Kyra - Privacy Policy

Kyra is a women-only ride-hailing service operating in Bengaluru, Karnataka, India. This Privacy Policy explains what personal information Kyra collects from riders and drivers, why we collect it, how it is used, who it is shared with, how long we keep it, and what rights you have under the Digital Personal Data Protection Act, 2023 (the "DPDP Act") and other applicable Indian law.

By creating an account or using the Kyra rider or driver application (together, the "Apps"), you agree to the practices described here.

1. Who we are

Kyra is operated by Divyashri Dinesh Patil, an individual operating as a sole proprietor in India. The operator is currently below the GST registration threshold and does not hold a GSTIN at this time; this policy will be updated when registration is obtained. References to "Kyra", "we", "our", and "us" mean this operator. The grievance officer is named in Section 13.

2. Scope

This policy covers the rider app, the driver app, and any associated webpages, support channels, and back-end systems that we operate. It does not cover services run by third parties, even when they are reached through the Apps (for example, payment partners and SMS providers). Those third parties have their own privacy policies and we link to the major ones in Section 9.

3. Personal data we collect

We only collect data we need to make the service work. The categories below are exhaustive for the current product.

3.1 Account and identity

• Phone number: Used to create the account, sign in, and contact you about a ride. Verified via a one-time password (OTP).
• Name, email (optional), date of birth, profile photo: Provided by you during sign-up.
• Selfie captured in-app (Photos): Used to verify that the person creating the account matches the photo and, for drivers, to verify that the person driving matches the registered driver. The image is stored encrypted at rest. We do not run facial-recognition matching across other Kyra accounts and we do not sell or share this image with any third party other than the KYC vendor disclosed in Section 9.
• Aadhaar verification reference (drivers only): When you are onboarded as a driver, our KYC vendor verifies your Aadhaar number through the official Aadhaar Offline / OKYC flow. We store the verification reference (a token) and the success/failure result. We do not store your Aadhaar number, your Aadhaar XML file, or your Aadhaar OTP.
• Driving licence, vehicle registration certificate (RC), insurance certificate, training certificate (drivers only): These files/documents and their images, along with the extracted text fields (licence number, RC number, expiry dates), are stored so our verification team can review them.

3.2 Ride and location data

• Rider precise location is collected on-demand: when you open the pickup screen, when you request a ride, and during an active ride. It is not collected when the rider app is in the background and there is no active ride.
• Driver precise location is collected continuously in the background (even when the app is closed or not in use) while the driver is online. This location data is shared with our matching service so we can route nearby ride requests to you. While a ride is in progress, the driver's location is also shared with the matched rider. When the driver toggles offline, location collection stops.
• Pickup, drop, and waypoint addresses: Stored against each ride.
• Trip route, distance, duration, fare: Stored against each ride.
• Cancellation reasons, no-show reasons: Stored against each ride.

3.3 Payments

• Mode of payment (UPI, cash): Stored against each ride.
• Payment instrument tokens: When you pay through Razorpay, Razorpay shares a transaction reference with us. We do not store your card number, UPI PIN, bank account number, or CVV. Your full payment details remain with Razorpay under their PCI DSS scope.
• Payment status, refund history, dispute notes: Stored against each ride.

3.4 Safety

• SOS events: When you press the in-app SOS button, we record the time, your latitude, longitude, accuracy, the ride ID (if any), and any short note you add. The event is reviewed by Kyra operations and may be shared with law enforcement at your request or where we are required to do so by law.
• Gender-check confirmations (drivers only): A short structured note recorded by the driver at the start of a ride confirming the rider matches the women-only policy.
• Ratings, written feedback, reports about another user: Stored against each ride and against the user who is the subject of the feedback.

3.5 App and device data

• Device model, OS version, app version, language, time zone: Used to debug crashes and tailor the interface.
• Crash logs, error logs: Used to find and fix bugs. Logs may include screen names and short event names; they are not designed to capture the contents of fields you type.
• App permissions you grant or deny: Stored on your device by the operating system; we read the result so we know whether to ask again.
• Push notification token (when you allow notifications): Used to deliver ride updates.

3.6 Communications data

We communicate with you through the following channels. Each channel and its purpose is listed below.

