a valid deletion request, we will:
- Delete or anonymize your account and profile data within 30 days.
- Delete vehicle photos and KYC documents uploaded by Captains within 30 days, except where retention is required by law.
- Retain certain data as required by law (e.g., subscription records for tax purposes, KYC documents for regulatory compliance, chat/call logs for safety investigations) for the periods stated in Section 7.
- Confirm deletion to you once complete.
13. Cookies and Tracking (Website)
Our Website uses cookies and similar technologies for functionality, analytics, and security. Non-essential cookies (analytics, functional) are set only with your consent through the cookie banner. You may manage or withdraw consent at any time through the cookie preferences link in the Website footer or your browser settings. For full details, see our Cookie Policy.
14. Grievance Officer and Complaint Process
If you have any questions, concerns, or complaints about this Privacy Policy or our data practices, contact our Grievance Officer:
Grievance Officer
Name: Sidharth Kumar Prasad
Designation: Grievance Officer
Phone: +91 92631 33158
Email: grievance@bookkaro.co.in
Address: H.no 70, Near Ram Mandir Main Road, Barajamda, West Singhbhum, Jharkhand 833221, India
Working Hours: Monday to Friday, 10:00 AM – 6:00 PM IST
Response timelines: We acknowledge privacy complaints within 48 hours and aim to resolve them within 15 days. If we need more time, we will inform you of the reason and expected timeline.
15. Data Protection Board
If you are unsatisfied with our response to a privacy complaint, you may lodge a complaint with the Data Protection Board of India under the DPDP Act, 2023.
16. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Material changes will be notified via the Platform or email where practicable. The "Last Updated" date at the top indicates when the Policy was last revised. Your continued use after changes constitutes acceptance.
17. Contact
For any questions about this Privacy Policy: grievance@bookkaro.co.in | +91 92631 33158