இந்த ஆவணம் தற்போது ஆங்கிலத்தில் மட்டுமே உள்ளது.

Vahana — Privacy Policy

Last updated: 5 November 2026

Effective from: 5 November 2026

1. Who this is about

Vahana is a mobile application for running a small vehicle-hire business — logging work, raising bills, recording payments and expenses, and keeping a driver roster. It is published by Vijayakumar M, proprietor of Vahana Agri Solutions, Vellore - Tiruvannamalai Rd, Santhavasal, Vellur, Polur, Tamil Nadu 606905 ("we", "us", "Vahana").

This policy explains what the app records, why, where it is kept, and what you can ask us to do with it. It is written for the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000 and the rules made under it. Your use of the app itself is governed by the Terms of Service, which this policy forms part of.

Two different relationships

This distinction matters for every section that follows.

Your account. Your own name, email address and profile picture come from your Google account when you sign in. For that data we are the Data Fiduciary — we decide what is kept and why, and you deal with us directly.

Your business's records. Everything entered into the app — customers, drivers, vehicles, work, bills, payments, salary — belongs to the business the account was opened for. The business owner decides what goes in and how long it stays. For that data the business owner is the Data Fiduciary and we are a Data Processor acting on their instructions. If you are a driver, a customer or a broker whose details appear in someone's Vahana account, the business that entered them is who you ask about correction or erasure; we will help them act on your request, but we will not alter another business's books on our own.

2. What the app records

2.1 Account and sign-in

Google is the only way into Vahana. When you sign in we receive, from Google:

• your name
• your email address
• your Google profile picture, if you have one
• a Google account identifier

We never see or hold your Google password. We do not use Google sign-in to read your Gmail, Drive, contacts or calendar. You can also add a phone number to your profile in the app.

If you are a driver, your owner invites you by email address before your first sign-in; that invitation record holds the address they used.

2.2 Your business profile

Business name, tagline, proprietor name, address lines (village, taluk, district), one or more contact phone numbers, a UPI ID if you choose to print one on your bills, your bill-number prefix, and your bill layout preferences.

Most of this is printed on the bills you hand to customers, which is the reason it is collected.

2.3 Operational records you enter

• Vehicles — registration or label, type, status, a photo if you add one, and a place name with optional map coordinates that you enter. The app does not read your phone's GPS and does not track vehicle location.
• Drivers — name, phone number, duty status, assigned vehicle, attendance by day with any note, pay scheme, monthly salary or daily wage, and advances paid.
• Customers and brokers — name, phone number, address details and notes you enter, outstanding balance, and commission terms.
• Work, bills, payments and expenses — what was done, for whom, when, by which driver and vehicle, the rate, the amount, any notes, and how it was settled.

A driver's pay is held in a separate table with its own access rules: the owner can see the whole business, a driver can see only their own line.

2.4 Photos

Vehicle photos, receipts and profile photos you attach are stored in private buckets. Before any photo leaves the device it is re-drawn and re-encoded, which removes the metadata the camera wrote into the file — including GPS coordinates, the original timestamp and the device model. We keep the picture and a short record of the upload: the original file's name, type and size, whether it came from the camera or the device, and who uploaded it. Phones often put the date in a file's name, so the name can show when a photo was taken.

2.5 Technical and security records

• IP address — the first hop of your connection is used by our server-side functions to count and block abuse. Twenty refused requests from one address in an hour earns a 24-hour block.
• Per-user request counters, so no one account can flood the service.
• An audit log — an append-only record of every write to the tables that carry money or people: what changed, from what to what, by whom, and when. The business owner can read their own trail; nobody, including the owner, can edit it through the app. It is only erased when an account is deleted, as §8 describes. This is what makes the books trustworthy, and it is also why a deleted record can be recovered (see §7).
• Session tokens, so you stay signed in. Each session also records the IP address and browser details it was opened from.

2.6 What stays on your device

The app works without a signal. Held in your device's local storage:

• your sign-in session
• a cached copy of the screens you last viewed
• a queue of work, bills, payments and expenses created while offline, waiting to be sent when the network returns

Signing out removes your sign-in session and the cached screens. Work still in the queue stays on the phone and is sent when you next sign in. It is never sent under another person's account. Your language, theme and first-run choices stay too.

Clearing the app's data or uninstalling removes all of it. Anything still waiting in the queue when you do that is lost and never reaches us.

Bills you export are written to the app's temporary storage on the phone so they can be shared. Android can clear that storage at any time, and uninstalling removes it.

2.7 What we do not collect

• No advertising identifiers, no advertising networks, and no ads.
• No third-party analytics, crash-reporting or behavioural tracking SDKs. The app ships with none.
• No device GPS and no background location.
• No contacts, SMS, call logs, microphone, or files beyond the photos you pick.
• No card, bank or UPI credentials. A UPI ID you enter is text printed on a bill; Vahana processes no payments and moves no money.
• We do not sell personal data, and we do not share it for anyone's marketing.

3. Why we use it, and on what basis

We do not use your business's records to train models, to build profiles, or for any purpose of our own beyond running and securing the service.

