PoolTransit — Privacy Policy
Effective date: on and from the date this policy is first published. Data Fiduciary: Prem S. Pal, an individual (sole operator), India. Contact / Grievance Officer: Prem S. Pal — [email protected].
PoolTransit ("we", "us") helps employees of whitelisted companies share commute rides between fixed stops ("hubs"). This policy explains what personal data we collect, why, how we share it, how long we keep it, and your rights.
The service is for adults (18+) who are employees of onboarded companies. It is not directed at children.
1. Data we collect
| Data | Why (purpose) |
|---|---|
| Corporate email address | Passwordless sign-in (one-time code) and to verify you belong to an onboarded company. |
| First name (and last name if you enter it) | Shown as first name only to a co-rider after you match, so you can recognise each other. |
| Gender (optional) | Only if you opt into same-gender matching. |
| Phone number (optional) | Optional contact detail you may add to your profile. |
| UPI ID (optional) | Shown to co-riders only when you use the optional fare-split feature, so they can pay you. We never process or hold money. |
| City & default hubs (optional) | Scope the stop list and pre-fill your trips. |
| Trip data — chosen hubs, bookings, matches, chat messages, fare splits | To match you with a co-rider and let you coordinate the ride. |
| Approximate device location (only when you tap "Use my location") | Computed on your device to suggest the nearest stop. We do not store your location or track your ride. |
| Device push token | To send you ride notifications (via Firebase Cloud Messaging). |
| Diagnostic / product-usage events and any feedback you send | To keep the service working, safe, and improving. |
We practise data minimisation — we collect only what the features above need.
2. What we do NOT do
- We do not hold, process, or transfer money. Fare splitting only calculates a share and hands off to your own UPI app.
- We do not track your live location or the ride itself.
- We do not sell your personal data or use it for third-party advertising.
3. Legal basis (DPDP)
We process your data on the basis of your consent, given when you sign up and use each feature, and for the legitimate purpose of providing the ride-sharing service you request. You may withdraw consent at any time (see Your rights).
4. How your data is shared
- With your co-rider (after a confirmed match): your first name and profile photo/initials only — never your email, phone, or last name. If you use fare split, your UPI ID is shown to co-riders in that ride.
- Processors who host the service on our behalf (bound to protect your data and use it only for us): Supabase (Postgres database, authentication, and backend — core data hosted in the ap-south-1 / Mumbai, India region), Postmark (delivery of your one-time login-code emails), and Firebase Cloud Messaging by Google (push notifications). Map imagery is served by OpenStreetMap (or the configured tile provider).
- Legal: we may disclose data where required by law or to protect safety.
Your core account and ride data are hosted in India (Mumbai). Some processors (Postmark for login emails, Firebase for push) may process limited data outside India; DPDP permits such transfers except to any country the Government of India restricts.
5. How long we keep it
- Chat messages are limited to a 24-hour conversation window per ride.
- Profile and account data are kept while your account is active.
- When you delete your account, we erase your personal data promptly and irreversibly (see Your rights). Aggregate/de-identified product analytics that no longer identify you may be retained.
6. Your rights (DPDP)
You can, at any time:
- Access the personal data we hold about you (via your profile / on request).
- Correct or update your data (edit your profile).
- Delete your account and all associated data — in the app at
Profile → Delete my account, or by requesting deletion at
https://pooltransit.com/delete-account. Deletion is immediate, permanent, and cannot be undone. - Withdraw consent (deleting your account withdraws consent and stops processing).
- Nominate an individual to exercise your rights in the event of death or incapacity (contact us).
- Raise a grievance with our Grievance Officer (above). We will respond within the timeframe required by law. You may also complain to the Data Protection Board of India.
7. Security
We use industry-standard measures (encrypted transport, row-level access controls, restricted backend access). No system is perfectly secure; in the event of a personal-data breach we will notify the Data Protection Board and affected users as required by DPDP.
8. Changes
We may update this policy; we will post the new effective date here and, for material changes, notify you in-app.
9. Contact
Prem S. Pal (sole operator) — Grievance Officer: Prem S. Pal, [email protected].