The house, in plain words
Privacy
What Truckaurbus holds about you, why, who sees it, the services we use, where it is kept, for how long, and how to use your rights. Written to be read, not skimmed past.
- 01
Who we are
Truckandbus Technologies Private Limited (CIN U63120KA2026PTC227607), 10th Floor, WeWork Latitude, RMZ Latitude Commercial, Hebbal Kempapura, Bangalore 560024, Karnataka, India, runs truckaurbus.com and every desk on it (business, partners, fleet, yard, creators, edge, support, verify and the sign-in pages), the Truckaurbus, Truckaurbus Business, Nazar Driver and Nazar Driver Lite apps, and Ustad on WhatsApp and Telegram. Under the Digital Personal Data Protection Act, 2023 we decide what happens to the personal data you give us, and we answer for it. Write to privacy@truckaurbus.com. Our Grievance Officer, Joydip Mitra, hears complaints at grievance@truckaurbus.com and by post at the address above; we acknowledge a complaint within 24 hours and resolve it within 7 days.
- 02
What we hold, and why
Your account: your phone number or email, the name you give, your language, when you confirmed you are eighteen or older, and, if you sign in with Google, your Google account's id and email; we use them to sign you in and to reach you about what you asked for. Each sign-in: the time, the address your device connected from and your browser or phone model, kept to protect your account. On the site and in the apps: the PIN code you set for nearby results, the vehicles you save, compare and recently viewed, the listings, questions, answers and photos you post, your enquiries and your finance, insurance or quote requests with the replies, a random id for your device or app, and the token that lets us send you notifications. The yard: your institution's membership, your bids, the agreements you accepted with the time and the address, your bidder checks (see Verification), the EMD transfers you report (the bank's reference, the amount, the day and the receipt) with the seller's answer, any report or flag about how you took part in auctions, with its evidence (from a seller, a yard's day host, another bidder or our own checks), any strike notice on your account with your contest, our decision and any lift or correction, your record as a buyer built from these (its mark: Clean, New, Strike or Notice open), the record of any bidding account of yours closed for fraud, the people you name for an inspection, and the settled records. To find bidding accounts opened in other people's names, we compare the phones, devices and bank accounts used across bidding accounts with different PANs; a match is a flag for a person at Truckaurbus to read, never a strike by itself. The fleet desk: your fleet's name and district, its vehicles by registration number, the drivers and staff you add with their names, roles and phone numbers, the papers you upload, fuel fills, the results of the VAHAN checks you run, the campaigns and statements. The business and partner desks: the business you claim, its papers and people, its stock, prices and offers, the enquiries and requests it receives, the calls made through our number (the caller's number and the time, never the call itself) and its bills. Billing: your organisation's balance, top-ups, bank references, the proofs of payment you attach, the terms your organisation agreed to with who agreed and when, and the numbered documents we issue. Nazar and Nazar Driver: a paired phone's position about every 2 minutes on Nazar Pro and about every 10 minutes on the free plan (while we charge nothing, every fleet gets Nazar Pro's pace), with its speed, heading, height, accuracy, battery and charging state; the phone's motion sensor readings while the vehicle moves (a summary a minute, short raw accelerometer and gyroscope clips around hard braking or sharp turns, and short raw accelerometer windows), kept to build models that make Nazar better (never audio or video); the driver's pauses; the rolling Bluetooth identifiers a phone heard (Nazar Driver Lite); an SOS with its position; the driver's name and number; the phone's model, system and app version; the trips, stops and jobs built from them; the availability cards and offers an owner publishes; and the seal of each day's record (never the positions themselves). Ustad: your conversations. Our WhatsApp and Telegram numbers: what you write to them, with your number on WhatsApp and your display name on Telegram; for a photo, a document or a voice note, only that you sent one, except a business's message that starts with STOCK, whose photos and files are kept for that business's stock; for a location you share, only the PIN code, district and state it falls in; for a contact card, only that you sent one, never the names or numbers on it. Writing to us there for the first time opens a Truckaurbus account on that number. Send STOP and Ustad does not reply to that number for 30 days (nothing is deleted); send DELETE MY CHAT and your conversation with Ustad is erased. Our mailing lists: the email you subscribed with and its language.
