Privacy Policy

Effective date: 9 June 2026

Last updated: 17 October 2026

1. About This Policy

This Privacy Policy applies to all users of VahanTag's products and services, including vehicle owners who register with us, and third parties (such as QR code scanners) who interact with our service. This policy is published in accordance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 (DPDP Act).

Entity: VahanTag is operated by VahanTag Technologies (Sole Proprietorship), located at A-505, Silver Coin, Lane 30/31, Ganesh Nagar, Dhayari, Pune, Maharashtra — 411041, India.

2. Information We Collect

We collect information based on how you interact with VahanTag:

2.1 From Registered Users (Vehicle Owners)

• Mobile phone number (for OTP authentication, WhatsApp/SMS notifications)
• Full name and delivery address (for order fulfilment and shipping)
• Vehicle registration number and owner name (for sticker activation)
• Emergency contact details — names and mobile numbers of up to 3 third parties you designate; optionally, one contact may be marked "public" so their name and mobile number are shown to anonymous QR scanners during an Emergency SOS
• Order and payment transaction records
• Communication preferences
• Support ticket content

2.2 From QR Code Scanners (Third Parties)

• GPS location (latitude/longitude) — if you grant permission when prompted
• Issue category and optional note describing the vehicle issue
• Session identifier (randomly generated, not linked to your identity)
• Timestamp of the scan
• Mobile number (optional) — if you choose to share it during an Emergency SOS, so the vehicle's emergency contacts can call you. Visible on the alert page for 2 hours, then permanently removed.

Note: By default, scanning is anonymous. We do not collect your name or any personally identifiable information. During an Emergency SOS, you may optionally share your mobile number with the vehicle's emergency contacts. This is entirely voluntary — the SOS works without it.

2.3 Automatically Collected Data

• Device and browser information via cookies and analytics tools (see Section 6)
• IP address (used for approximate geolocation and security)
• Pages visited, time spent, and interaction data

2.4 From Partner & Distributor Applicants

When you submit an application through our Partner Program or Distributor Program application forms, we collect:

• Your full name and mobile number
• Business name, type, and location
• PAN (for distributor applications)
• Any other details you voluntarily provide in the application form

This information is used solely to evaluate your application and contact you regarding the program. It is not shared with third parties or used for marketing. If your application is not taken forward, this data is retained for 12 months and then deleted.

2.5 Digital E-Tag Specific Data

When you purchase and use a Digital E-Tag, the following additional data is collected and stored:

• E-Tag PDF artwork: A unique QR code sticker image is generated for your order and stored securely on our cloud storage (Cloudflare R2) for download access. The PDF contains a unique sticker identifier linked to your vehicle profile.
• Vehicle type selection: The vehicle type you select during activation (2-wheeler, 3-wheeler, or 4+ wheeler) is recorded and associated with your sticker profile.
• E-Tag state: We track the lifecycle state of each E-Tag (Created, Activated, or Voided) to manage service delivery and prevent misuse.
• Download activity: We log when you download your E-Tag PDF to provide support and prevent unauthorized access.

The E-Tag PDF stored on our cloud infrastructure is accessible only to the authenticated account holder who purchased it. If you request account deletion, all associated E-Tag PDFs will be removed from our storage within 90 days.

3. Legal Basis for Processing

We process your data on the following grounds under the DPDP Act, 2023:

• Consent: When you sign up, place an order, or activate a sticker, you provide consent by proceeding with the action. You may withdraw consent at any time by contacting us.
• Contract performance: To fulfil your order, deliver stickers, send alert notifications, and provide customer support.
• Legitimate interest: For fraud prevention, security incident investigation, and service integrity — where processing is necessary and proportionate and does not override your rights. We do not rely on this basis for marketing or analytics; those use consent.
• Legal obligation: To maintain transaction records as required under Indian tax and commerce laws.

3a. What Data We Collect at Each Step

The following explains exactly what personal data is collected, for what purpose, and on what basis at each point of interaction with VahanTag.

4. How We Use Your Information

• Send WhatsApp/SMS notifications when someone scans your QR code or triggers an SOS
• Process and deliver your orders
• Authenticate your identity via OTP
• Provide customer support and resolve disputes
• Improve our service, fix bugs, and analyse usage patterns
• Comply with legal obligations (tax records, fraud prevention)

5. Third-Party Data Sharing

We share your data only with the following categories of service providers, solely to operate VahanTag:

• Razorpay (Payment Gateway): Receives your name, mobile number, and payment details to process transactions. We never store your card or UPI details on our servers.
• WhatsApp / SMS Gateway (Messaging Provider): Receives mobile numbers to deliver OTPs and alert notifications.
• Shipping/Courier Partners: Receive your name, address, mobile number, and order ID for delivery.
• Google Analytics: Receives anonymised browsing data (pages visited, device type, approximate location) to help us understand usage. See Section 6 for details.
• Cloud Infrastructure (Hosting): Our servers are hosted on cloud infrastructure located within India. All data is stored domestically.

We do not sell, rent, or trade your personal data to any third party for marketing purposes.