• SMS one-time passwords: Message content is the OTP and a short brand prefix only.
• In-app chat (if and when launched): Currently not in scope; this policy will be updated before any chat feature ships.
• Support tickets and emails you send us: Stored so we can resolve your issue and meet our record-keeping obligations.

4. How we use this data

We use your data only for the purposes listed below.

• To create your account and verify that you are eligible to use the service (rider eligibility = adult woman in our service area; driver eligibility = adult woman with valid licence and vehicle).
• To match you with a driver or a rider, calculate fares, route trips, and process payments.
• To meet our legal obligations under Indian motor-transport, taxation, and information-technology law.
• To detect, investigate, and respond to safety incidents, fraud, and abuse.
• To improve the service: to fix bugs, design new features, and produce aggregate, non-identifying reports about how the service is used.
• To send you operational messages (ride status, driver arrival, payment receipts, account alerts).
• To send you marketing messages, only with your explicit opt-in, and only for Kyra's own services. You can withdraw consent at any time from the profile screen.

We do not use your personal data for automated decision-making that produces legal or similarly significant effects on you without a human in the loop. Specifically, every account suspension, every KYC rejection, and every safety action is reviewed by a Kyra staff member before it is applied.

5. How we communicate with you

5.1 Transactional communication

Transactional messages are sent to deliver the service and cannot be opted out of while your account is active. They include:

• Ride updates - driver assigned, driver en-route, driver arrived, ride started, ride completed. Sent via push notification and, where push is unavailable, SMS.
• OTP / authentication - one-time passwords for sign-in and phone-number verification. Sent via SMS.
• Payment confirmations and receipts - fare charged, refund processed, payment failed. Sent via push notification and email.
• Account and KYC alerts - account created, KYC approved or rejected, account suspended. Sent via push notification and email.
• Safety alerts - SOS acknowledgement, emergency-contact trip-share link triggered. Sent via push notification and SMS.
• Policy and legal notices - updates to this Privacy Policy or the Terms of Service. Sent via in-app banner, push notification, and email.
• Earnings summaries (drivers, pilot period) - daily or weekly earnings digest. Sent via WhatsApp and email.

5.2 Marketing communication

Marketing messages are sent only with your explicit, separate opt-in and only for Kyra's own services. We do not send third-party marketing. Marketing channels are:

• SMS (via MSG91)
• Push notifications
• In-app banners

You can withdraw marketing consent at any time from Profile → Notifications in the app, or by replying STOP to any marketing SMS. Withdrawal of marketing consent does not affect transactional messages.

Personal data used for marketing: your name (for personalisation), phone number (SMS), push token (push notifications), ride history (to send contextually relevant offers). This data is not shared with any third-party advertiser.

6. Lawful basis

Under the DPDP Act we process your data on the following bases:

• Consent, which you give when you create an account and tick the agreement to this policy.
• Legitimate uses as defined in Section 7 of the DPDP Act, including the performance of a service you have asked for, compliance with law, and responding to a medical or safety emergency.

You can withdraw consent at any time using the controls described in Section 12. Withdrawing consent for processing that is essential to running the service (for example, location during a ride) means we cannot continue to provide the service to you, and your account will be deactivated.

7. Children

Kyra is not for people under 18. We do not knowingly collect data from anyone under 18. If we learn that we have collected such data, we delete it. If you believe a child has signed up, please contact the grievance officer (Section 13).

8. How long we keep your data

• Account profile (name, phone, email): kept while your account is active and for 24 months after you delete the account, unless a longer period is required by law.
• KYC documents (driver licence, RC, selfie, Aadhaar verification reference): kept for the longer of (a) the period required by the Motor Vehicles Act and tax law (currently 8 years from the end of the financial year of the last trip) and (b) 5 years from account deletion.
• Ride records (trip details, fares, payment status, ratings): kept for 8 years from the end of the financial year of the trip, to meet tax and dispute obligations.
• Location traces: raw location points are kept for 12 months. After that we keep only the polyline summary attached to the ride record.
• SOS event records: kept for the longer of 5 years and the duration of any related investigation.
• Marketing-consent logs: kept for 3 years from the date consent was last refreshed.
• Crash and error logs: kept for 90 days.

After the relevant retention period ends, we delete the data or irreversibly anonymise it.

9. Who we share data with

We do not sell your personal data. We share it only with the categories of recipients listed below, only for the purposes listed, and only to the minimum extent needed.

