Privacy Policy

1. Scope & Commitment

Rechev (“we,” “our,” or “us”) is committed to protecting your privacy and personal data. This Privacy Policy describes how we collect, verify, process, store, and safeguard your personal information when you access our website (rechevrental.com), mobile interfaces, and self-drive car rental services in Hyderabad, Telangana.

We adhere strictly to applicable Indian data protection legislation, including the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 (DPDP).

2. Information We Collect

We collect only the information necessary to provide, manage, and verify self-drive car rentals:

• Account & Contact Information: Full legal name, verified mobile phone number, email address, and optional OAuth profile details (e.g., Google sign-in).
• Driver Verification & KYC: Clear photographs of your government-issued Driving License, Aadhaar card (or other officially valid proof of identity), and a verification selfie. These documents are collected solely to establish legal driving eligibility and prevent identity theft.
• Booking & Trip Data: Selected vehicle, scheduled pickup and return dates, delivery address within Hyderabad, start/end odometer readings, and initial/final fuel levels.
• Payment & Transaction Records: Transaction IDs, payment timestamps, order amounts, and payment status. All financial transactions are processed directly through our PCI-DSS certified payment gateway partner (Razorpay). Rechev never stores credit/debit card numbers, CVVs, or net banking passwords on its servers.
• Vehicle Safety & Toll Tracking: Odometer readings, vehicle telemetry for roadside assistance and anti-theft security, and NHAI Fastag tollway transaction logs generated during active rental reservations.

3. Document Verification & KYC Security

To comply with the Motor Vehicles Act and transport safety regulations, all drivers must be verified before vehicle keys are handed over.

• Private Cloud Vaults: All uploaded KYC documents are stored in private, restricted cloud object storage buckets. Public access is strictly forbidden at the database and storage level via Postgres Row Level Security (RLS).
• Human Operations Review: Identity documents are reviewed directly by trained, authorized Rechev fleet operations compliance officers. We do not use automated biometric scoring or uncontrolled third-party AI scrapers to process your identity papers.
• Short-Lived Authorized Access: Document previews and verification links use time-limited, cryptographically signed URLs (valid for 15 minutes to 1 hour max) that expire automatically. Raw documents are never accessible through permanent public web links.
• Masked Aadhaar Accepted & Recommended: In accordance with UIDAI notifications and DPDP Act data minimization principles, customers are encouraged to upload a Masked Aadhaar (where the first 8 digits are obscured and only the last 4 digits are visible). Rechev never collects, requests, or stores biometric authentication data.

4. Third-Party Service Providers (Sub-Processors)

We share data only with verified technical infrastructure providers required to operate our rental platform. Each provider operates under contractual confidentiality and data security obligations:

• Supabase Inc.: Cloud database, user authentication services, and private object storage with end-to-end Row-Level Security.
• Razorpay Software Pvt. Ltd.: PCI-DSS compliant payment processing, UPI/Card/Netbanking gateway services, and automated refund management.
• Phone.Email: Sign-in and instant OTP mobile number verification.
• EmailJS: Transactional email dispatch for reservation confirmations, account notices, and customer support inquiries.
• Vercel Inc.: Application edge hosting and privacy-preserving, cookieless web performance analytics.
• Cloudinary: Vehicle catalog image optimization and content delivery.
• Google LLC: Google Fonts CDN asset delivery and optional Google OAuth authentication.
• WhatsApp (Meta): Optional transactional customer support and trip dispatch coordination (with prior user consent).
• Fleet Telematics & Fastag Partners: On-board GPS for emergency roadside breakdown assistance, vehicle recovery, and NHAI electronic toll reconciliation.

5. Data Retention & Erasure Policy

We retain your personal data only as long as necessary to fulfill the purposes for which it was collected or to satisfy statutory obligations:

• Active User Profiles: Retained while your account remains active so you can book vehicles without re-uploading basic details.
• KYC Identity Documents: Retained during active account tenancy for motor vehicle regulatory compliance. For non-recurring guests, KYC documents are subject to a 180-day retention schedule following successful trip completion (allowing for traffic police e-challan and accident liability windows), after which they are purged. Immediate erasure can be requested at any time via the Account Deletion page provided no active rentals or unresolved liabilities exist.
• Statutory Tax & Invoicing Records: Completed trip invoices, payment reference IDs, GST invoices, and transaction logs are securely archived for 7 years in compliance with Indian taxation and company law requirements.

6. Cookies & Local Storage

Rechev uses minimal, strictly necessary local storage items (e.g., theme preference, authenticated session tokens, and cookie consent choices) to operate smoothly. We do not use third-party advertising cookies or cross-site tracking trackers.

For a detailed breakdown of all storage keys and to modify your preferences, visit our Cookie & Local Storage Policy.

7. Data Security Measures

We employ robust administrative, technical, and physical safeguards:

• Encryption in Transit: All web and API traffic is encrypted using Modern TLS 1.3 / SSL cryptographic protocols.
• Encryption at Rest: Database tables and file objects are stored encrypted using industry-standard AES-256 algorithms.
• Principle of Least Privilege: Only vetted personnel with multi-factor authentication can access verification workflows.

8. Grievance Redressal & Contact Information

In accordance with the Information Technology Act, 2000, and the Digital Personal Data Protection Act, 2023, the details of our Grievance Officer are provided below:

We will acknowledge your privacy inquiry or grievance within 24 hours and resolve it within 15 working days of receipt.

9. Governing Law & Jurisdiction

This Privacy Policy is governed by and construed in accordance with the laws of the Republic of India. Any disputes arising out of or related to data protection under this policy shall be subject to the exclusive jurisdiction of the competent courts in Hyderabad, Telangana.