1. Who we are and what this policy covers

This Privacy Policy explains how Gosaath ("Gosaath", "we", "us", "our"), of Madanapalle, Andhra Pradesh, India, collects, uses, shares, stores and protects personal data when you use the Gosaath passenger app, the Gosaath Captain app and the website gosaath.com (together, the "Platform"), and the rights you have.

For the purposes of the Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the rules made under it, Gosaath is the Data Fiduciary for the personal data described in this policy, and you are the Data Principal. This policy is also published under the Information Technology Act, 2000 (the "IT Act"), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and rule 3(1) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (the "IT Rules").

This policy forms part of the Terms of Use and the Captain Terms. Words defined there, such as captain, owner, passenger and renter, have the same meaning here.

2. Personal data we collect

Everyone

Account and sign-in: your mobile number, which we verify in one of these ways: a one-time password (OTP) sent by WhatsApp or SMS; Truecaller, if you choose "Continue with Truecaller" (Truecaller then shares with us only your verified mobile number and the name on your Truecaller profile, and only after you agree on Truecaller's screen); or, on Android, the other Gosaath app already signed in on the same phone ("Continue as …", which works only between our own two apps); your name; your gender; and, if you set one, a password, which we store only as a one-way hash. If you signed up in an earlier version with an email address or Google Sign-In, we also hold that email address and the name and photo Google shared.
Profile: your date of birth and a short "about you", if you add them.
Chats and support: the messages you send to other users and to Gosaath support, support tickets (their category, reference, subject and messages), and when you sent them.
Ratings, reports and votes: ratings and feedback you give or receive, complaints you make, and the places you vote for when you ask Gosaath to start in your area.

Passengers and renters

Quick Rides: pickup and drop points, the road route you booked, the vehicle, the number of people, the fare and any amount you add, the start code, and the status and history of your rides. If you book for someone else, their name and mobile number (you must have their permission).
Long Rides: your searches, seat requests, seats, the answer time you choose, bookings, and the ride requests you post (route, date, time and note).
Live photos: once a day, with your first Long Rides seat request (a Long Ride request needs only this live photo, no other document), a photo of you taken at that time with the front camera; on a Long Ride for more than one person, the name and a live photo of each other passenger, taken with their permission; and the place where each photo was taken, if you allow location. Our system checks automatically that each photo shows a face, and our team may look at a photo, for example to check a complaint or misuse. For these passenger photos it does not recognise who the person is, and we do not create face templates. (Captains' live photos are handled differently; see Face comparison for captains below.)
Rentals: your requests (vehicle, start time, length, note). The app does not ask renters for a live photo or a driving licence; the owner may check your licence in person at the handover. (Older versions of the app asked for a driving licence and a live photo; any you sent are kept and deleted as described in How long we keep data.)
Emergency contacts: the names and mobile numbers of up to three people that you type in, and whether each number belongs to a Gosaath account.

Captains and owners

Verification documents: a live photo of you (which becomes your profile photo), your driving licence (front, back and number) and the vehicle classes on it, the vehicle's registration certificate (front, back and vehicle number), your Aadhaar card (front and back), and, for an auto or car, the model and photographs of the vehicle. For Aadhaar, the app reads only the last four digits of the number on your phone and sends those four digits as text; we do not store the full Aadhaar number as text. The card images are kept so that our team can verify them. We also keep the results of the app's automatic checks (such as whether the right card was photographed and whether names match) and our team's decisions. Face comparison for captains: to help our team confirm that the documents belong to the person applying, our server compares the face in the captain's live photo with the photo printed on their driving licence and Aadhaar, and keeps only a similarity score (a percentage) with the documents. The score helps our team; it never approves or rejects anyone by itself, and it is deleted together with the documents.
Location while on duty: while you are online, and during a trip, the Captain app sends your location regularly, including when the app is in the background (a "You're online" notification shows while it does). It does not send it when you are offline and not on a trip.
Trips and fares: the requests you receive, accept or decline, your trips, Long Ride offers, seat answers and the fare amounts recorded for completed trips. Gosaath does not receive this money.
Rentals: your owner profile (name, area and the phone number on your account), each listing's photos, number plate, RC photos, details, rent, rental time, free and extra kilometres, availability and pickup place, and the answers you give to requests.

