Privacy Policy

Last updated: 1 August 2026

Abhay Kumar Shukla, sole proprietor, trading as Roundrop (“Roundrop”, “we”, “us”) operates the Roundrop mobile app and the roundrop.in website (together, the “Service”). This policy explains what personal data we collect, why, and the choices you have. It applies to both the website and the Roundrop app — they are the same business and, where the app is not yet public, this describes the data practices it is built to follow.

We process personal data under India’s Digital Personal Data Protection Act, 2023 (DPDP Act). Where this policy refers to your rights as a “Data Principal” or to us as the “Data Fiduciary,” those are the terms the DPDP Act uses.

1. What we collect

Account & identity

Phone number (your primary credential — verified by OTP)
Name, preferred language, profile photo
Email address (optional)
Aadhaar: we verify your identity via DigiLocker’s consent flow and store only the last 4 digits of your Aadhaar number plus a yes/no name-match result — never your full Aadhaar number. This is a deliberate DPDP-Act-driven data minimisation choice, not a technical limitation.

KYC and verification documents

Depending on whether you use Roundrop as a shipper or a driver:

Driver’s licence, vehicle registration certificate (RC), truck photographs, PAN (optional)
GSTIN and business details (shippers who book as a business)
A selfie, used to match against your government ID
Bank account details, verified via penny-drop or Razorpay Fund Account Validation before your first payout (drivers only)

KYC documents are stored with our storage provider, Cloudinary, access-controlled, and used only for verification and fraud prevention.

Location data

The Roundrop app collects GPS location while you have an active trip or booking — this is how we show shippers real-time truck position, confirm pickup/delivery proximity, and detect off-route deviations. Location is sent roughly every 60 seconds in transit (every 30 seconds in the final approach to delivery), and paused automatically when the vehicle is stationary for more than 10 minutes.

[REVIEW]Confirm the exact Android/iOS background-location permission strings and whether location is ever collected outside an active trip (e.g. to suggest nearby journeys) before this ships — as specified today, the backend only records location tied to a booking, not standing background tracking.

Cargo & booking details

Pickup/dropoff addresses, cargo description, declared value
E-way bill numbers, where applicable under GST rules for interstate or high-value shipments
Chat messages exchanged within a booking
Ratings and reviews you give or receive

Automatically collected

Device identifiers and push-notification tokens
App version, crash and error logs
Search activity (routes searched, results shown)

2. Why we collect it

To verify your identity and prevent fraud (KYC)
To match drivers with shippers along a route and price a booking
To let shippers track their cargo and confirm safe pickup/delivery
To process payments and hold them in escrow until delivery
To send booking updates via app push, WhatsApp, or SMS
To investigate disputes, no-shows, and safety incidents
To meet legal obligations (GST/e-way bill, KYC record-keeping)

3. Who we share it with

We share data only where the Service requires it:

Payments: Razorpay (payment processing and escrow); your bank account details are shared only for payout verification
Identity verification: our KYC aggregator and DigiLocker, to verify Aadhaar/DL/RC documents
Maps & routing: Google Maps Platform, for route calculation and geocoding
Messaging: WhatsApp Business Platform (Meta), for booking notifications you opt into
Storage: Cloudinary, for KYC documents and truck photos
The other party to your booking:a driver and shipper in a confirmed booking see each other’s first name, rating, and (once confirmed) phone number — never full profile or ID documents
Law enforcement or regulators, where legally required

We do not sell personal data.

4. How long we keep it

Booking chat becomes read-only once a trip is complete and remains visible for a limited window afterward before archival.
Ratings are held from public view until both parties submit theirs, or automatically after 14 days, whichever comes first.
KYC documents and booking records are retained for as long as needed for dispute resolution, fraud prevention, and statutory record-keeping (e.g. GST/e-way bill obligations).

[REVIEW]Exact retention periods for KYC documents, GPS trails, and audit logs after account closure need a defined data-retention schedule — placeholder policy here says “as long as necessary,” which should be replaced with specific durations before this is relied on for a compliance review.

5. Your rights

Under the DPDP Act, you can:

Ask us what personal data we hold about you
Correct inaccurate or incomplete data
Withdraw consent for optional processing (e.g. WhatsApp opt-in)
Request erasure of your data, subject to our legal obligation to retain certain records (KYC, payment, and tax records)
Nominate another person to exercise these rights on your behalf

To exercise any of these, contact us at hello@roundrop.in.

6. Grievance officer

[REVIEW]The DPDP Act requires a named Grievance Officer with contact details published here. Provide a name and dedicated contact before this policy is treated as final — currently routed through the general contact address below.

Until a dedicated grievance officer is appointed, direct privacy concerns to hello@roundrop.in.

7. Security

We use industry-standard measures to protect your data, including encrypted transport (HTTPS), access-controlled storage for KYC documents, and server-side verification of all payments. No system is perfectly secure, and we encourage you to report any concerns to us immediately.

8. Children

Roundrop is not directed at anyone under 18. We do not knowingly collect data from minors.

9. Changes to this policy

We’ll update this page if our data practices change and post the new “last updated” date above. Material changes will be notified in-app.

10. Contact

Questions about this policy: hello@roundrop.in.