4. Who else touches this data

Sharing you initiate. When you export a bill as a PDF or an image and send it through WhatsApp, email or any other app, that file leaves Vahana and is governed by whatever you sent it through. We have no control over it afterwards.

Inside your business. An owner can see every record in their own business, including each driver's work, attendance, advances and salary. A driver can see:

• the vehicle and work-type lists, and vehicle photos;
• the customer list, including each customer's name, phone number, place and notes;
• the business details printed on bills;
• their own driver record, profile, work, bills (with how much has been paid against them), attendance, advances, pay and notifications.

A driver cannot see another driver's details or pay, receipts, the business's payment records, the audit log, or any other business.

5. Where it is kept

On Supabase infrastructure in the ap-south-1 (Mumbai) region, in India.

Our public website is hosted by Zoho in India.

Google processes sign-in, our support mailbox and our landing page's fonts on its own global infrastructure, which may involve transfers outside India under Google's terms.

We have not chosen to keep your data anywhere else. Our providers may handle some of it outside India while running their services, such as delivering an invitation email, under their own terms. If we choose to move it, this policy will be updated first, and the transfer will follow whatever the Central Government has permitted under section 16 of the DPDP Act.

6. How it is protected

• Every record carries the identifier of the business it belongs to, and row-level security in the database — not merely a check in the app — decides who may read or write it. The limits in §4 apply to a driver calling our API directly, not only to the screens in the app.
• Salary sits in its own table so that row-level rules can protect it.
• Photo storage buckets are private, size- and type-limited, and scoped to one business. Within a business, only an owner can open a receipt, and only an owner and the person it belongs to can open a profile photo.
• The administrative key that could bypass these rules exists only inside our server-side functions. It is not in the app you install and it is not in any browser.
• All traffic is encrypted in transit (TLS). Data at rest is encrypted by our hosting provider.
• Every write to a table that matters is audited, and the trail cannot be edited through the app. It is only erased when an account is deleted, as §8 describes.
• Requests are rate-limited per user and per IP address.

No system is perfectly secure. If a breach affects your personal data we will report it to the authorities and notify you, as the law requires.

7. How long it is kept

Please read this carefully: deleting a record inside the app removes it from your working data, but a copy stays in the audit log — that is how the recycle bin brings it back. If you need something truly erased, ask us under §8 and we will remove it from the trail as well.

Deleting your own account takes effect immediately (see §8). When we close an account for any other reason, we delete or irreversibly anonymise its data within 90 days, except what we are required to keep by law.

8. Your rights

Under the DPDP Act you may ask us to:

• tell you what personal data of yours we hold and who we have shared it with;
• correct what is inaccurate, complete what is incomplete, and update it;
• erase your personal data, where we are not required to keep it;
• record a nomination — someone who may exercise these rights if you die or become incapable;
• let you withdraw consent, as easily as you gave it. Withdrawing consent to the processing that runs the app means the account can no longer function;
• hear your complaint first, before you take it to the Data Protection Board of India.

Inside the app you can already correct most of your own details. An owner can also export the business's records and delete rows from them.

You can also delete your account yourself, under Settings → Delete account. It takes effect immediately and cannot be undone:

• If you are a driver, or one of two owners of a business, your sign-in and profile are deleted. The business's records — including work and bills you logged — stay with the business, because they are its accounts. The details on your profile are removed from its audit trail. A driver's entry in the driver list, and that entry's history, also stay, including the name and phone number the owner entered.
• If you are the only owner, the business is deleted with you: every record in it, its photos, its audit trail, and the logins of its drivers. The app offers an export first.

The account deletion page gives the same steps, and tells anyone without the app installed how to ask us to do it.

To make a request, write to vahanasupport@gmail.com from the email address on your account. We will respond within 30 days. We may ask you to confirm who you are before acting.

If you are a driver, a customer or a broker whose details sit in someone's Vahana account, send your request to that business. If you cannot reach them, write to us and we will pass it on and help them act on it.

9. Grievance redressal

If you are unhappy with how we have handled your data or your request:

Grievance Officer

Vijayakumar M

Proprietor, Vahana Agri Solutions, Vellore - Tiruvannamalai Rd, Santhavasal, Vellur, Polur, Tamil Nadu 606905

vahanasupport@gmail.com · +91 86082 58419

We acknowledge every grievance within 24 hours and resolve it within 7 days, as rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 requires.

If you remain dissatisfied, you may complain to the Data Protection Board of India.

10. Children

Vahana is a tool for running a business and is not intended for anyone under 18. We do not knowingly collect a child's personal data. Do not enter a child's personal data into the app. If you believe a child's data is in the app, write to vahanasupport@gmail.com and we will remove it.

11. Changes to this policy

We will post any change here and update the date at the top. If a change materially affects how your personal data is used, we will tell you in the app or by email before it takes effect, and where the law requires it we will ask for your consent again.

12. Contact

Vijayakumar M, proprietor of Vahana Agri Solutions Vellore - Tiruvannamalai Rd, Santhavasal, Vellur, Polur, Tamil Nadu 606905 Email: vahanasupport@gmail.com