• The matched driver or rider on a given trip. Drivers see the rider's first name, profile photo, pickup, and drop. Riders see the driver's first name, profile photo, vehicle make/model, registration plate, rating, and live location during the ride. Phone numbers are not shared directly; in-app calls are masked through a third-party number-masking service when launched.
• Razorpay Software Private Limited ("Razorpay") - payment processing. Razorpay's privacy policy: https://razorpay.com/privacy/.
• MSG91 (Walkover Web Solutions Pvt. Ltd.) - SMS OTP and transactional SMS. MSG91 privacy: https://msg91.com/in/privacy.
• A regulated KYC partner authorised under UIDAI's Aadhaar Offline / OKYC framework - Aadhaar verification, RC verification, and driving-licence verification for drivers. The specific partner will be named here once onboarding is complete; users will be notified through an in-app prompt and an updated version of this policy before the partner is engaged.
• Supabase, Inc. and its sub-processors - managed PostgreSQL database, authentication, file storage, and edge functions. Supabase region: AWS Mumbai (ap-south-1). Supabase privacy: https://supabase.com/privacy.
• Google LLC - We share Location data for maps, geocoding, place search, navigation. Google privacy: https://policies.google.com/privacy.
• Sentry / Expo error reporting (if enabled) - We share Crash Logs and App Performance Data for error reporting and to find and fix bugs. Sentry privacy: https://sentry.io/privacy/. Expo privacy: https://expo.dev/privacy.
• Law enforcement and regulators - when required by a valid legal demand under Indian law.
• Professional advisers - lawyers, accountants, auditors who are themselves bound by confidentiality.
• A successor entity - if Kyra is acquired or restructured, your data may transfer; the successor must continue to honour this policy or give you notice and a chance to delete your account first.

10. Where data is stored

Kyra primary data is stored in AWS Mumbai through Supabase. Backups are stored in the same region. Some sub-processors (for example, Sentry and Google Maps) may process data outside India in line with their published policies. Cross-border transfers comply with the DPDP Act and are limited to the countries permitted by the Central Government.

11. Security

We protect your data with industry-standard measures: TLS 1.2+ in transit; AES-256 at rest in Supabase storage; role-based access for Kyra staff; signed URLs for KYC document access with short expiry; rate-limited authentication; and immutable audit logs for admin actions. No system is perfectly secure; if a breach occurs we will notify the Data Protection Board and affected users in line with the DPDP Act.

12. Your rights

Under the DPDP Act you have the right to:

• Access the personal data we hold about you and a summary of how we use it.
• Correct data that is inaccurate or out of date.
• Erase data that we no longer need to keep, subject to the retention rules in Section 8.
• Withdraw consent for any processing based on consent.
• Nominate another individual to exercise these rights on your behalf if you die or become incapacitated.
• Complain to the Data Protection Board of India: https://www.dpbindia.gov.in (when operational).

To exercise any of these rights, write to the grievance officer in Section 13 from the email or phone number on your account, or use the in-app "Privacy" controls in the profile screen. We respond within 30 days. You can also request account and data deletion via our website at https://kyra-account-deletion.vercel.app/.

13. Grievance officer

In line with Rule 3(11) of the Information Technology (Intermediary Guidelines) Rules and the DPDP Act, our grievance officer is:

• Name: Divyashri Dinesh Patil
• Designation: Founder & Grievance Officer
• Email: admin@kyrarides.in
• Postal address: Salarpuria Sattva Magnificia, A2301, Bengaluru 560016, Karnataka, India
• Acknowledgement window: within 24 hours of receipt
• Resolution window: within 15 days of receipt

14. Changes to this policy

We may update this policy at any time without prior intimation. When we do, we will notify you that the policy has been updated through the following channels:

• In-app banner - shown the next time you open the app.
• Push notification - sent to all registered devices.
• SMS - sent to your registered phone number.
• Email - sent to your registered email address (if provided).

The "last updated" date at the top of this policy will always reflect the current version. Your continued use of the service after we notify you of a change means you accept the updated policy. If you do not accept the updated policy, you may close your account from Profile → Settings → Delete Account. You can also request account and data deletion via our website at https://kyrarides.in/delete-account.

15. Contact

For anything not covered above, write to the grievance officer (Section 13) or in-app via Profile → Help.