Our Core Privacy Commitment
Pillion is built from the ground up on the principles of the Digital Personal Data Protection Act, 2023 (DPDP Act). We practice strict data minimization: we only collect data necessary to ensure safe peer-to-peer bike pooling, encrypt all uploaded documents with AES-256-GCM, delete documents immediately post-review, and never store full Aadhaar numbers.
1. Principles of Data Processing
We process personal data solely in accordance with the following statutory principles:
- Notice & Consent: We provide clear, itemised notice before collecting any personal or identity data, requiring explicit, unbundled affirmative consent.
- Purpose Limitation & Data Minimization: We only collect data required for peer-to-peer commute matching, verification, and rider safety.
- Storage Limitation: Identity documents are deleted immediately upon administrator review (or auto-deleted after 30 days). Data is purged upon account deletion.
- Data Security: Industry-standard AES-256-GCM encryption at rest on encrypted disks, memory-only decryption, and comprehensive immutable audit logging.
- Data Principal Rights: Full control over your data, including rights to access, correction, consent withdrawal, and permanent account erasure.
2. Data Inventory & Retention Schedule
The table below details every category of personal data collected, its purpose, legal basis, storage location, and retention schedule:
| Data Element | Purpose | Legal Basis | Storage Location | Retention Period |
|---|---|---|---|---|
| Google Profile (Name, Email, Profile Picture) |
Authentication & user session management | Contract / User Consent | PostgreSQL Database (Encrypted) | Retained until user deletes their account. |
| Aadhaar QR Fields (Name, Last 4 Digits, Year of Birth) |
Peer trust & name verification via UIDAI cryptographic signature | Explicit Consent (aadhaar_offline_kyc) |
PostgreSQL Database (Encrypted) | Retained until user withdraws consent or deletes account. |
| Full Aadhaar Number | N/A — Not required | NEVER STORED | Not Stored | Never collected, stored, or logged under any circumstances. |
| DL & RC Photos (Driving Licence & Registration Certificate) |
Admin ops review of riding eligibility & vehicle ownership | Explicit Consent (document_review) |
Encrypted Disk (AES-256-GCM) | Deleted immediately upon approval or rejection; unreviewed files auto-expire in 30 days. |
| Corporate Work Email (e.g. [email protected]) |
Verification of corporate commuter status via 6-digit OTP | Explicit Consent (work_email_verification) |
PostgreSQL Database | Retained until user withdraws consent or deletes account. |
| Commute Routes & Schedules (Pickup/Drop points & timing) |
Corridor matching & route overlap calculations | Contract / Service Delivery | PostgreSQL PostGIS | Retained until commute route or account is deleted. |
| Consents & Audit Logs | Statutory compliance demonstration and admin accountability | Legal Obligation (DPDP Act) | PostgreSQL (Immutable Log) | Retained for regulatory audit trails as mandated by law. |
3. Document Security & Encryption at Rest
Pillion enforces rigorous cryptographic safeguards for all sensitive data:
- AES-256-GCM Encryption: Every uploaded document image (DL/RC) is encrypted before writing to disk using a unique random 12-byte nonce (stored as a file prefix). If the encryption key is unconfigured, uploads fail closed (HTTP 503) — unencrypted plaintext is never written to disk.
- Zero In-Transit Plaintext: All communications between the mobile client and backend servers use TLS 1.3 encryption.
- Post-Review Atomic Deletion: The moment an administrator approves or rejects a KYC document, the image file is permanently deleted from the filesystem in the same atomic database transaction.
- Automated Cleanup Service: Pending unreviewed documents older than 30 days are automatically deleted by a scheduled daily cleanup background service.
- Immutable Admin Audit Trail: Every document review, approval, rejection, user suspension, or data modification creates an immutable entry in the administrative audit log.
4. Data Principal Rights under the DPDP Act 2023
As a Data Principal, you have the following enforceable rights, which can be exercised directly inside the Pillion mobile application:
A. Right to Access ("Download My Data")
You may request a machine-readable summary of all personal data held about you at any time. Navigate to Profile → Privacy & Data → Download My Data. The system generates an authenticated JSON export directly from our servers.
B. Right to Correction & Erasure
You can update profile information or request correction of inaccurate data. Withdrawing verification consent immediately clears the associated verified data fields and triggers automated document deletion.
C. Right to Withdraw Consent
You can selectively withdraw consent for Aadhaar verification, Document Review, or Work Email at any time under Profile → Privacy & Data. Withdrawing consent immediately removes your verified badge and purges the associated record.
D. Right to Account Deletion
You can permanently delete your entire Pillion account directly in the mobile app by going to Profile → Privacy & Data → Delete My Account and typing DELETE to confirm. You may also email our Grievance Officer at [email protected]. Upon deletion, all user records, commutes, ride requests, chats, and auth sessions are permanently purged.
5. Age Restriction (18+ Only)
Pillion is strictly intended for individuals who are 18 years of age or older. We enforce an age gate during onboarding (requiring affirmative age_18_plus confirmation). We do not knowingly collect personal data from minors.
6. Security Incident & Breach Notification Protocol
In accordance with Section 8(6) of the DPDP Act 2023, in the unlikely event of a security breach involving personal data:
- Our security response team will isolate affected services and revoke compromised keys within minutes.
- The scope of impacted users and data categories will be assessed within 24 hours.
- We will notify the Data Protection Board of India (DPBI) and all affected Data Principals without undue delay, outlining the nature of the breach, potential risks, and remedial actions taken.
7. Grievance Redressal & Contact
For any questions, concerns, or grievances regarding this Privacy Policy or the processing of your personal data, please contact our Data Protection and Grievance Officer:
Data Protection & Grievance Officer
Entity: Pillion is a Marsys Group product. Marsys Group is the brand of Toonshala (Proprietor: Ashish Rai), Udyam Reg. No. UDYAM-DL-02-0119198, 769, Jay Ambey Apartment, Balia, New Kondli, East Delhi, Delhi – 110096
Email: [email protected]
Subject Line: Attention: Data Protection Grievance
Response Time: We acknowledge all grievances within 48 hours and resolve them within the statutory period prescribed under the DPDP Act 2023.