GoToGoCar – Intercity Carpooling Platform · gotogocar.com
GoToGoCar ("GoToGoCar", "we", "our", or "us") is an intercity carpooling platform operated by its founders, registered and based in Hyderabad, Telangana, India. We operate through our mobile application ("App") and marketing website at gotogocar.com (collectively, "Platform").
This Privacy Policy ("Policy") describes how we collect, use, store, share, and protect personal information when you use our Platform. It applies to all users worldwide, with specific provisions for users in India under the Digital Personal Data Protection Act, 2023 (DPDPA) and Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules").
By downloading, installing, or using our App or visiting our website, you agree to the practices described in this Policy. If you do not agree, please discontinue use immediately.
| Category | Examples | When Collected |
|---|---|---|
| Account & Identity | Name, phone number, profile photo, age range, gender (optional) | Registration & profile setup |
| Ride Information | Pickup location, drop location, date, time, seats offered/requested, vehicle details (make, model, registration number), price per seat | When posting or booking a ride |
| Communications | In-app chat messages between driver and rider | When using in-app messaging |
| Reviews & Ratings | Star ratings and written feedback about other users | After trip completion |
| Support Requests | Emails, messages, and attachments sent to support | When contacting us |
| Identity Verification | Government-issued ID details (if voluntary verification is introduced) | If/when verification features are live |
| Category | Examples |
|---|---|
| Device Information | Device type, OS version, unique device identifier (Android ID), app version |
| Log Data | IP address, timestamps, pages/screens viewed, crashes, error logs |
| Usage Analytics | Features used, search queries entered, ride booking funnel steps |
| Push Notification Tokens | Expo push token for sending ride confirmations and alerts |
We use the information we collect for the following purposes:
Under the DPDPA 2023 and applicable data protection principles, we process your personal data on the following legal bases:
| Processing Activity | Legal Basis |
|---|---|
| Account creation, ride matching, messaging | Performance of contract / provision of service |
| OTP verification and identity checks | Consent + Legitimate interest (safety) |
| Analytics and product improvement | Legitimate interest |
| Promotional communications | Consent (opt-in) |
| Legal compliance and law enforcement requests | Legal obligation |
| Fraud prevention and safety enforcement | Legitimate interest |
Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
We may share information only in the following limited circumstances:
When a booking is confirmed, the driver and rider can see each other's:
This information is shared solely to facilitate the ride and is not accessible to other users on the platform.
We use third-party vendors who process data on our behalf under strict contractual obligations:
| Provider Type | Purpose | Data Shared |
|---|---|---|
| Cloud Hosting (MongoDB Atlas / similar) | Database storage | All app data, encrypted at rest |
| OTP / SMS Provider | Phone verification | Phone number only |
| Push Notification (Expo) | Ride alerts | Push token, notification payload |
| Media Storage (Cloudinary) | Profile photo hosting | Profile images only |
| Analytics (if applicable) | App performance monitoring | Anonymised/aggregated usage data |
| Email / Support | Responding to user queries | Email address, query content |
All service providers are contractually bound to use data only for the specified purpose and to implement appropriate security measures.
We may disclose information if we believe in good faith that such disclosure is necessary to:
Where permitted by law, we will notify users of such requests.
In the event of a merger, acquisition, restructuring, or sale of all or substantially all of our assets, your personal information may be transferred as part of that transaction. We will notify you via email or prominent notice on the Platform before your data is subject to a different privacy policy. You will have the option to delete your account if you do not consent to the new terms.
We may share aggregated or de-identified data (e.g., "X rides completed on the Hyderabad–Warangal route this month") that cannot reasonably be used to identify any individual. Such data is not subject to this Policy.
Our App may integrate third-party services, including but not limited to notification services, analytics SDKs, and cloud providers. These third parties operate under their own privacy policies. We encourage you to review the privacy policies of any third-party services you interact with.
We currently use or may use the following categories of third-party services:
We do not embed third-party advertising SDKs. We do not use advertising identifiers (GAID) for ad targeting.
| Data Type | Retention Period | Reason |
|---|---|---|
| Active account data (profile, phone) | Duration of account + 30 days post-deletion | Service delivery; grace period for accidental deletions |
| Ride history | 3 years from trip date | Dispute resolution, legal compliance |
| In-app messages | 90 days from message date | Safety investigations; then deleted |
| Support communications | 2 years from last interaction | Audit trail, legal compliance |
| Ratings & reviews | Duration of both users' accounts | Community trust system |
| Financial transaction records (if applicable) | 7 years | Indian tax & accounting law |
| Server logs (IP, access logs) | 90 days | Security monitoring; then deleted |
| Anonymised analytics | Indefinite | Not personal data; used for product improvement |
After the retention period, data is securely deleted or irreversibly anonymised. Legal hold obligations (e.g., ongoing litigation or regulatory investigation) may require us to retain data for longer.
We implement the following technical and organisational measures to protect your data:
Under the DPDPA 2023 and other applicable laws, you have the following rights with respect to your personal data:
| Right | What It Means | How to Exercise |
|---|---|---|
| Right to Access | Obtain a copy of the personal data we hold about you | Email support@gotogocar.com |
| Right to Correction | Request correction of inaccurate or incomplete data | In-app profile settings or email us |
| Right to Erasure | Request deletion of your account and personal data (subject to legal obligations) | gotogocar.com/delete-account.html |
| Right to Withdraw Consent | Withdraw consent for optional processing (e.g., promotional emails) | Unsubscribe link in emails or email us |
| Right to Grievance Redressal | Lodge a complaint with our Grievance Officer | See Section 14 |
| Right to Nominate | Nominate another person to exercise rights on your behalf in case of death or incapacity (DPDPA provision) | Email us with documentation |
We will respond to verifiable requests within 30 days. Where we are unable to fulfil a request (e.g., data required for legal compliance), we will explain the reason in writing.
We reserve the right to verify your identity before processing any request to protect against unauthorised access to another user's data.
You can disable push notifications at any time through your device's notification settings (Android: Settings → Apps → GoToGoCar → Notifications). Note that disabling push notifications may affect your ability to receive ride alerts and booking confirmations in a timely manner.
You may delete your account at any time via the in-app "Delete Account" option (Profile → Settings → Delete Account) or by visiting gotogocar.com/delete-account.html. Upon deletion, your profile and personal data will be permanently removed within 30 days, subject to retention obligations in Section 7.
GoToGoCar is based in India and primarily processes data on servers located within India or in data centres operated by our cloud providers. Certain service providers (such as Cloudinary, Expo, MongoDB Atlas) may process data in other countries.
When we transfer personal data outside India, we ensure appropriate safeguards are in place, including:
By using GoToGoCar, you acknowledge and consent to the transfer of your information to our service providers globally as described in this Policy.
Our marketing website may use the following types of cookies:
| Cookie Type | Purpose | Can You Opt Out? |
|---|---|---|
| Strictly Necessary | Essential for website to function (e.g., security, session handling) | No (required for service) |
| Analytics | Understand how visitors use the website (e.g., pages visited, bounce rate) | Yes – via browser settings |
| Performance | Improve website speed and user experience | Yes – via browser settings |
We do not use advertising or tracking cookies. We do not use third-party ad networks on our website.
Our App does not use browser cookies. We use a device-level analytics identifier to understand aggregate app usage. This identifier cannot be used to identify you personally. You can reset it via Android Settings → Privacy → Ads → Reset Advertising ID.
GoToGoCar is intended for users who are 18 years of age or older. We do not knowingly collect, process, or store personal information from individuals under the age of 18.
If we become aware that a user under 18 has registered on the Platform, we will immediately suspend the account and delete all associated personal data within 7 days of discovery. If you believe a minor has registered, please notify us immediately at support@gotogocar.com.
Under the DPDPA 2023, processing of data of children requires verifiable parental consent. As our Platform is not directed at minors, we do not implement such processes — and instead prohibit minor usage entirely.
Nothing in this clause limits or excludes any liability that cannot be excluded under applicable Indian law.
In accordance with the Information Technology Act, 2000, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the Digital Personal Data Protection Act, 2023, we have designated a Grievance Officer:
You may also escalate unresolved complaints to the Data Protection Board of India (once constituted under the DPDPA 2023) or approach appropriate courts in Hyderabad, Telangana, India.
We reserve the right to modify this Privacy Policy at any time. When we make material changes, we will:
Your continued use of the Platform after the effective date of any revised Policy constitutes your acceptance of the updated terms. If you do not agree to the revised Policy, you must stop using the Platform and request account deletion.
For any privacy-related questions, data requests, or concerns, please contact us:
This Privacy Policy is governed by and construed in accordance with the laws of India. Any disputes arising from this Policy or our data practices shall be subject to the exclusive jurisdiction of the courts in Hyderabad, Telangana, India.