Privacy Policy

Totowala Technologies Private Limited, a company incorporated under the laws of India ("TotoWala", "we", "our", or "us"), operates a zero-commission ride-hailing platform across Bihar, India. Through the TotoWala app, Riders can book on-demand rides across vehicle categories - Toto (electric rickshaw), Bike taxi, Auto rickshaw, and Cab - nearby available Drivers are notified, and a matched Driver fulfils the trip. Drivers use the TotoWala for Drivers app to receive and manage ride requests.

We respect your privacy and are committed to protecting the personal information you share with us. This Privacy Policy describes what information we collect from you when you use our applications and services, how we use and store that information, when and with whom we share it, and your choices and rights regarding your information.

This Privacy Policy applies to all users of our platform - including riders who use the TotoWala app to book rides, and drivers who use the TotoWala for Drivers app to provide transportation services. By accessing or using our services, you agree to the collection, use, and sharing of your information as described in this Privacy Policy. If you do not agree, please discontinue use of our services.

This Privacy Policy should be read together with our Terms and Conditions, which govern the use of our services.

We collect information you provide directly, information generated through your use of our services, and in certain cases, information from third-party sources.

2.1 Information You Provide

• Account registration: When you create an account, we collect your full name, mobile phone number, email address, date of birth, and address.
• Driver onboarding: Drivers are required to submit additional information for verification purposes, including a government-issued photo identity document (Aadhaar card, PAN card, or Voter ID), a valid driving licence, vehicle registration certificate, vehicle insurance details, a profile photograph, and a live selfie.
• In-app communications: Messages sent through the in-app chat during a ride, and any messages or information submitted to our customer support team.
• Ratings and feedback: Ratings and comments submitted after a completed ride.

2.2 Information Generated Through Use of Services

• Location data: Precise GPS location when you use our app, as further described in Section 5.
• Trip information: Pickup and drop-off addresses, trip route, distance travelled, trip duration, ride status, fare amount, and complete trip history.
• Transaction data: Payment amount, payment method type, and transaction reference identifiers for rides and donations processed through our platform.
• Device information: Mobile device model, operating system version, app version, and unique identifiers associated with your device.
• Usage data: Features and screens accessed within the app, session duration, and general interaction patterns.
• Crash and diagnostic data: App crash reports and error logs generated automatically when the app encounters a problem.

2.3 Information from Third Parties

We may receive limited information from third-party service providers in the course of delivering our services - for example, call status information from our communication service provider after a masked call between a rider and driver. We do not purchase or acquire personal data from data brokers.

We use the information we collect for the following purposes:

3.1 Providing and Operating the Service

• To create and manage your account and verify your identity.
• To match riders with available drivers based on location and vehicle preference.
• To provide real-time navigation and route information during a ride.
• To calculate and display ride fares before booking confirmation.
• To process payments and issue digital receipts for completed rides and donations.
• To facilitate communication between riders and drivers through masked voice calls and in-app chat.
• To send you booking confirmations, ride updates, receipts, and relevant service notifications.

3.2 Safety and Trust

• To verify driver credentials and maintain a trustworthy network of service providers.
• To monitor and respond to safety incidents, SOS alerts, and emergencies during rides.
• To detect, investigate, and prevent fraudulent activity, abuse, and violations of our Terms and Conditions.
• To investigate and resolve complaints and disputes between riders and drivers.

3.3 Improving Our Services

• To analyse how our app is used in order to improve existing features and develop new ones.
• To diagnose and fix technical problems and app crashes.
• To conduct internal research and data analysis to understand and improve service quality.

3.4 Legal and Compliance

• To comply with applicable Indian laws, regulations, and legal obligations.
• To respond to lawful requests from government authorities, courts, or regulatory bodies.
• To enforce our Terms and Conditions and protect the rights of TotoWala, its users, and the public.

We share your information only in the circumstances described below. We do not share your information with third parties for their own independent use.

4.1 Between Riders and Drivers

When a Rider books a ride and a Driver accepts the request, we share limited information between both parties to enable the trip. The Rider can see the Driver's first name, vehicle type, vehicle registration number, and real-time location as the Driver approaches. The Driver can see the Rider's first name and the trip's pickup and drop-off location. Phone numbers are never shared directly between the two parties - all in-app calls are routed through a masked communication system.

4.2 With Service Providers

We engage trusted third-party service providers to assist in operating our platform - including providers for cloud infrastructure and data storage, map and navigation services, OTP and SMS delivery, masked voice communication, and payment processing. We share only the minimum information necessary for each provider to perform their function.

Some of our service providers operate servers located outside India, including in the United States and other countries. Where your personal information is transferred internationally, we ensure that appropriate safeguards are in place.

4.3 For Legal Compliance and Protection

We may disclose your information if we believe in good faith that such disclosure is required to comply with a legal obligation, a court order, or a lawful request from a government or regulatory authority under applicable Indian law, including the Information Technology Act, 2000.

4.4 In Safety Emergencies

In the event that a rider or driver activates an SOS alert or in situations where we reasonably believe there is an imminent risk to the safety of any person, we may share relevant location and account information with emergency services or law enforcement.

4.5 Business Transfers

In the event of a merger, acquisition, reorganisation, or sale of all or a portion of our assets, your information may be transferred to the acquiring entity. We will provide notice before your information is transferred and becomes subject to a different privacy policy.

