Privacy policy

This policy is issued by Washing Daddy Private Limited, the data fiduciary for the personal data described below, under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Information Technology Act, 2000. It applies to our website, our customer app, our pilot app and the Service described in our Terms.

1. What we collect

We do not collect Aadhaar, PAN or other identity documents from customers. We collect them from our pilots, as employees, for police verification and statutory registrations; that processing is covered by our employee privacy notice.

Our website sets no analytics or advertising cookies and loads no third-party scripts. The website forms send only what you type into them.

2. Consent

We process your personal data on the basis of your consent, given when you sign up and, separately, when you add a vehicle and agree to photographs of it and to location capture during service. The notice you see at that point is this policy. You can withdraw consent at any time (clause 7). Withdrawing consent for photographs or location means we can no longer provide the Service for that vehicle, because proof of service is the Service, and we will cancel the plan under the Refund Policy.

We also process data where the law requires it (tax records, responding to lawful requests) and for the legitimate uses the DPDP Act allows, such as preventing fraud and protecting the safety of our pilots.

3. Who sees your data

We do not sell personal data. We do not share it with advertisers. We share it only with:

• Our pilots and supervisors, who see your name, the vehicle, the parking location and any wash notes for the cars on their route, and a masked version of your phone number.
• A payment gateway, which receives your name, phone number and the amount in order to process payments, mandates and refunds. It handles your card, UPI or bank details under its own privacy policy and regulatory obligations.
• A messaging provider, which receives your phone number and the content of the messages we send you (OTPs, wash-complete notifications with photographs, renewal reminders).
• Cloud hosting in India, where our systems and your photographs are stored. Photographs are stored on infrastructure we control and are not passed to any third-party analytics service.
• Your society’s RWA or facility manager, who receives a monthly report showing vehicles served by registration number and bay, litres used and exceptions. The report does not include your phone number or photographs.
• Insurers, repairers and legal advisers, only for a damage claim you raise, and only the data needed for that claim.
• Authorities, where the law requires us to.

Each processor acts on our written instructions and is contractually bound to protect your data and to use it only for the purpose we engage it for. We remain responsible to you for their processing.

4. How long we keep it

• Wash photographs (before, after, exception): 90 days from the wash, then deleted.
• Baseline photographs: for as long as the vehicle is on an active plan, plus 90 days.
• Damage-claim images and records: for the life of the claim and any resulting dispute, then 90 days.
• Wash records without photographs (pilot, time, litres, services): for the life of your account plus 12 months, for service history and disputes.
• Precise location points: 90 days; after that only the society and bay you registered.
• Account, vehicle and parking details: while your account is active, then 12 months, unless you ask for earlier deletion.
• Invoices, payment and refund records: as long as tax and company law require, currently up to 8 years.
• Waitlist and enquiry form submissions: 12 months, or until we launch in your society and you decide whether to subscribe.

When a retention period ends, data is deleted or anonymised so that it no longer identifies you or your vehicle.

5. Security

Data is encrypted in transit and at rest. Access inside the company is role-based and logged. Pilot devices hold only the day’s route and sync it to our servers; photographs are removed from the device after upload. We keep encrypted backups and test that we can restore them. If a breach affects your personal data, we will notify you and the Data Protection Board of India as the DPDP Act requires.

6. Children

The Service is for adults. We do not knowingly collect personal data from anyone under 18.

7. Your rights and how to use them

Under the DPDP Act you may:

• Access a summary of the personal data we hold about you and how we have used it.
• Correct anything inaccurate or out of date. Most of it you can edit in the app.
• Erase your personal data, subject to records we must keep by law (clause 4).
• Withdraw consent at any time, with the consequences described in clause 2.
• Nominate another person to exercise these rights for you if you are unable to.
• Complain to our Grievance Officer and, if unresolved, to the Data Protection Board of India.

Deletion requests. Use Account → Delete my data in the app, or email [email protected] from the number or email on your account with the subject “Delete my data”. We confirm your identity by OTP to the account number, cancel any active plan under the Refund Policy, and complete deletion within 30 days, telling you when it is done and what, if anything, we must keep and why.

Grievance Officer: [Grievance Officer name — to be confirmed], [grievance email — to be confirmed], [Registered address — to be confirmed]. We acknowledge requests within 48 hours and respond within 30 days.

8. Where your data is processed

Your data is stored and processed in India. If a processor we use stores data outside India, we will only allow it where the DPDP Act and the rules under it permit, and we will update this policy to say so.

9. Changes to this policy

We will tell you in the app and by message before a material change takes effect, and ask for fresh consent where the law requires it. The date at the top of this page is the date of the current version.