Figures you enter on our tools. When you change a figure on a vehicle's cost sheet, such as your freight rate, diesel price, kilometres or driver's pay, we keep the figures you entered with the vehicle, the kind of work you chose, the state and the date, and a random number that lasts only for that visit. We do not keep your name, account, phone number or address with them. We use them only added together with others, to improve our estimates, and we never show one person's figures to anyone.
- 03
What we use it for
To sign you in and keep your account safe. To show listings, prices and answers, and to keep the alerts you asked for. To send an enquiry, a finance or insurance request or a quote request to the businesses that can answer it (see Who sees what). To run the yard, the fleet desk and Nazar for the people who use them. To give better advice to everyone: unnamed figures from many fleets or businesses are pooled, and others see them only as a band from at least 5, never a name, a registration, a place or one account's figures. To check that people, businesses and vehicles are who and what they say (see Verification). To bill businesses for what they buy. To stop fraud, spam and abuse, including automatic checks of what is posted before it appears. To count visits and fix crashes. To send the weekly report, after a person at our desk approves it. For research, as set out below. If you say yes to finance news for the lots you bid on, we keep that yes with its words and time, and write to you about finance for those lots until you stop it on the lot page.
- 04
Who sees what
When you send an enquiry or a request, the business you sent it to sees it. When you send an enquiry, "Share what I looked at" is ticked unless you untick it. If it stays ticked, the business you asked receives the vehicles you opened on Truckaurbus and what you told us in that form, for that enquiry only. You can stop it any time from Your enquiries. A finance or insurance request goes to the lenders or insurers that serve your area, with your vehicle and your verified name if you have one; your number is shown to a business only when it accepts your request, and some businesses pay us a fee when they accept one. If a lender on Truckaurbus makes you an offer on your finance request and you say yes to sellers seeing it, sellers whose lots you bid on see "Finance ready" beside your bid. They never see the amount, the lender or its terms. Listings show what you publish; your number stays masked until you choose to share it. The Circle shows your name on your questions and answers, never your number. When you book a yard visit, the yard's host sees your verified name and your slot. A seller deciding on your bid sees, beside it, the mark of your record as a buyer on Truckaurbus (Clean, New, Strike or Notice open), and the yard sees the same mark beside your name on a visit you booked; neither sees the sellers, lots or prices behind it, or the details of your checks. Your record is never public; you can see all of it, and ask us to correct it, on your account. A strike notice to you names the record relied on. If you report someone, we tell you that your report was received and whether we acted on it, never what we decided about the other person. Where a strike needs it, we may tell the seller concerned who you are, only as far as necessary (bidding agreement, clause 3.4). Once the seller confirms your win, it sees your name as on your PAN, your phone and the last four characters of your PAN (bidding for a firm, also the firm's name and GSTIN), to arrange payment and handover, and each look is recorded on the seller's own log. While the bidding is on, the seller never sees who you are. Nazar positions are seen by the fleet's owner and the people the owner gives keys to, and not by other fleets, insurers or lenders unless the owner hands them a record. A mechanic or a shop who is read the driver's proof code sees that vehicle's position and can reach the owner only while the owner's providers switch is on (it is on until the owner turns it off). The public owner profile shows only what the owner turns on. Truckaurbus staff see what they need to run the desks, check what is posted and answer you; their tools sit behind a second sign-in. The register's counts and the wire are public and carry no personal data.
- 05
Photographs
Before a photo you post appears on Truckaurbus, we remove the camera's location from the file. If a photo shows a number plate or a face you want taken off, tell us and we will remove it.
- 06
The services we use
We run Truckaurbus on systems we manage and secure. Other companies do specific jobs for us, each with only what that job needs.
A network provider carries every visit to the site and the apps, including the positions Nazar Driver and Nazar Driver Lite send, protects them from attacks (it may set its own security cookies) and checks forms against robots. A storage provider keeps your photos and the documents you upload. Messaging providers send our sign-in codes by SMS and our emails, and hold our own mailboxes, privacy@ among them; your phone's own notification service delivers our notifications. When you message us on WhatsApp or Telegram, WhatsApp or Telegram carries those messages, including Ustad's replies and the alerts and enquiries you asked for. When you sign in with Google, Google signs you in. Google Analytics counts visits on the site (unless you turn it off in Cookie settings) and screens in the apps.
