Privacy Policy

When you register or book a shipment, we collect your name, mobile number, and email address. Operators additionally provide government-issued ID details and bank account or UPI information for KYC verification and payout processing.

For each booking we collect: pickup and delivery addresses, declared parcel contents and category, weight and dimensions, number of parcels, any special handling instructions, and booking history. This data forms the operational record of your shipment.

Every transfer point in your shipment’s journey generates an immutable custody event comprising: a custody confirmation code, handoff timestamp, operator identifier, and up to two proof photographs (pickup confirmation and delivery confirmation). These records are append-only and form the audit trail for your shipment. They cannot be altered after creation.

We collect GPS location samples from operators (Last-Mile Partners) during active trip legs for corridor verification, custody confirmation, and safety purposes. Location data collection ceases upon completion of each trip leg. Customers are not tracked continuously at any point.

We record Razorpay order IDs, payment reference numbers, transaction amounts, and payment status for billing and dispute records. Card numbers, CVV codes, UPI handles, and bank account details are processed exclusively by Razorpay and are never transmitted to or stored by Patwadi.

Our mobile application may automatically collect: device model and operating system version, app version, crash reports and error logs, and session event data (screens visited, actions taken). This data is collected to diagnose technical issues and improve application performance. We do not use device data to build advertising profiles or share it with advertisers.

When you contact us via WhatsApp or email, we retain records of those communications to resolve your query and improve our support processes. If you initiate a WhatsApp conversation via a link in our app or website, the conversation is subject to WhatsApp’s own privacy policy in addition to ours.

To book, route, assign, and track parcels across our corridor network; to match shipments to available corridor partners; to generate booking confirmations and delivery receipts; and to calculate pricing based on route, weight, and parcel category.

To maintain an immutable chain of custody across multiple handoff points; to verify that parcels were transferred and delivered to the correct recipients; to investigate damage claims, mis-delivery reports, and support requests; and to provide audit evidence in disputes. Custody event records are relied upon as the authoritative record of shipment movement.

To detect and prevent fraudulent bookings, identity misuse, and abuse of the platform; to verify operator credentials and maintain network integrity; to block accounts that violate our Terms and Conditions; and to comply with our legal obligations to report certain activities to authorities.

To comply with applicable Indian law, including GST record-keeping obligations, income tax requirements, and any lawful orders or directions from government authorities, courts, or regulators. Where we are legally required to retain data beyond the periods described in our Data Retention section, we will do so.

To analyse aggregate and anonymised operational data (such as corridor performance, delivery success rates, and shipment volumes) to improve our network coverage, routing efficiency, and application features. This analysis uses data that has been stripped of personally identifiable information wherever possible.

To send booking confirmations, custody update notifications, delivery confirmations, and support responses via push notification, SMS, or WhatsApp. You may manage notification preferences in the app under Settings. Promotional communications are only sent with your explicit opt-in and can be withdrawn at any time.

We share personal data with the following providers to the extent required to deliver our services. Each provider is contractually bound to use data only as instructed and to maintain appropriate security:

• Supabase (US) — authentication, database, and file storage. User and parcel data is stored on Supabase infrastructure.
• Mapbox (US) — address search and geocoding for pickup and delivery locations.
• Razorpay (India) — payment processing. Razorpay processes payment credentials under its own PCI-DSS compliant environment.
• Expo / EAS (US) — mobile application build, distribution, and over-the-air updates.
• WhatsApp / Meta (US) — customer-initiated support conversations via WhatsApp links. We do not use the WhatsApp Business API to initiate messages.

Supabase, Mapbox, Expo/EAS, and WhatsApp/Meta are based in the United States. By using Patwadi services, you acknowledge that your personal data may be transferred to and processed in the United States and other jurisdictions where data protection standards may differ from Indian law. We take contractual and technical measures to ensure such transfers are protected to a standard equivalent to the requirements of Indian data protection law.

We may disclose personal data to government authorities, law enforcement agencies, or courts when: (a) required by a lawful court order, summons, or regulatory direction; (b) necessary to protect the rights, property, or safety of Patwadi, our users, or the public; or (c) required by applicable law. We will notify you of any such disclosure to the extent permitted by law.

In the event of a merger, acquisition, restructuring, sale of assets, or change of control affecting Patwadi, personal data held by us may be transferred to the acquiring or surviving entity as part of that transaction. We will notify you of any such transfer and of any material changes to how your data is handled as a result.

We may publish or share aggregated and anonymised data — such as corridor shipment volumes, average delivery times, or network coverage statistics — that cannot reasonably be used to identify any individual. This data may be shared with partners, investors, or in public communications without restriction.

Account deletion (via Settings → Delete account) permanently removes your profile, sign-in credentials, and active booking data from our systems. However, transaction records, custody events, and parcel records required for legal compliance under Indian tax law will be retained in anonymised form for the periods described above.

Account deletion is not available while you have a parcel actively in transit.

You may request confirmation of whether we hold personal data about you, a summary of the categories of data we hold, and the purposes for which that data is processed. We will respond within 30 days of a verified request.

You may request correction of inaccurate or incomplete personal data. You may also request erasure of data that is no longer necessary for the purpose for which it was collected, subject to our legal retention obligations and our need to maintain records for active service delivery. Custody event records, which are append-only, cannot be deleted as they form the legal audit trail of your shipment.

You have the right to have privacy-related grievances addressed promptly. Our Grievance Officer will acknowledge your complaint within 48 hours and endeavour to resolve it within 30 days. If you are not satisfied with the resolution, you may approach the Data Protection Board of India once constituted under the DPDP Act.

Under the DPDP Act, 2023, you may nominate another individual to exercise your data rights in the event of your death or incapacity. To register a nominee, contact our Grievance Officer with the nominee’s full name and contact details.

Where our processing is based on your consent (for example, marketing communications or promotional notifications), you may withdraw consent at any time via app Settings or by contacting us. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal, nor does it affect processing carried out for legal compliance or contractual performance.

Email our Grievance Officer at admin@patwadi.com with subject line “Data Rights Request” and include: your registered name and mobile number; the nature of your request (access, correction, erasure, nomination, or withdrawal of consent); and supporting documentation where relevant. We will verify your identity before processing any request.

Our website uses session cookies that are strictly necessary for basic page functionality. We do not use persistent tracking cookies, third-party advertising cookies, or cookies from social media platforms on patwadi.com.

You may configure your browser to block or delete cookies. Blocking strictly necessary cookies may affect the functionality of certain pages.

The Patwadi mobile application may automatically collect crash reports, error logs, and diagnostic data when the application encounters a technical failure. This data is used exclusively to identify and resolve bugs. It does not contain personally identifiable information and is not used for marketing or profiling purposes.

We do not use Google Analytics, Meta Pixel, Firebase Analytics, or any similar behavioural analytics or advertising technology on our website or in our mobile application. If this changes in the future, this Policy will be updated at least 7 days before such tools are activated, and registered users will be notified via in-app notice or email.

• All data is transmitted over HTTPS/TLS encryption between clients and our servers.
• Database access is controlled by Row-Level Security (RLS) policies — each authenticated user can access only their own records.
• Custody event records are append-only; no modification is permitted after creation by any user including administrators.
• Payment credentials are processed exclusively by Razorpay in a PCI-DSS compliant environment; Patwadi never receives or stores card or UPI details.
• Operator administrative access requires separately credentialed authentication from standard user access.

Access to production data is restricted to essential personnel on a strict need-to-know basis. Database credentials and API access tokens are not shared externally. Operator KYC documents are handled through a restricted onboarding process accessible only to authorised administrators.

In the event of a personal data breach that is reasonably likely to result in risk to the rights and freedoms of affected users, we will notify the relevant supervisory authority and affected users within the timeframe required by applicable law, and in any event as promptly as possible.

No system of data transmission or storage can be guaranteed to be 100% secure. We recommend that you use a strong, unique password for your Patwadi account, do not share your login credentials, and contact us immediately at admin@patwadi.com if you suspect unauthorised access.

Patwadi services are not directed at children under the age of 13. We do not knowingly collect personal data from children. If we become aware that personal data has been collected from a child under 13 without verifiable parental or guardian consent, we will take immediate steps to delete that data from our systems.

If you are a parent or guardian and believe we have inadvertently collected personal data relating to your child, please contact us at admin@patwadi.com.

We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, or data practices. When we make material changes, we will post the updated Policy on this page with a revised “Last updated” date and notify registered users via in-app notification or email at least 7 days before the changes take effect.

Your continued use of Patwadi services after the effective date of the revised Policy constitutes your acknowledgement of and agreement to the changes.

This Privacy Policy is governed by the laws of India. Any dispute arising from or in connection with this Policy, or from the use of Patwadi services, shall be subject to the exclusive jurisdiction of the competent courts at Chandigarh, Punjab, India.

Our application and website may contain links to third-party services including Razorpay’s payment interface, WhatsApp, and Mapbox. These services operate under their own privacy policies over which Patwadi has no control. Patwadi is not responsible for the data practices of third-party services.

Email admin@patwadi.com with subject line “Privacy Grievance” and include: your full name and registered mobile number; a description of the grievance and the data concerned; and the specific resolution you are requesting. We will verify your identity before processing the grievance.

If you are not satisfied with the resolution provided by our Grievance Officer, you may, once constituted, approach the Data Protection Board of India under Section 27 of the Digital Personal Data Protection Act, 2023. You may also approach the competent courts at Chandigarh, Punjab.