Legal

Privacy Policy

Effective date: 12 October 2026 · Last updated: 16 October 2026

This Privacy Policy explains how BabuTaxi (“BabuTaxi”, “we”, “us”) collects, uses, shares, retains and deletes information when you use the BabuTaxi customer app, the BabuTaxi Driver app, or this website (together, the “Services”). BabuTaxi is a fixed-fare taxi pre-booking service for the Darjeeling hills, operated from India.

By creating an account or booking a ride you agree to this policy. If you do not agree, please do not use the Services. You can browse routes and check fares in the customer app without creating an account; an account is required only to book.

1. Information we collect

Account information (customers and drivers). Name, email address, mobile number and a password (stored only as a salted cryptographic hash — we never see or store your plain password). We send a one-time code (OTP) to your email to verify it.

Booking information (customers). Pickup and drop locations, travel date, pickup time, pickup point and drop point you type in, notes to the driver, the vehicle type you choose, the fare, and the payment status of each booking.

Driver & vehicle verification (drivers only). Vehicle details (type, brand, model, colour, seats, registration number), document numbers and expiry dates (registration certificate, insurance, driving licence), and photos of those documents (RC front/back, driving licence front/back and, optionally, insurance, permit, fitness, PUC and a vehicle photo) that you capture with your camera or choose from your gallery. These are used solely to verify drivers before they can accept bookings.

Payment information. Bookings are prepaid through a payment provider regulated in India. We record the amount, payment status and a payment reference. We do not collect or store your card number, UPI PIN or banking credentials — those are handled by the payment provider on its own secure pages.

Technical information. Standard server logs (IP address, request time, app version) used for security and troubleshooting.

What we do NOT collect. The apps do not track your GPS location in the background or foreground, do not read your contacts, photos (other than the documents a driver explicitly submits), messages or files, do not show advertising, do not use advertising identifiers, and currently include no third-party analytics or tracking SDKs.

2. How we use your information

To create and secure your account and verify your email.
To take, confirm, assign and complete taxi bookings, and to process prepayments and refunds.
To connect a booked customer with their assigned driver (see section 3).
To verify drivers and vehicles so only approved drivers carry passengers.
To provide customer support and resolve disputes about a ride.
To keep the Services safe — preventing fraud, abuse and unauthorised access.
To meet legal obligations such as tax and accounting record-keeping.

We do not sell your personal information, and we do not use it for third-party advertising or cross-app tracking.

Between customer and driver. When a driver takes your booking, the customer sees the driver’s name, phone number and vehicle details, and the driver sees the customer’s name, phone number, pickup and drop points, and any notes — the minimum needed to complete the ride.

Service providers. We use a small number of providers to run the Services: cloud hosting, email delivery (for OTPs and booking emails) and a payment gateway. They process data only on our instructions and only to provide their service.

Our staff. Authorised BabuTaxi staff can see bookings and driver verification documents in an access-controlled admin panel, to verify drivers, assign rides and handle support.

Legal. We may disclose information when required by law, court order or a competent authority, or to protect the rights and safety of riders, drivers or the public.

We never share your data with advertisers or data brokers.

4. App permissions we request

Camera (driver app only) — to photograph vehicle and licence documents during driver registration. Used only when you tap a capture button; nothing is recorded in the background.
Photos / media picker (driver app only) — to let you choose an existing photo of a document instead of taking a new one. We receive only the photos you pick.
Internet — to talk to BabuTaxi servers over encrypted connections.
Notifications (when introduced) — to tell you about booking confirmations and driver assignment. You can switch these off in system settings at any time.

The apps do not request location, contacts, microphone, SMS or call-log permissions.

5. How long we keep data

Account data — kept while your account is active, deleted or anonymised after account deletion (section 6).
Email OTP codes — short-lived; they expire within minutes and are purged.
Booking and payment records — kept for as long as Indian tax, accounting and consumer-protection law requires (typically up to 8 years), after which they are deleted or anonymised.
Driver verification documents — kept while the driver account is active and for the period required by law after it closes, then deleted.
Server logs — rotated and deleted on a short cycle.

