Privacy Policy

This Privacy Policy explains how CAR GRANTH Technologies Private Limited ("CAR GRANTH", "we", "us") processes personal data on cargranth.com and our related services. It is published under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000 and the rules made under them. By using our services you agree to the processing described here.

Data we collect

Information you give us

• Account details: name, email address, mobile number and a securely hashed password.

• Enquiries and bookings: the car you are interested in, preferred city, test-drive slot, message and callback preferences.

• Seller and dealer details: business name, GSTIN, address and listing information for accounts that sell on CAR GRANTH.

• Finance requests: the loan amount, tenure and basic income band you choose to share with a lending partner.

Information collected automatically

• Device and browser type, pages viewed and approximate location derived from your IP address.

• Essential cookies that keep you signed in and protect forms — see our Cookie Policy.

• A salted, one-way hash of your IP address on contact forms to prevent spam. We do not store the raw address with your enquiry.

Payment information

Booking amounts are processed by our payment partner Razorpay. Card, UPI and bank details are entered on Razorpay's secure checkout and are never stored on our servers. We receive only the payment reference and status.

How we use your data

Who we share it with

We share personal data only when it is needed for the service you requested:

• Dealers and sellers — when you enquire about, book or request a test drive for their vehicle.

• Lending and insurance partners — only when you ask for a loan or insurance quote.

• Service providers — hosting (our own servers in India), email delivery and payment processing, bound by confidentiality and data-processing terms.

• Authorities — when required by law, a court order or to protect the rights and safety of our users.

We do not sell, rent or trade your personal data to anyone for marketing.

How long we keep it

• Account data — while your account is active, and up to 90 days after you delete it.

• Enquiries and test-drive requests — up to 24 months, so we can resolve follow-ups and disputes.

• Payment and invoice records — 8 years, as required by tax laws.

• Security logs — up to 180 days.

Your rights

Under the DPDP Act you have the right to:

• Get a summary of the personal data we hold about you and how it is used.

• Correct, complete or update inaccurate data.

• Ask us to erase data we no longer need to keep.

• Withdraw consent at any time — this does not affect processing already done.

• Nominate another person to exercise your rights in case of death or incapacity.

• Raise a grievance with us and, if unresolved, with the Data Protection Board of India.

Email privacy@cargranth.com from your registered email address. We respond within 30 days.

How we protect it

• All traffic is encrypted with HTTPS.

• Passwords are stored only as strong one-way hashes.

• Access to customer data is limited to staff who need it and is logged.

• Uploaded documents and images are stored on our own servers, not on third-party file hosts.

No system is completely secure. If a breach affects your data, we will notify you and the Data Protection Board as the law requires.

Children

Our services are meant for people aged 18 and above. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

Changes to this policy

We may update this policy as our services or the law change. The "Last updated" date at the top shows the latest version. For material changes we will notify registered users by email before they take effect.

Contact and grievances

For privacy questions write to privacy@cargranth.com. For complaints, contact our Grievance Officer using the details at the end of this page. We acknowledge complaints within 24 hours and aim to resolve them within 15 days.