Privacy Policy

Cholo ("we", "our", "us") operates the Cholo mobile app and website (the "Service"). This policy explains what personal data we collect, why we collect it, and your rights under the Digital Personal Data Protection Act, 2023 (DPDPA).

1. Data we collect

Data	Why
Phone number	Account creation & OTP login
Name	Identifying you in-app and to drivers
GPS location	Matching you with nearby totos; route tracking during a trip
Trip history	Showing your past rides; billing records
Payment method	Recording cash or UPI payment against each trip
Profile photo	Displayed to your driver (optional)
Driver: TTEN & vehicle	Registering verified toto drivers on the platform
Push token	Sending ride-request alerts to drivers

We do not collect payment card numbers, Aadhaar, or any financial account details.

2. How we use your data

• Booking, dispatching, and completing toto rides
• Sending one-time passwords (OTP) by SMS for login
• Calculating fares and maintaining fare records
• Displaying your name and photo to your assigned driver (and vice versa) during a trip
• Improving the Service (aggregated, anonymised analytics only)
• Investigating complaints or disputes

3. Third-party services

Service	Purpose	Data shared
Neon (PostgreSQL)	Database hosting	All account & trip data
Render	API server hosting	All API traffic
Cloudinary	Profile photo storage	Photos you upload
Ping4SMS	OTP SMS delivery	Phone number + OTP
Cloudflare Pages	Frontend hosting & CDN	IP address, browser headers

Each provider has its own privacy policy. We do not sell your data to any third party.

4. Location data

Your precise location is accessed only while the app is open and only during an active booking or trip. We do not track your location in the background. Driver locations are updated in real time while the driver is marked online; this data is not retained after 2 minutes of inactivity.

5. Data retention

• Trip records — kept for 3 years for legal and regulatory compliance
• Account data — kept until you request deletion
• Location history — not stored; only real-time position is used
• OTP logs — deleted automatically after 10 minutes

6. Your rights (DPDPA 2023)

• Access — request a copy of your personal data
• Correction — update your name or photo at any time in-app
• Erasure — request deletion of your account and all personal data
• Grievance redressal — raise a complaint; we will respond within 48 hours
• Withdraw consent — you can stop using the Service at any time

7. Children

The Service is not directed at anyone under 18. We do not knowingly collect data from minors.

8. Changes to this policy

We will update the "Last updated" date at the top of this page when we make material changes and notify active users via in-app notice.

9. Contact us