Privacy Policy

Effective date: 25 February 2026  |  Last updated: 18 September 2026

This Privacy Policy explains how Asli One Global Private Limited (“Zride”, “we”, “our”) — CIN U62011TN2026PTC190105, GSTIN 33ABFCA0187P1ZF, registered office at 309/3, Yasmin Nagar, Vedhanarayanapuram, Ozhalur, Tirukalikundram, Kanchipuram 603111, Tamil Nadu, India — collects, uses, shares and protects your personal data when you use the Zride passenger app, the Zride Partner (driver) app, the Zride Vendor app, the website zride.in and related services (the “Platform”).

Zride is the data fiduciary for this data. This Policy is our notice to you under section 5 of the Digital Personal Data Protection Act, 2023 (“DPDP Act”), and is also published under section 43A of the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 and Rule 3(1)(a) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. We have written it in plain English. If anything is unclear, write to support@zride.in.

1. What we collect and why

Each purpose below is the reason we ask for the data next to it. We do not use it for anything else without telling you first.

Government ID: drivers may provide any identity document the transport authority accepts. If Aadhaar is provided it is used only to verify identity, as the Aadhaar Act, 2016 permits, and is never used for any other purpose or shared for marketing.

2. How we use your data

• Match passengers with nearby drivers and complete rides and deliveries.
• Record and debit Zride's per-ride and daily platform fees, and process wallet top-ups through our RBI-authorised payment aggregator.
• Verify driver and vendor documents and identity during onboarding (KYC) and on renewal.
• Send in-app notifications (ride accepted, arrived, completed, receipts, document-expiry reminders) and email where needed.
• Provide safety features: SOS alerts, trip sharing, live tracking, two-way ratings.
• Deliver driver welfare benefits you opt into (education support, legal assistance, care calls).
• Detect and prevent fraud, abuse, safety breaches and money laundering.
• Comply with legal, regulatory and tax obligations (GST filings, MCA filings, transport-authority requests, lawful law-enforcement requests).

3. Consent and how to withdraw it

• When you sign up you are shown this Policy and asked to agree. Consent is asked for separately for location, notifications, emergency contacts and any optional programme.
• You can withdraw consent at any time, as easily as you gave it: from the app's Account / Profile settings, from your phone's permission settings, or by emailing support@zride.in. Withdrawal does not affect processing already done lawfully, and we may be unable to provide a service that depends on that data (for example, no location means no ride matching).
• If the Data Protection Board notifies Consent Managers under the DPDP Act, you will be able to give, manage and withdraw consent to Zride through a registered Consent Manager of your choice, and we will honour instructions received that way.

4. Who we share data with

We share personal data only in these cases, and only what is needed:

• The other party to your ride or order — the passenger's first name, pickup and drop points and a masked call/chat channel are shown to the driver; the driver's first name, photo, vehicle number and live location are shown to the passenger. Phone numbers are masked wherever the app supports it. Vendors see the delivery name, address and order.
• Payment processing — our RBI-authorised payment aggregator processes wallet top-ups and platform-fee mandates under PCI-DSS. It receives the data needed to process the payment and is bound by RBI regulations and its own privacy obligations under Indian law. The current processor's legal name is available on request from support@zride.in.
• Cloud hosting and messaging — Google Firebase (Firestore, Authentication, Storage, Cloud Functions, Cloud Messaging, Crashlytics) operated by Google LLC, with our primary data region in asia-south1 (Mumbai). Google Maps Platform is used for maps and routing.
• Identity and vehicle verification — a licensed KYC / vehicle-registry verification service receives the vehicle number or ID details a driver submits, to confirm them against government records.
• Government and law enforcement — the transport authority, police or a court, in response to a valid legal demand or where the Motor Vehicle Aggregator Guidelines require it (for example after an SOS or accident).
• Corporate events — a successor in a merger, acquisition or asset sale, who must honour this Policy.

Every processor works under a written contract that limits it to our instructions and requires reasonable security safeguards, as section 8 of the DPDP Act requires.

5. Where your data is stored and cross-border transfer

Our primary storage region is Mumbai, India (asia-south1). Limited data (crash diagnostics, push delivery, map tiles) may transit Google's global infrastructure. We do not transfer personal data to any country the Central Government has restricted under section 16 of the DPDP Act.

6. How long we keep data

7. How we protect your data

• All data in transit is encrypted (TLS 1.2 or higher). Data at rest is encrypted with AES-256.
• Access inside Zride is role-based, limited to staff with a specific need, and logged.
• Payment credentials (full card / UPI PIN) are never handled by Zride servers.
• We run regular security reviews of the apps, rules and cloud configuration.

If a breach happens: we will inform the Data Protection Board of India and every affected user without delay, in the form and time the DPDP Rules prescribe, describing what happened, the likely impact and what you can do. We also report cyber incidents to CERT-In within the time its directions require.

8. Your rights

Under the DPDP Act you have the right to:

• Access — a summary of the personal data we hold about you, how we use it, and who we have shared it with.
• Correction and updating — fix inaccurate or incomplete data. Most fields can be edited in the app.
• Erasure — delete your account and personal data (see our Delete your account page). We keep only what the law obliges us to keep, as listed in section 6.
• Withdraw consent — at any time, as described in section 3.
• Grievance redressal — raise a complaint with us (section 10) and, if not satisfied, with the Data Protection Board of India.
• Nominate — name a person who may exercise these rights for you if you die or become incapacitated. Send the nominee's name and mobile number to support@zride.in from your registered email or number.

To use any of these rights, use the in-app Help & Support section or email support@zride.in from your registered email, or WhatsApp +91 81109 08008 from your registered number. We verify that it is you and respond within 15 days. There is no fee. You must not impersonate another person or make false claims when exercising these rights.

9. Children

Zride is for persons aged 18 and above. We do not knowingly collect personal data from anyone under 18, and we do not track children or show them targeted advertising. If we learn that an account belongs to a child, we delete it and the associated data. A parent or guardian who believes a child has used Zride should write to support@zride.in.

10. Grievance Officer and Data Protection contact

Our Grievance Officer, appointed under Rule 3(2) of the IT Rules, 2021 and Rule 4(4) of the Consumer Protection (E-Commerce) Rules, 2020, is also the person who answers your questions and requests about personal data under section 8(9) of the DPDP Act.

If you are not satisfied with our response, you may complain to the Data Protection Board of India under section 13 of the DPDP Act, after first giving us the opportunity to resolve the matter. For consumer complaints you may also approach the District Consumer Disputes Redressal Commission.

11. Cookies and website analytics

The zride.in website uses only the cookies needed for the language selector and basic, aggregated visitor statistics. No advertising cookies are set on the website.

12. Changes to this Policy

We may update this Policy from time to time. The “Last updated” date at the top shows the current version. Material changes are notified by in-app notice and/or email before they take effect, and we remind you of this Policy at least once a year. Continued use of the Platform after a change means you accept the revised Policy.