Skip to main content

Legal

Privacy Policy

Effective 15 September 2026. Plain-English summaries where possible.

This Privacy Policy describes how Velosta Technologies ("Velosta", "we", "us") collects, processes, and protects personal information when you use our platform.

1. Information we collect

  • Account data: name, email, phone, organization details for staff accounts.
  • Customer data (your renters): name, phone, address, masked Aadhaar (last 4 digits only), driving license metadata, passport metadata for foreigners. Full Aadhaar images are processed and discarded. Masked Aadhaar and other supported document copies may be retained for the rental workflow.
  • Booking and payment metadata: vehicle assignment, dates, amount, GST details, payment method.
  • System logs: IP address, user-agent, and timestamps for authentication and audit purposes.

2. How we use your information

  • To deliver the Velosta platform and its features.
  • To enable WhatsApp and email communications with your customers (initiated by you).
  • To detect and prevent fraud. including the opt-in cross-vendor blacklist.
  • To meet legal, accounting, and tax obligations (e.g., GST invoicing).

3. Aadhaar and passport handling

Full Aadhaar images are used to extract customer information and are discarded after processing. We do not retain the full Aadhaar number. Masked document copies, with only the last four Aadhaar digits visible, and relevant parsed customer details are retained for the rental workflow. Other supported document copies may be stored where the enabled workflow requires them. Access and deletion follow the controls described in this policy.

4. Data storage and security

  • Data is hosted on AWS infrastructure in India (ap-south-1).
  • Files are stored in segregated, server-side encrypted S3 buckets.
  • Authentication uses short-lived JWT access tokens with rotated refresh tokens.
  • Access is role-based with 24+ permission keys and branch-scoped membership.

5. Sharing and disclosure

We do not sell your data. We share data only with:

  • Sub-processors required to operate the service (AWS, Google Cloud Vision for OCR, WhatsApp Business API, payment processors, SMTP providers).
  • Law enforcement, when compelled by valid Indian legal process.
  • Other Velosta-powered rental stores, only in the form of the opt-in cross-vendor blacklist (and only the flag, category, and approximate month. never the renter's identity).

6. Your rights

  • Access and export your data on request.
  • Correct inaccurate information.
  • Delete your account or organization, subject to a 30-day grace window, after which deletion follows the scope and legal-retention exceptions in our deletion policy. See our Data Deletion Policy for step-by-step instructions.
  • Withdraw consent for non-essential processing.

7. Retention

We retain account and booking data for the duration of your subscription and as required by accounting/tax law. PII associated with deleted accounts is purged after the 30-day grace window, except where retention is legally mandated.

8. Contact us

For privacy questions, data access requests, or complaints, reach our team at support@velosta.com.

9. Marketing website and enquiries

On velosta.com and vendor.velosta.com, we use Google Analytics, Meta Pixel and Vercel Analytics to understand page visits, traffic sources and interactions with contact links. These services may process browser, device, network and online identifier information and use cookies or similar technology according to their settings.

The demo form prepares a message in your browser. It does not submit the form to a Velosta server. If you choose WhatsApp or email, the message is transferred to that service and you must send it there to contact us. We use information you send to respond to your enquiry and discuss the service. Our custom contact-intent events do not include the form's business name, city or message text.

For enabled product features, additional records can include verification results, handover photos or video, face-comparison information and connected-vehicle location or battery data. The data involved depends on the features your organisation enables. Contact support to discuss the processing and retention relevant to your account.