Placeholder for legal review. This is a working draft that reflects how the system actually behaves. It must still be reviewed and adapted by qualified Indian counsel — including its position under the Digital Personal Data Protection Act, 2023 — before you rely on it.
What we collect
- Vehicle registration number — to look up challans.
- Mobile number — to verify the request and to contact you about an order.
- Name and email — when you create an account.
- Challan data returned by our data provider, cached against your vehicle.
- Order and payment records — amounts, status and gateway reference. Not card details; those never reach us.
- Identity documents you upload after payment.
- Technical logs — request and security logs. Website analytics use a per-day salted hash rather than a stored IP address.
- Enquiry records — the vehicle number you look up, and the mobile number you enter, even if you do not complete verification. See below.
Enquiries you did not complete
If you enter a vehicle number and a mobile number but do not finish verifying the code, we keep that as an enquiry. We may contact you about it, because someone who stopped part-way usually wanted help and did not get it.
What that means in practice:
- We may call or message you about the challans on that vehicle.
- We do not use these numbers for unrelated marketing, and we do not share or sell them.
- Enquiry records are deleted automatically after a set retention period unless the enquiry became an order.
- Ask us to delete your enquiry at any time and we will, immediately.
How we use it
To provide the service: fetching challans, determining eligibility, taking payment, engaging an advocate, and keeping you updated. We do not sell personal data, and we do not use your details for advertising.
Who it is shared with
- The advocate assigned to your case — the case details and documents needed to act for you, and nothing else.
- Our data provider — the vehicle number, to perform the lookup.
- The payment gateway — the amount and order reference.
- Authorities — where we are legally required to disclose.
How documents are protected
Uploaded documents are encrypted with AES-256-GCM before being written to disk, using a key held outside the web directory. There is no public URL for a document. Access is limited to you and the assigned advocate, enforced per object, and every access and every refusal is written to an audit log.
Retention
Order and payment records are kept for the period required by tax and accounting law. Identity documents are kept while the matter is open and for a defined period afterwards. One-time-code records are pruned after a short period. Raw analytics rows are aggregated daily and the raw rows are then deleted.
Your rights
You may ask what we hold about you, ask for corrections, and ask for deletion. Raise a support ticket marked as a privacy request. Some records must be retained for statutory reasons; where that applies we will tell you specifically which and why.
Changes
Material changes will be notified to registered users. The date of the last revision appears at the foot of this page once it is finalised by counsel.