Data collected when you use the apps

Passenger location: your device's precise location, only with your permission and only while you use the app, to set the pickup, find captains and vehicles near you, show the trip and the fare, and run the safety features. The passenger app does not ask for background location.
Safety events: SOS alerts (time, place, ride and which contacts were told), wrong-route alerts on a ride and your answers to them.
Camera and photos: only the photographs you choose to take or upload.
Microphone: only if you use voice search. Your phone's speech service turns your speech into text, and we receive only the text.
SMS and WhatsApp codes: on Android, the app reads only the one message that carries your OTP, through the phone's SMS code service, or receives the code directly from WhatsApp when you use WhatsApp's "Autofill" for our code. It does not ask for permission to read your SMS or WhatsApp messages and does not read any other message.
Device and technical data: device model, operating system, app version, push-notification token, an identifier used to keep your account on one phone at a time, IP address, and logs of actions such as sign-ins, requests, bookings and status changes, with their dates and times.
Advertising data: see Advertising.

Gosaath does not handle any payment (not a single rupee passes through the Gosaath app), so we do not ask for your bank account details, card details or UPI PIN. Never share them in the app or in a chat.

3. Why we use your data

to create and secure your account, verify your mobile number and keep you signed in on one phone;
to show, match and manage Quick Rides, Long Rides and rentals, to calculate distances, fares and price ranges, and to send requests to captains and owners;
to verify captains' documents and vehicles and owners' listings, and to prevent fake, forged or duplicate accounts and vehicles;
to run the safety features: live tracking on the booked road, wrong-route alerts, SOS alerts to your emergency contacts, the start code and live photos;
to let the people on the same ride or rental communicate and find each other;
to send OTPs, notifications about rides and rentals, account messages and replies from support;
to investigate complaints, accidents, fraud and misuse, and to enforce our terms;
to comply with the law, to respond to lawful requests from authorities, and to establish, exercise or defend legal claims;
to show ads that help keep the apps free; and
to understand how the Platform is used, fix problems and improve it, using aggregated or de-identified data wherever possible.

4. Consent and legitimate uses

We process your personal data on the basis of your consent, which you give when you sign up, when you grant a permission in the app, or when you provide the data, for the purposes stated in this policy. We may also process personal data without consent where the DPDP Act allows it as a legitimate use, for example where you have voluntarily provided data for a specific purpose, to comply with a law, judgment or order, to respond to a medical emergency or a threat to anyone's life or health, or during a disaster or a breakdown of public order.

If you do not give the data a feature needs (for example, your location for Quick Rides, a live photo for a Long Rides request, or documents to become a captain), you will not be able to use that feature, but you can still use the rest of the Platform where possible.

5. Withdrawing consent

You can withdraw your consent at any time, as easily as you gave it: turn off a permission (location, microphone, camera or notifications) in your phone's settings, remove information from your profile, remove your driving licence or emergency contacts, delete your account (see Deleting your account and data), or write to the Grievance Officer.
Withdrawing consent does not affect processing that took place before you withdrew it, or processing that we must continue under the law. After you withdraw consent, some or all features may stop working for you.

6. Who we share your data with

We share your personal data only with the people and organisations listed in this section, and only what each one needs.

1. The other person on your ride or rental (limited)

Quick Rides: the captain who accepts your request sees your first name (or the name of the person you booked for), the pickup and drop, the booked route, the fare and a phone number to call the rider. You see the captain's name and photo, the vehicle model and number plate, a phone number to call, and the captain's live location during the ride.
Long Rides: before you book, you see a captain's first name, vehicle type, route, seats and price per seat. After the captain confirms your booking, you also see the captain's full name, photo, vehicle model, colour and number plate. Passengers never receive a Long Rides captain's phone number. The captain of a ride you request sees your name, phone number, seats, pickup and drop, your live photo, and the names and live photos of the people travelling with you, while the request is waiting or booked.
Ride requests you post: verified captains with an approved bike or car can see the request with your name, phone number, route, date, time and note, so that they can call you.
Rentals: the owner of a vehicle you request sees your name and the request details and note. The app does not send a live photo or driving licence with a request (if an older version of the app sent them, the owner sees them only with that request, while it is waiting or booked, and the licence until 24 hours after the rental ends). The owner does not receive your phone number through the app. You see the owner's name, phone number, pickup place and the vehicle's details.
Chats: the messages you send go to the other person in that chat.