Location data is central to our service. We collect precise GPS location from both riders and drivers in order to match rides, display real-time navigation, and provide safety features.

• Riders: Location is collected while you have the app open in the foreground - to show your position on the map, suggest pickup points, and track the ride in progress.
• Drivers (foreground): Location is collected while the app is open - to show the Driver's position to nearby Riders seeking a ride, and to notify the Driver of incoming ride requests in their area.
• Drivers (background): The TotoWala for Drivers app collects location in the background, but only while an active ride is in progress. Background location collection stops automatically as soon as the ride is completed or cancelled. We do not track driver location in the background at any other time.

You can disable location permissions through your device's Android settings at any time. However, doing so will prevent core features of the app - including ride booking and navigation - from functioning.

Location data collected during completed rides is not permanently stored after the trip ends, except for the pickup and drop-off addresses which are retained as part of your ride history.

6.1 Masked Voice Calls

When a rider or driver initiates a call through the app, the call is routed through a third-party communication provider. Neither the rider's nor the driver's actual phone number is revealed to the other party during or after the call.

6.2 In-App Chat

Riders and drivers may exchange messages through the in-app chat feature during an active ride. These messages are stored securely and may be reviewed by TotoWala's safety and support team in the event of a complaint, dispute, or safety investigation. Chat messages are retained for 90 days after ride completion and then deleted.

6.3 OTP and SMS Notifications

We send one-time passwords (OTPs) to your registered mobile number for account login and verification. We also send SMS notifications for ride confirmations and important account updates.

6.4 Push Notifications

We send push notifications for ride requests (drivers), booking updates, chat messages, and service alerts. You can manage push notification preferences through your device settings. Disabling notifications will not affect your ability to use core services but may cause you to miss important ride updates.

Payments for rides and voluntary in-app donations are processed through a third-party payment gateway. When you make a payment through our app, you are redirected to the payment provider's secure environment to complete the transaction.

TotoWala does not collect, store, or have access to your payment card number, CVV, UPI credentials, bank account details, or any other sensitive payment information. This information is entered directly into and retained by the payment provider.

We receive and store only the payment amount, transaction status, and a transaction reference identifier. Payment records are retained for a minimum of 7 years in compliance with applicable financial and tax regulations.

We retain your personal information for as long as your account is active and for a reasonable period thereafter, or as necessary to fulfill the purposes described in this Privacy Policy, resolve disputes, enforce our agreements, or comply with legal obligations.

• Account and profile information: Retained for the duration of your active account and deleted within a reasonable period following a verified account deletion request.
• Ride history: Retained for the duration of the account and for up to 2 years after account deletion.
• In-app chat messages: Retained for 90 days after ride completion, unless required for an active dispute or investigation.
• Payment and transaction records: Retained for a minimum of 7 years as required by applicable financial and tax laws.
• Driver verification documents: Retained for the duration of the driver's active tenure on the platform and for 1 year thereafter.
• Crash reports and diagnostic logs: Retained for up to 90 days and then automatically deleted.

After the applicable retention period, your information is securely deleted or anonymised.

We implement reasonable and appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, misuse, alteration, or destruction. These measures include encryption of data in transit using SSL/TLS protocols, access controls limiting data access to authorised personnel, and security mechanisms to verify that requests to our services originate from genuine TotoWala applications.

We regularly review our security practices and update them as appropriate. However, no method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee absolute security of your information.

In the event of a data breach that is reasonably likely to result in a risk to your rights and freedoms, we will notify you and the appropriate regulatory authorities as required by applicable law.

Subject to applicable law, you have the following rights with respect to your personal information:

• Access and correction: You may access and update most of your account information directly through the app's profile settings.
• Data portability: You may request a copy of the personal data we hold about you by contacting us at [email protected].
• Account deletion: You may request deletion of your account and associated personal data through the app or by contacting us. We will action your request within a reasonable period.
• Location permissions: You can withdraw or restrict location access through your device's Android settings at any time. This may affect the functionality of the app.
• Notifications: You can opt out of push notifications through your device settings or within the app. Transactional messages (such as OTPs and ride confirmations) cannot be disabled independently.
• Complaints: If you believe we have handled your personal information in a manner inconsistent with this Privacy Policy or applicable law, you may raise a complaint with our Grievance Officer (see Section 13).

Our services are not directed at persons under the age of 18. We do not knowingly collect personal information from minors. If you are a parent or guardian and believe your child has provided us with personal information without your consent, please contact us at [email protected] and we will take prompt steps to delete such information from our records.

We may update this Privacy Policy from time to time to reflect changes in our services, practices, or applicable laws. When we make material changes, we will provide you with advance notice through an in-app notification, a notice on our website, or an email to your registered address, at least 7 days before the changes take effect.

The "Last Updated" date at the top of this page indicates when the most recent revision was made. Your continued use of TotoWala after the effective date of any changes constitutes your acceptance of the revised Privacy Policy. If you do not agree with the changes, you should stop using our services and may request account deletion.

In accordance with the Information Technology Act, 2000 and the rules made thereunder, we have appointed a Grievance Officer to address concerns and complaints regarding the processing of your personal information.

We will acknowledge your complaint within 24 hours and endeavour to resolve it within 30 days of receipt, unless the nature of the complaint requires additional time, in which case we will keep you informed of the progress.

If you have any questions, requests, or concerns about this Privacy Policy or how we handle your personal information, you can contact us through any of the following channels: