1. Scope and your consent

This Privacy Policy explains how HonestDrive, which owns and operates HonestDrive ("HonestDrive", "we", "us", or "our"), collects, uses, discloses, retains, and protects your personal data when you use the HonestDrive website, account, booking, test-drive, inspection, finance, KYC, and support services. It forms part of, and should be read with, our Terms and Conditions and Cookie Policy.

By using the Platform, creating an account, or submitting information, you consent to the collection and processing of your personal data as described here. Where the law requires specific consent (for example, for KYC, finance sharing, or analytics cookies), we collect that consent separately, and you may withdraw it as described below.

2. Who is responsible for your data

HonestDrive is the data fiduciary responsible for personal data processed through the Platform. Questions, requests, or grievances may be sent to support@honestdrive.in or to the Grievance Officer named at the end of this Policy.

3. Personal data we collect

• Account and contact data: name, email address, mobile number, password (stored in hashed form), city, state, and address.
• Authentication and technical data: encrypted session tokens, OTP records, IP address, device and browser type, user agent, log and usage data, and cookie choices.
• Transaction data: selected vehicle, booking order and status, Booking Token payment status, selected protection or warranty plans, and support and communication history.
• Test-drive and inspection data: preferred date, time, location, vehicle details, ratings, feedback, and inspection-request notes.
• Finance and KYC data: date of birth, gender, annual income, employment details, PAN, Aadhaar, driving licence, uploaded documents, EMI selections, and consent records (including consent version, IP address, user agent, and time).
• Vehicle, seller, and dealer data: ownership and registration documents, service history, inspection reports, images, and video links.

4. How we collect personal data

• Directly from you when you register, book, schedule a test drive, request an inspection, apply for finance, upload documents, or contact us.
• Automatically through cookies, server logs, and similar technologies when you use the Platform (see our Cookie Policy).
• From Partners and third parties, such as payment processors, dealers, sellers, inspection agencies, lenders, insurers, and public or verification sources, in connection with your transaction.

5. How we use personal data

• To create, secure, and manage your account and verify your email and identity.
• To provide listings, bookings, test drives, inspections, support, and transaction assistance.
• To process the Booking Token, verify and reconcile payments, and prevent and investigate fraud, chargebacks, and misuse.
• To forward finance or insurance enquiries to Partners where you have given specific consent.
• To communicate with you about transactions, service updates, security, and grievances, and, where permitted, about offers.
• To operate, analyze, secure, and improve the Platform, and to measure usage where analytics consent has been given.
• To comply with legal, tax, accounting, regulatory, and law-enforcement obligations and to establish, exercise, or defend legal claims.

6. Lawful basis for processing

We process personal data on one or more lawful bases: your consent; the performance of a contract or steps you request before a contract; our legitimate interests in operating, securing, and improving the Platform and preventing fraud, provided these do not override your rights; and compliance with legal obligations. For KYC, finance sharing, and optional analytics, we rely on your specific, separately recorded consent.

7. Cookies and analytics

We use essential cookies for authentication and security and, only with your consent, optional analytics such as Google Analytics. You can manage your choices through our cookie banner and your browser settings. Full details are in our Cookie Policy.

8. How we share personal data

We share personal data only as reasonably required to operate the Platform and complete your transaction, with: dealers or vehicle owners involved in your transaction; inspection personnel; PhonePe for payment processing; hosting and media providers such as Vercel and Cloudinary; email and communication providers; finance or insurance Partners you have chosen; professional advisers; and government, regulatory or law-enforcement authorities where required by law or to protect our rights, users, or the public.

We may also share or transfer personal data in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to this Policy. We do not sell your personal data as a standalone product.

9. KYC and sensitive personal data

KYC documents and financial information are collected only for the specific finance, insurance, verification, or transaction purpose you have consented to. Sensitive document identifiers are encrypted, access is restricted on a need-to-know basis, and uploads are stored through our document and media providers.

Submitting KYC for one purpose does not authorize unrelated marketing or sharing. Consent for a loan and consent for insurance remain separate, and refusing optional insurance sharing does not invalidate a loan enquiry.

10. Data retention

We retain personal data for as long as your account or transaction is active and thereafter for the period required to meet tax, accounting, fraud-prevention, dispute-resolution, consent-evidence, and other legal obligations, after which it is deleted or anonymized. Specific retention periods for each category are maintained internally and disclosed as required by law.

11. Data security

We apply reasonable technical and organizational safeguards, including access controls, encrypted authentication and document identifiers, restricted uploads, transport encryption, and rate limiting. While we take security seriously, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your credentials and devices secure.

12. Third-party processing and transfers

Some Partners and service providers may process or store data on infrastructure located in or outside India in accordance with applicable law. Where data is transferred, we take reasonable steps to require protection consistent with this Policy.

13. Your rights and choices

• Access: request confirmation of and access to the personal data we hold about you.
• Correction and updating: request correction of inaccurate or incomplete data.
• Erasure: request deletion of data that is no longer required for a legal or operational purpose.
• Withdraw consent: withdraw consent for processing that relies on consent, without affecting earlier lawful processing or records we must retain.
• Decline optional processing: decline analytics cookies and optional finance or insurance sharing.
• Grievance and nomination: raise a grievance about data processing and, where the law allows, nominate another individual to exercise your rights.
• We may verify your identity before acting on a request and may decline requests that are unlawful, unfounded, repetitive, or that would infringe others' rights.

14. Children's data

The Platform is intended for users aged 18 and above. We do not knowingly collect personal data from children. If we learn that we have collected such data without lawful consent, we will delete it.

15. Third-party links

The Platform may link to third-party websites and services, including YouTube and Partner sites. We are not responsible for their privacy practices, and you should review their policies before providing information.

16. Changes to this policy

We may update this Policy from time to time by posting the revised version with a new effective date. Material changes take effect when posted unless stated otherwise. Your continued use of the Platform after a change indicates acceptance of the updated Policy.

17. Grievance Officer and contact

In line with the Information Technology Act, 2000, the applicable rules, and the Digital Personal Data Protection Act, 2023, you may contact our Grievance Officer for any privacy concern: Priyanshu Kumar Singh, priyanshu1kumar2002@gmail.com. General privacy requests may also be sent to support@honestdrive.in. Registered office: Jamshedpur, Jharkhand – [PIN CODE].

If your concern is not resolved, you may approach the relevant data-protection or consumer authority as permitted by law.