2. Your emergency contacts, when you send an SOS

When you send an SOS (or the app sends one because a wrong-route alert was not answered), your emergency contacts who have a Gosaath account receive your name and phone number, the captain's name and phone number, the vehicle, where you were going and your live location until the trip ends. Gosaath uses your emergency contacts' numbers for nothing else.

3. Service providers who run the Platform for us

Carefully chosen service providers process data on our behalf, only on our instructions and only for the purposes in this policy: SMS, WhatsApp and OTP delivery (MSG91; WhatsApp is run by Meta); phone-number verification with Truecaller when you choose it; maps, routes and place search; push notifications; cloud hosting and database storage; and advertising (Google AdMob in the apps and Google AdSense on the website's home page; see Advertising).

4. Police, courts and authorities, only on a valid legal request

We disclose personal data to the police, courts, transport departments and other government agencies only when we receive a valid legal request or order under the law in force, or where the law requires or permits us to act to protect someone's life or safety in an emergency. Requests must come through the official channel described on our Grievance Redressal page.

What others can see because you publish it

A captain's Long Ride offer on the board (first name, vehicle type, route, date, time, seats and price) and a shared Long Ride link (gosaath.com/ride/…), which never shows phone numbers or email addresses.
An owner's vehicle listing (owner name, area and phone number, photos, details, rent and ratings).

Within Gosaath

A small number of authorised Gosaath team members can see accounts, documents, rides, rentals, safety events, logs and chats, only to verify users, resolve complaints, keep users safe and comply with the law.

7. We never sell your data

Gosaath never sells, rents or trades your personal data. We do not give advertisers or data brokers your name, phone number, photos, documents, location history or chats. The advertising services collect only what Advertising describes, under their own policies.

8. How long we keep data

OTP codesMinutes, then deleted
Ride chats (hidden from both users one day after the ride ends)Deleted 14 days after the ride ends
Live photos for Long Rides (and any sent with a rental request by an older app), with names and places7 days after the ride or rental
Captains' location history while online or on a trip24 hours, then deleted automatically
Captains' replaced document sets (after a newer set is approved)30 days after replacement
Captains' current documentsWhile the account is active
Removed rental listings30 days after removal
A driving licence added for rentals (older app versions)Until you remove it or delete your account
Emergency contactsUntil you remove them or delete your account
Your account after you ask to delete itDeleted 30 days later

A Long Rides live photo is deleted 7 days after the ride's departure time; a rental live photo 7 days after the rental ends, or 7 days after the request is declined, cancelled or expires. A photo that is never sent with a request is deleted after the day it was taken.
If you delete a chat message, it is hidden from the other person at once, but a copy is kept for safety review until the chat itself is deleted.
Records of rides, requests, rentals, SOS alerts, support tickets, sign-ins and other logs are kept for as long as needed for safety, fraud prevention, handling complaints and disputes, and legal and tax compliance, and in any case for at least the periods the law requires. For example, the IT Rules require an intermediary to keep a user's registration information for 180 days after the account is closed, and the rules under the DPDP Act require certain logs to be kept for at least one year. After that, these records are deleted or anonymised.
We may keep data for longer where the law requires it, where it is needed for an ongoing investigation, complaint or legal proceeding, or where a lawful order asks us to preserve it.

