Privacy Policy.

This policy explains how Tripkoz Technologies ("Tripkoz", "we", "us") collects, uses, shares and protects personal data when you use the Tripkoz platform — the web dashboard, the driver and guardian mobile apps, and related services.

It applies to everyone whose data passes through the platform:

• Administrators and staff at a school, college, company or fleet operator;
• Drivers, whether employed by an organisation or operating independently;
• Guardians — parents and other authorised contacts;
• Passengers, including children transported on school and college routes;
• Visitors to this website.

Where an organisation (a school, college, company or fleet operator) uses Tripkoz to manage its transport, that organisation decides what data is collected about its passengers and staff, and we process that data on its instructions. In those cases the organisation is the Data Fiduciary and Tripkoz is a Data Processor. For our own website visitors and for independent drivers who sign up directly, Tripkoz acts as the Data Fiduciary.

Account and identity data:

• Name, phone number, email address and user role;
• Password hashes and authentication audit records (sign-in timestamp and IP address);
• Profile photographs, where uploaded by the user.

Passenger data, supplied by the organisation or a guardian:

• Passenger name, class or department, and optional identification photo;
• Pickup and drop-off points, and the routes a passenger is assigned to;
• Boarding, drop-off and absence status records for each trip;
• Linked guardian contact details and relationship.

Driver and vehicle data:

• Driving licence number, identity details, and document expiry dates;
• Vehicle registration number, vehicle type, seating capacity, and insurance details;
• Pre-trip safety checklist results, odometer logs, and incident reports.

Location data:

• The live GPS position of a vehicle recorded exclusively while an authorized trip is in progress;
• The route travelled, stop arrival times, and departure timestamps.

Billing and transaction data:

• Subscription plan, billing cycle, invoice history, and payment status;
• Payment identifiers returned by Razorpay (order IDs, payment IDs). Full card numbers, UPI PINs and net-banking credentials are never handled or stored on our servers.

A substantial part of the platform exists to keep children safe on the way to and from school. We treat children’s personal data as the most sensitive category we handle.

• A child’s data is only ever created inside an organisation’s account, by that organisation or by a linked guardian — a child cannot register on Tripkoz directly;
• Verifiable parental or guardian consent is obtained by the organisation before a child is added to the platform, in line with Section 9 of the Digital Personal Data Protection Act 2023;
• A child’s live location is visible only to their linked guardians, the driver operating that trip, and authorised administrators of the organisation;
• We do not use children’s data for advertising, behavioural profiling or commercial tracking of any kind, and we never sell personal data;
• We do not process a child’s data for any purpose beyond operating, navigating and safeguarding their daily transit.

Location is essential for child safety and transit transparency, so it is governed by strict safeguards:

• A vehicle’s GPS position is recorded only while a driver has an active trip running in the foreground. Starting a trip begins location streaming; completing or stopping the trip terminates reporting immediately;
• Location is tied to the vehicle and the assigned trip, never to a driver’s personal movements outside active trips;
• Guardians see the vehicle carrying their own passenger, and only for the active duration of that journey;
• Historical trip routes are retained securely for safety reviews, complaint resolution, and audit compliance.

We process personal data only for the explicit purposes below:

• To operate transport — planning routes and stops, assigning drivers and vehicles, and running trips;
• To keep guardians informed with real-time ETA countdowns and arrival alerts;
• To verify driver qualifications, vehicle roadworthiness, and safety checklists;
• To provide 1-tap emergency SOS alarm dispatch during active transit incidents;
• To process SaaS subscription billing and generate tax-compliant invoices;
• To comply with applicable transport, education, and child safety laws.

We never sell your personal data. We share data only with verified sub-processors necessary to run the service:

• Cloud Infrastructure: Supabase and Fly.io (AWS Singapore region) for encrypted database and application hosting;
• Payment Processing: Razorpay Software Private Limited for secure PCI-DSS compliant checkout and subscription billing;
• Push Notifications & Alerts: Firebase Cloud Messaging (Google) for real-time pickup and emergency notifications;
• Maps & Routing: Google Maps Platform for tile rendering, map display, and geocoding.

We retain personal data only for as long as necessary to provide the services or fulfill legal obligations.

• Active Account Data: Retained for the lifetime of your account or subscription;
• Trip & GPS History: Stored for 90 days for safety records, after which granular GPS points are purged;
• Financial & Invoice Records: Retained in accordance with Indian tax and statutory retention mandates (7 years);
• Account Deletion: Users can delete their account at any time directly in the mobile app (Settings → Delete Account) or by emailing privacy@tripkoz.com. Upon request, personal identifiers are permanently deleted or anonymized within 30 days.

We implement industry-standard administrative, physical, and technical safeguards:

• All network communication is strictly encrypted in transit using TLS 1.3 / HTTPS;
• Mobile authentication tokens and session credentials are encrypted on-device via Android Keystore and EncryptedSharedPreferences (AES-256 GCM);
• Role-based access control (RBAC) and multi-tenant database isolation prevent unauthorized cross-organization data access;
• Regular vulnerability monitoring, automated dependency audits, and secure backups.

Under the Digital Personal Data Protection Act 2023, you have the right to:

• Access a summary of personal data being processed about you;
• Request correction, updating, or completion of inaccurate data;
• Request erasure of personal data that is no longer necessary for the purpose it was collected;
• Nominate an individual to exercise your rights in the event of death or incapacity;
• Lodge a grievance with our Grievance Officer regarding the processing of your personal data.

If you have any questions, concerns, or requests regarding this Privacy Policy or data protection, you may contact our Grievance Officer:

• Name: Grievance Officer — Tripkoz Technologies
• Email: grievance@tripkoz.com (and copy privacy@tripkoz.com)
• Jurisdiction: Ahmedabad, Gujarat, India
• Response Time: We acknowledge all grievance complaints within 24 hours and resolve them within 15 working days.