6. Deleting your account and data

You can request deletion of your BabuTaxi account and the personal data associated with it at any time, whether you are a customer or a driver:

On the web — go to babutaxi.com/delete-account, enter the email of your account, choose the app, and enter the code we email you.
In the app — Profile → Delete account (being rolled out; if you do not see it yet, use the email option below).
By email — write to [email protected] from your registered email with the subject “Delete my account”.

We verify the request, close your account and sign you out straight away, then delete or anonymise your account data within 30 days and email you when it is done. Booking and payment records that we are legally required to retain (for example for tax) are kept for the statutory period and then deleted; they are no longer linked to a usable account. Deletion is permanent and cannot be undone.

This section serves as the data-deletion disclosure for the Google Play Data safety form and the account-deletion requirement of both Google Play and the Apple App Store.

7. How we protect data

All traffic between the apps, the website and our servers is encrypted (HTTPS/TLS).
Passwords are stored only as salted bcrypt hashes.
Sign-in uses short-lived email OTP verification for new accounts.
Driver documents and bookings are visible only to authorised staff through a role-restricted admin panel.
Access to production systems is limited and logged.

No internet service can promise absolute security, but if we learn of a breach affecting your personal data we will notify you and the authorities as required by law.

8. Children

The Services are for adults. You must be at least 18 years old to create an account, book a ride or drive with BabuTaxi. The apps are not directed at children, are not enrolled in family/kids programmes, and we do not knowingly collect data from anyone under 18. If you believe a minor has given us personal data, contact us and we will delete it.

9. Your rights

Subject to applicable law — including India’s Digital Personal Data Protection Act, 2023 — you can:

access a summary of the personal data we hold about you;
correct inaccurate or incomplete data (name, email and phone can be updated via support);
withdraw consent and delete your account (section 6);
nominate another person to exercise these rights if you are unable to;
raise a grievance and, if unresolved, approach the Data Protection Board of India.

To exercise any of these rights, email [email protected]. We respond within 30 days.

10. Third-party services

The Services currently rely on: cloud hosting (storage and processing of all app data), transactional email (delivery of OTPs and booking emails) and an RBI-regulated payment gateway (payment processing; publishes its own privacy policy). When push notifications launch they will use Google Firebase Cloud Messaging, which processes a device token to deliver notifications. We will update this policy and the store data-safety declarations before adding any new third-party service.

11. Google Play & Apple App Store disclosures

For the Google Play Data safety form and the Apple App Privacy labels, BabuTaxi declares:

Data collected and linked to you: name, email address, phone number (account management); addresses you type for pickup/drop and booking details (app functionality); payment status and reference (app functionality); driver apps additionally collect photos/documents and vehicle identifiers you submit (identity/driver verification).
Data used to track you across other companies’ apps or websites: none.
Advertising data: none collected or shared.
Precise or approximate device location: not collected.
Data shared with third parties: limited to the service providers in section 10, and ride details exchanged between a customer and their assigned driver.
Data encrypted in transit: yes.
A way to request deletion: yes — babutaxi.com/delete-account, section 6 of this policy, in-app deletion, or [email protected].

Google Play and the App Store are distribution platforms; Google and Apple process your download and payment data under their own privacy policies.

12. Changes to this policy

When we change this policy we will update the date at the top and, for significant changes, notify you in the app or by email before the change takes effect. This page is always available at babutaxi.com/privacy.

13. Contact & grievance officer

Questions, requests or complaints about privacy:
Email: [email protected]
Grievance Officer (per Indian IT Rules, 2021 / DPDP Act, 2023): Grievance Officer, BabuTaxi — reachable at the email above; acknowledgement within 48 hours, resolution within 30 days.