Privacy Policy

1. Information We Collect

• Account & contact details: your mobile phone number (verified via one-time password), your full name, and an optional profile photo.
• Vehicle details: registration/plate number, make, model, manufacturing year, and colour for every vehicle you add to your account.
• Precise location: your device's GPS coordinates while you request or receive a service, enabling us to dispatch help, display live tracking, and calculate routing. We collect location only when the app is in active use for a job or wash booking unless you have granted background location permission.
• Payment information: subscription and transaction processing is handled entirely by our payment partner Razorpay. We receive only transaction status codes, order identifiers, and masked payment method metadata — we never store your full card number, CVV, or net-banking credentials.
• Device & usage data: push notification tokens (FCM), app version, device model, operating system version, app interactions, crash reports, and diagnostic logs used to maintain and improve the Services.
• Service-related data: job histories, car-wash booking records, inspection reports, before/after wash photos, and ratings you submit.

2. How We Use Your Information

We use the information we collect strictly to deliver and improve the GERAZ Services. Specifically, we use your data to create and manage your account and subscription; dispatch the nearest available patrol driver or garage partner when you request roadside assistance; process payments and issue receipts; send you job status updates, service notifications, and renewal reminders via push notification or SMS; provide in-app live tracking of your responder; schedule and manage car-wash bookings; and respond to support queries or disputes.

We may also use aggregated, anonymised data — from which individual identities cannot reasonably be determined — for analytics, product improvement, and internal reporting. We do not sell your personal data to third parties for advertising purposes.

We may use your contact details to send you important service communications, such as security alerts, policy updates, or critical service changes. Promotional communications are sent only with your consent and you may opt out at any time through the app settings.

3. Service Providers We Share Data With

We share your personal information with trusted third-party processors only to the extent necessary to deliver the Services. Each processor is bound by its own data protection obligations. Our current key processors are:

• Razorpay: payment processing, subscription mandates, and refund management. Your payment data is stored and processed under Razorpay's PCI-DSS-compliant infrastructure.
• Twilio: SMS delivery for OTP authentication, backup notifications, and AI-assisted outbound voice calls to patrol drivers. Twilio processes the phone number and message content required to complete each communication.
• Google (Maps Platform): map display, real-time routing, distance calculations, and address look-up within the GERAZ apps. Google receives the coordinates and addresses needed to render maps and compute ETAs.
• Firebase (Google LLC): phone-number OTP authentication and push notification delivery via Firebase Cloud Messaging. Firebase processes your phone number during sign-in and your notification token for push delivery.
• Amazon Web Services / Cloudflare R2: secure cloud object storage for profile photos, garage documents, and car-wash before/after images.
• ElevenLabs: AI text-to-speech synthesis used in proactive vehicle health reminder calls and certain automated patrol alerts. Only the script text required for a given call is sent; no personal identifiers beyond what is needed for the call are transmitted.

4. Sharing With Responders

When you request roadside assistance or a car-wash service, the assigned patrol driver or garage partner receives the minimum personal information required to fulfil your request: your first name, your confirmed service location, the vehicle registration and description, and the specific job details (e.g., service type, reported issue). Responders do not receive your full account history, payment details, or any information beyond what is strictly necessary for the active job.

Responder access to your information is limited to the duration of the active job. Once the job is marked complete, the responder's app no longer displays your personal details. GERAZ does not permit responders to use your information for any purpose other than fulfilling the assigned job.

5. Location Data

Precise location is the core data point that enables GERAZ to dispatch the nearest available responder to you and to give you real-time tracking of their progress. We collect precise GPS coordinates from your device during an active service request and, for responder apps, during active job assignments. We do not track your location in the background between service requests unless you have explicitly enabled that permission and a job is active.

You can review and revoke location permissions at any time through your device's system Settings app under the GERAZ application entry. Disabling location access will prevent you from requesting services that require dispatch — the core roadside assistance feature will not function without location permission. Car-wash address entry via manual text input will still be available.

6. Data Retention

We retain your personal data for as long as your account is active and for a period thereafter as required to fulfil legal obligations, resolve disputes, and enforce our agreements. Specifically: account and vehicle data is retained while your account is open and for up to five years after account deletion; transaction and subscription records are retained for eight years for tax and financial regulatory compliance; job history and inspection records are retained for five years; push notification tokens are refreshed automatically and expired tokens are deleted within 30 days.

You may request deletion of your account and associated personal data at any time by contacting us at info@geraz.in. We will action deletion requests within 30 days, subject to any retention requirements mandated by applicable law.

7. Security

GERAZ implements reasonable technical and organisational measures to protect your personal information against unauthorised access, disclosure, alteration, or destruction. These measures include encrypted data transmission (TLS 1.2 or higher), hashed credential storage, JWT-based authentication with short-lived tokens, rate limiting on authentication endpoints, and restricted access controls for internal systems.

No method of electronic storage or transmission is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify affected users and, where required, the relevant authorities in accordance with applicable Indian data protection law.

8. Your Rights

Subject to applicable law, you have the right to access the personal data we hold about you, request correction of inaccurate data, request deletion of your data, and object to or restrict processing in certain circumstances. To exercise any of these rights, please write to us at info@geraz.in with your registered mobile number and a description of your request. We will respond within 30 days.

If you believe your data has been handled in violation of applicable law, you may lodge a complaint with the Data Protection Board of India or another competent supervisory authority.

9. Children

The GERAZ Services are intended for users aged 18 and over. We do not knowingly collect personal information from individuals under 18. If we become aware that a user under 18 has provided us with personal information without verifiable parental consent, we will take steps to delete that information promptly. If you believe a minor has submitted information to us, please contact us at info@geraz.in.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will update the "Last updated" date at the top of this page and provide an in-app notification. Continued use of the Services after the updated Policy takes effect constitutes your acceptance of the revised terms.

11. Contact Us

GERAZ ENTERPRISES PRIVATE LIMITED — for privacy-related enquiries, data access requests, or complaints, please email info@geraz.in. This Privacy Policy is governed by the laws of India and is subject to the jurisdiction of competent courts in Gujarat.