6. Cookies & Tracking Technologies

We use the following tracking technologies:

• Google Analytics: Uses cookies to collect anonymised data about page views, session duration, device type, and geographic region. This helps us improve the website.
• Browser Storage: Used to store authentication tokens and session data locally on your device. This is essential for the service to function.

We do not use advertising cookies or third-party tracking pixels.

7. Data Retention

• Account data (name, mobile, vehicle details): Retained for as long as your account is active. Deleted within 90 days of account deletion request.
• Order and payment records: Retained for 7 years as required under Indian tax regulations (GST Act).
• Scan/alert logs: Retained for a minimum of 1 year from the date of processing, as required under Rule 8(3) and Rule 6(1)(e) of the Digital Personal Data Protection Rules, 2025. Logs may be retained longer if required by law or for ongoing legal proceedings.
• Support tickets: Retained for 1 year after resolution.
• Analytics data: Retained as per Google Analytics default retention settings (14 months).
• Scanner-shared mobile number (SOS opt-in): Permanently removed from display on the alert page after 2 hours from the SOS trigger.
• E-Tag PDF files: Retained on cloud storage for as long as the associated E-Tag is active. Deleted within 90 days of account deletion or E-Tag voiding.

8. Data Protection & Security

• All data transmitted between your device and our servers is encrypted using TLS/HTTPS
• Authentication tokens are securely stored and expire after a defined period
• Payment processing is handled entirely by Razorpay (PCI-DSS compliant); we never see or store card details
• Access to production data is restricted to authorised personnel only
• We conduct periodic security reviews of our infrastructure

9. Data Storage Location

All your personal data is stored exclusively on servers located within India. We do not transfer or store any personal data outside the territory of India.

10. Your Privacy Rights (Data Principal Rights)

Under the DPDP Act, 2023 and applicable Indian laws, you have the following rights:

• Right to Access: Request a summary of the personal data we hold about you.
• Right to Correction: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your data (subject to legal retention obligations).
• Right to Withdraw Consent: Withdraw consent at any time. This will not affect the lawfulness of processing done before withdrawal.
• Right to Nominate: Nominate another person to exercise your rights on your behalf in the event of death or incapacity.
• Right to Grievance Redressal: File a complaint with our Grievance Officer (see Section 13).

To exercise any of these rights, email us at support@vahantag.me with the subject line "Data Principal Rights Request". We will respond within 30 days.

11. Emergency Contacts & Third-Party Data

When you add emergency contacts during sticker activation, you are sharing their names and mobile numbers with us. The activation flow requires you to explicitly confirm, for each contact, that they have been informed and have agreed. VahanTag records a timestamped confirmation at the point of activation. By providing this data, you confirm that:

• You have informed these individuals that their details are being shared with VahanTag.
• They have agreed to receive emergency SOS alert messages from VahanTag on behalf of your vehicle.
• They may contact us at support@vahantag.me to request removal of their data at any time.

11.1 Public Emergency Contact

During activation, you may optionally designate one emergency contact as "public". When this option is enabled, that contact's name and mobile number will be displayed to any anonymous third party who triggers an Emergency SOS by scanning your VahanTag QR code. This information is shown so the scanner can call them directly to report the situation.

Enabling the public contact option requires a separate explicit confirmation in the activation flow. VahanTag records a timestamped confirmation of this disclosure consent at the point of activation. By marking a contact as public, you confirm that:

• The contact has been explicitly informed that their name and mobile number may be shown to unknown third parties in an emergency context.
• They have consented to this public disclosure.
• VahanTag is not liable for any calls or contact attempts made to this person by third-party scanners acting in response to an SOS event.

11.2 Scanner Contact Sharing During SOS

When a person triggers an Emergency SOS by scanning your VahanTag QR code, they may optionally choose to share their own mobile number. If they do, their number is displayed on the alert page (vahantag.me/a?i=...) alongside the SOS details, visible to anyone with the alert link for 2 hours. After 2 hours, the number is permanently removed from the alert page.

The scanner provides this number voluntarily through an explicit opt-in checkbox on the SOS confirmation screen. They are informed at the point of consent that the number will be visible on the alert page for 2 hours and cannot be recalled after the SOS is submitted.

As a vehicle owner, your emergency contacts may see and use this number to contact the scanner about the emergency. VahanTag is not responsible for how emergency contacts use the scanner's number after it is displayed on the alert page. Emergency contacts' use of the number for the purpose of responding to the emergency falls within their own personal and domestic use, outside the scope of the DPDP Act, 2023.

12. Children's Privacy

VahanTag is not intended for use by individuals under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected data from a minor, we will delete it promptly. If you believe a minor has provided us with personal data, please contact us at support@vahantag.me.

13. Grievance Officer

In accordance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, the designated Grievance Officer for VahanTag is:

14. Contact Information

For any privacy-related questions or concerns, please contact us:

15. Changes to This Policy

We may update this privacy policy from time to time. When we make material changes, we will notify registered users via WhatsApp/SMS and update the "Last updated" date at the top of this page. Continued use of VahanTag after changes constitutes acceptance of the revised policy.