9. Deleting your account and data

You can delete your account in the passenger app (Profile, then Account & privacy, then Delete my account; or Settings, then Delete Account), on our delete account page, or by writing to the Grievance Officer. Captains use the same Gosaath account and can delete it in the same ways. When you ask, you are signed out, and your account is deleted 30 days later; signing in again within those 30 days cancels the request. On deletion, your profile, documents, photos, ride history and chats are removed, except data that we must keep under the law, as explained in How long we keep data. See also Account & Data Deletion.

10. How we protect your data

We use reasonable security practices and procedures, including encrypted (HTTPS) connections, passwords stored only as one-way hashes, one phone at a time per account, and strict limits on who at Gosaath can see personal data. For your safety, the Gosaath apps check on your phone whether Developer options or USB debugging are switched on, and do not run until they are turned off. No system is completely secure. If a personal data breach happens, we will take steps to contain it and will inform the Data Protection Board of India and the affected users as the law requires.

11. Where your data is stored

Your data is stored on servers run by our cloud hosting provider and by the service providers listed above, who may store or process it in India or in other countries. We transfer personal data outside India only as permitted by the DPDP Act and any restrictions notified by the Government of India.

12. Your rights

Subject to the DPDP Act and other applicable law, you have the right to:

access a summary of the personal data we process about you, the processing we carry out, and the identities of those with whom we have shared it;
correct, complete or update your personal data (you can change most of it yourself in the app, and captains can send new documents at any time);
erase your personal data, including by deleting your account, unless we must keep it for a stated purpose or under a law;
withdraw consent, as described above;
grievance redressal through our Grievance Officer and, if you are not satisfied, complain to the Data Protection Board of India; and
nominate another person to exercise your rights if you die or become unable to exercise them.

To use these rights, write to the Grievance Officer and include your registered mobile number. We may need to verify your identity before we act. We acknowledge requests within 24 hours and aim to complete them within 15 days, and in any case within the time the law allows.

13. Your duties

Under section 15 of the DPDP Act, you must not impersonate anyone, must not suppress material information or give false particulars (including in documents), must not file false or frivolous complaints, and must give only verifiably authentic information when you ask us to correct or erase data. If you give us someone else's details (such as a person you book for, a co-passenger or an emergency contact), you must have their permission. If you receive other users' data through the Platform, use it only for that ride or rental. Breaking these duties may lead to a penalty under the Act and to the suspension of your account.

14. Children

The Platform is only for people aged 18 or over. We do not knowingly collect personal data of anyone under 18, and we do not track or monitor the behaviour of children or target advertising at them. If we learn that a person under 18 has created an account, we will delete it. If you believe that a child has given us personal data, please contact us.

15. Website, cookies and similar technologies

Our website's home page may show ads served by Google AdSense. Google and its partners may use cookies and similar technologies to show, measure and personalise those ads, based on your visits to this and other websites, under Google's own privacy policy. You can turn off personalised ads at adssettings.google.com, and read how Google uses data at policies.google.com/technologies/ads. Our help, safety, legal, payment and account pages show no ads. Some pages load fonts from Google Fonts, which receives your IP address and browser details when your browser fetches them.

16. Advertising

The apps show ads served by Google AdMob, which may collect your device's advertising ID, IP address, approximate location and information about how you interact with ads, to show, measure and personalise ads, under Google's own privacy policy. You can reset or delete your advertising ID, or opt out of personalised ads, in your Android settings (usually under Settings, then Google, then Ads, or Settings, then Privacy, then Ads). You can read how Google uses data at policies.google.com/technologies/ads.

17. Changes to this policy

We may update this policy from time to time. The "Last updated" date and the version at the top of this page show the current version. If we make a significant change, we will tell you in the app or on the website and, where the law requires, ask for your consent again.

18. Grievance Officer and contact

For any question, request or complaint about your personal data, contact:

Grievance Officer, Gosaath (also our contact for data protection matters)
Name and designation: Venu Madhav, Co-founder & Chief Executive Officer
Email: [email protected]
Phone / WhatsApp: +91 73370 51857
Address: Madanapalle, Annamayya District, Andhra Pradesh 517325, India

If you are not satisfied with our response, you may complain to the Data Protection Board of India. See Grievance Redressal & Contact for our time limits and other ways to escalate.