Privacy Policy
Last Updated: 25 August 2026
1. Who We Are
Carverse Technologies ("Carverse", "we", "us", "our") is a company incorporated under the laws of India. We operate the Carverse platform, a vehicle service management application accessible at carverse.in.
We are the Data Fiduciary as defined under the Digital Personal Data Protection Act, 2023 ("DPDP Act") for personal data collected through our platform. This means we determine the purposes and means of processing your personal data.
Contact Details:
Email: support@carverse.in
Registered Address: [To be updated upon registration]
2. What Personal Data We Collect
We collect only the data necessary to provide and improve our services. The following table details each category of personal data we collect:
| Data Category | Specific Data Fields | Purpose | Retention Period |
|---|---|---|---|
| Account Data | Name, email address, phone number, user role (owner/provider), profile avatar | Account creation, authentication, communication, role-based access | Until account deletion + 90 days for backup cleanup |
| Vehicle Data | Vehicle make, model, year, registration plate number, VIN | Service tracking, maintenance scheduling, expense analytics | Until user deletes the vehicle record |
| Service Records | Maintenance history, repair costs, fuel logs, odometer readings | Expense tracking, service history, analytics | Until user deletes the record |
| Provider Data | Business name, GSTIN, services offered, business description | Provider profile display, invoice generation | Until account deletion + 8 years (Income Tax Act) |
| Appointment Data | Date, time, service type, status, notes | Scheduling, service management | Until user deletes the appointment |
| Invoice Data | Line items, quantities, unit prices, totals, payment status | Billing, financial records, tax compliance | 8 years (Income Tax Act compliance) |
| Customer Data | Customer name, email, phone (entered by providers) | Customer relationship management | Until provider deletes the customer record |
| Community Data | Posts, comments, likes | Social features, community engagement | Until user deletes their content |
| Location Data | Search queries (city/area names), device geolocation (when permitted) | Nearby garage discovery | Not stored permanently; used in real-time only |
| Analytics Data | User ID, role, page views, custom events | Product improvement, usage analytics | 2 years |
| Error Data | Error reports, stack traces, browser metadata | Bug detection, debugging, platform stability | 1 year |
3. How We Collect Your Data
We collect personal data in the following ways:
- Directly from you: When you create an account, fill in your profile, add vehicle information, create service records, schedule appointments, generate invoices, or post in the community.
- Automatically: When you use the platform, we collect analytics data (page views, features used) and error data through our analytics and monitoring tools.
- Through third-party authentication: When you sign in using Google OAuth, we receive your name, email, and profile picture from Google.
4. Why We Process Your Data (Purpose Limitation)
We process your personal data only for the specific purposes listed in the table above (Section 2). We do not process your data for purposes incompatible with those stated purposes. Under the DPDP Act, each purpose requires separate consent.
5. How We Obtain Your Consent
Under Section 6 of the DPDP Act, consent must be free, specific, informed, unconditional, unambiguous, and given by a clear affirmative action.
- When you create an account, you explicitly agree to our data collection practices by clicking "I Agree" or similar affirmative action.
- We do not use pre-ticked boxes or implied consent.
- Consent for analytics (PostHog and Google Analytics) is obtained separately through our cookie consent mechanism.
- Consent for location access (Google Maps) is requested through your browser's native permission prompt.
6. How You Can Withdraw Consent
You can withdraw your consent at any time by:
- Deleting your account through the Profile page (Danger Zone → Delete my account)
- Disabling analytics tracking in your browser settings
- Revoking location permission in your browser settings
- Contacting us at support@carverse.in
Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
7. Third-Party Data Processors
We share your personal data with the following third-party service providers who process data on our behalf:
| Service | Purpose | Data Shared | Location |
|---|---|---|---|
| Supabase | Authentication, database, file storage | Email, name, phone, role, avatar, session tokens, uploaded files | India (AWS Mumbai) |
| PostHog | Product analytics | User ID, role, page views, custom events | European Union |
| Google Analytics | Website traffic analytics | Page views, events, device/browser metadata, coarse location (hashed user ID only — never your name or email) | Google servers (global) |
| Razorpay | Payment processing for paid plans | Name, email, phone, payment method details (card/UPI/bank details are handled by Razorpay and never stored by Carverse) | India |
| Sentry | Error monitoring | Error reports, stack traces, browser metadata | EU/US |
| Google Maps / Places API | Nearby garage search | Geolocation (lat/lng), search queries | Google servers (global) |
| Google OAuth | Single Sign-On login | Google identity (name, email, profile picture) | Google servers (global) |
| Vercel | Hosting and deployment | HTTP request logs, IP addresses | Global CDN |
8. Cross-Border Data Transfers
Some of our third-party processors are located outside India. Under Section 16 of the DPDP Act, personal data may be transferred outside India except to countries specifically restricted by the Central Government. As of the date of this policy, no countries have been officially restricted.
We ensure that our third-party processors maintain reasonable security safeguards as required under the DPDP Act and DPDP Rules, 2025.
9. Children's Data
The Carverse platform is designed for users aged 18 and above. We do not intentionally collect personal data from children under 18 years of age. If we become aware that we have collected personal data from a child, we will take steps to delete such data promptly.
10. Your Rights as a Data Principal
Under the DPDP Act, you have the following rights:
- Right to Access (Section 11): You can request a copy of all personal data we hold about you.
- Right to Correction (Section 12): You can request correction of inaccurate or incomplete personal data.
- Right to Erasure (Section 12): You can request deletion of your personal data when it is no longer necessary for the purpose it was collected.
- Right to Nomination (Section 14): You can nominate another individual to exercise your rights on your behalf.
- Right to Grievance Redressal (Section 8(10)): You can file a complaint with our Grievance Officer if your rights are not being respected.
11. How to Exercise Your Rights
To exercise any of the above rights, you may:
- Access, correct, or delete your data directly through the Carverse platform (Profile page, Vehicle page, etc.)
- Email us at: support@carverse.in
We will respond to your request within 30 working days from the date of receipt, as prescribed under the DPDP Rules, 2025.
12. Data Security
We implement reasonable security safeguards to protect your personal data, including:
- Encryption of data in transit (TLS 1.2+) and at rest
- Role-based access controls through Supabase Row Level Security (RLS)
- Session-based authentication with secure token management
- Regular security monitoring through Sentry
- Secure file storage with access controls
13. Data Breach Notification
In the event of a personal data breach, we will:
- Notify the Data Protection Board of India within 72 hours of becoming aware of the breach, as required under Section 8(6) of the DPDP Act.
- Notify affected Data Principals through the email addresses we have on file, without undue delay.
- Document the breach, its effects, and the remedial actions taken.
14. Grievance Officer
If you have any complaints or concerns about our data processing practices, you may contact our Grievance Officer:
Name: Sohaib AK
Designation: Founder & Grievance Officer
Email: support@carverse.in
Response Commitment: We will acknowledge your complaint within 48 hours and resolve it within 1 month from the date of receipt.
15. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of material changes through:
- In-app notification
- Email to the address associated with your account
The "Last Updated" date at the top of this page indicates when this policy was last revised. We encourage you to review this policy periodically.
Version History:
Version 1.0 — 25 August 2026 — Initial release
16. Contact Us
For any questions about this Privacy Policy or our data practices:
Carverse Technologies
Email: support@carverse.in
Website: carverse.in