Legal

Privacy Policy

Effective date: 1 September 2025  ·  Last updated: 20 September 2026

Plain English summary: Grid collects the minimum data needed to match riders with drivers and process payments. We do not sell your personal data. You can request deletion of your account at any time by writing to privacy@nona.cbsemaster.in.

1. Who we are

Grid Technologies Private Limited ("Grid", "we", "our") operates the Grid ride-hailing platform — mobile apps for riders and drivers, and this website. We are a Data Fiduciary under the Digital Personal Data Protection Act, 2023 (DPDP Act).

Registered address: Grid Technologies Private Limited, Koramangala, Bengaluru, Karnataka 560034, India.

Data Protection contact: privacy@nona.cbsemaster.in

2. Data we collect and why

2.1 Account data

  • Email address — to create your account, verify identity, and send trip receipts.
  • Password (hashed) — to authenticate sign-in. We never store your password in plain text.
  • Role — rider or driver, so we route you to the right experience.

2.2 Driver identity documents

  • Driving licence, vehicle registration, insurance certificate, and identity proof — collected from drivers only, stored encrypted, and reviewed by authorised operators for regulatory compliance.

2.3 Location data

  • Rider: pickup and drop-off coordinates, collected at booking time only. We do not track your location between trips.
  • Driver: live GPS position while the app is active, used for dispatch and routing. Location history is retained for 90 days for dispute resolution, then deleted.

2.4 Trip data

  • Origin, destination, fare, vehicle class, surge multiplier, and trip status — used for billing, support, and city-level analytics (aggregated, not personal).

2.5 Payment data

  • Transaction amounts and references. Grid does not store full card or bank account numbers; payment processing is handled by a PCI-DSS-compliant gateway.

2.6 Device and session data

  • IP address and user-agent string, stored with each authenticated session to detect suspicious sign-ins and satisfy legal audit requirements.

3. Legal bases for processing

We process personal data on the following bases:

  • Contract performance — processing necessary to provide the trip you booked or the driver account you registered.
  • Legal obligation — document verification required by the Motor Vehicles Act, 1988 and applicable state transport rules.
  • Legitimate interests — safety, fraud prevention, dispute resolution, and platform security — balanced against your privacy rights.
  • Consent — for optional features, where we ask separately.

4. How we share your data

We share personal data only as described below. We do not sell it.

  • With your matched driver or rider: first name and live location are shared during a trip only, and removed from both parties' views once the trip ends.
  • With payment processors: trip amount and your payment token, to complete the transaction.
  • With cloud infrastructure providers: AWS and Hetzner host our servers under data processing agreements.
  • With law enforcement: when required by a valid court order or statutory authority under Indian law.

5. Retention

  • Account data: for the life of your account, plus 3 years after deletion for legal audit purposes.
  • Driver documents: for the life of the driver account, plus 5 years after closure (regulatory requirement).
  • Driver location history: 90 days, then permanently deleted.
  • Trip records: 7 years (GST and tax compliance).
  • Session logs: 90 days.

6. Your rights under the DPDP Act, 2023

As a Data Principal you have the right to:

  • Access — obtain a summary of the personal data we hold about you and the purposes for which it is processed.
  • Correction — ask us to correct inaccurate or incomplete data.
  • Erasure — request deletion of your data, subject to legal retention obligations. Deleting your account removes your email and profile; anonymised trip statistics may be retained.
  • Grievance redressal — raise a complaint with our Grievance Officer (below). If unresolved within 30 days, you may escalate to the Data Protection Board of India once established.
  • Nomination — nominate another person to exercise your rights in the event of death or incapacity.

To exercise any right, write to privacy@nona.cbsemaster.in with your registered email address. We respond within 30 days.

7. Security

  • Passwords are hashed with Argon2id (OWASP-recommended parameters).
  • Driver identity documents are encrypted at rest with AES-256-GCM before storage.
  • All data in transit uses TLS 1.2 or later.
  • Access to personal data is restricted by role — operator staff can only see data relevant to their city.
  • Two-factor authentication (TOTP) is required for all operator and staff accounts.

8. Cookies and analytics

This website uses only strictly necessary session cookies. We do not use advertising or behavioural tracking cookies. The rider and driver apps do not embed third-party analytics SDKs.

9. Children's privacy

Grid is not intended for users under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has registered, contact us and we will delete the account promptly.

10. Changes to this policy

We will notify registered users by email at least 14 days before any material change takes effect. Continued use of Grid after that date constitutes acceptance of the updated policy.

11. Grievance Officer

Name: Grievance Officer, Grid Technologies Private Limited
Email: grievance@nona.cbsemaster.in
Address: Grid Technologies Private Limited, Koramangala, Bengaluru, Karnataka 560034
Response time: within 30 days of receipt