AI services write Ustad's answers, check listings, questions, answers, comments and adverts before they appear, sort messages sent to our support desk, and read photos you upload to price a vehicle; what reaches them is your question, the conversation so far and the register's facts, your number and name when you write on WhatsApp, your display name on Telegram, and, when you are signed in and ask about your own things, the records you asked about, such as your bids, listings or fleet ledger. A verification service runs the checks against the vehicle registry, DigiLocker and the GST, company and income-tax records (see Verification). An app update service delivers app updates and sees your phone's address and app version when an app starts.
Map and location services: a map service serves map tiles and sees the area of a map you open; a weather service gets points along a corridor, rounded, for the weather; a route service gets only each corridor's two ends, for traffic; the postal service's PIN lookup gets a PIN code typed in the Truckaurbus Business app. Where the PIN code you set sits, and the routes themselves, are worked out on our own systems, so that PIN code reaches no one. Your phone's own speech and location services work when you speak to Ustad or use your location. YouTube serves the videos and thumbnails on our pages, without its tracking cookie. A security service receives the addresses that attack our systems. Our document check page, verify.truckaurbus.com, records each check's address, city, network and browser for ninety days. Crash reports and our own visit counts stay on our own systems.
We do not take payments online yet; when we do, a payment service will get only what it needs to take the payment. Each of these companies works under its own terms and privacy policy.
- 07
Where your data is kept
Your data is stored securely on systems we control. Some of the companies that do jobs for us work from other countries. Indian law lets personal data go abroad except to countries the government restricts; ours goes only to do those jobs.
- 08
Verification
When a listing, a bid, a claim or a key needs a verified person or vehicle, or you want a finance or insurance request to carry a verified name, we ask you to verify. Each check runs only after you say yes to it, in your language, and we record that yes with the result. Yourself: through DigiLocker (you sign in there yourself and we receive your name, year of birth and address details from your e-Aadhaar, never the Aadhaar number), or through your PAN with your name as on the card, both through our verification service. We keep only the kind and the date of the check, your verified name, your year of birth and, for DigiLocker, your state; for PAN, your name and the number masked as ABCDE****F. Never the Aadhaar number, the photograph, the full address or the document. If you prefer not to use Aadhaar, or have no Aadhaar or DigiLocker, our desk can check a driving licence, a passport or a voter ID on a short video call; the staff member records your name, year of birth and state as the document shows them, which document it was, and who checked and when, and copies nothing. A vehicle: only its registration number goes to the vehicle registry, through our verification service. For a listing we keep the vehicle's own facts, the registered owner's name (only to match it with your declaration; a buyer sees that it matches, never the name), the financer and the dates on the papers. The registry's full answer, which also carries the owner's address and contact details, is kept locked for thirty days in case of a dispute, shown to no one, and then deleted. A number asked twice within thirty days is answered from our own record, except for a sale or a transfer. On Worth today, a signed-in person can fetch a vehicle by its registration number: only that number goes to the vehicle registry, the same way, and you confirm this once before your first fetch. The page and the app use only the vehicle's own facts (the maker and model, the fuel, the emission norm, the dates of first registration and of manufacture, the office and the body) to fill the form; the owner's name, address and financer, and the chassis and engine numbers, are never shown and never kept with your account. Our verification service keeps what the registry says about the vehicle, never the full answer, and a number fetched again the same day is answered from it. We count your fetches, without the number, to hold the daily limit. On the fleet desk, Verify with VAHAN sends only the truck's registration number, and you confirm this once before the first check; we keep what the registry says about the truck and its papers (dates, status, insurer, permit, challans, the financer, and on your own desk the registered owner's name), never the full answer, and read one truck at most once a day. A lot in the yard is checked the same way, with only its registration number sent: when its seller lists it, and again before its auction if the last check is more than a month old. Bidders see the papers' dates and status, the financier if it is a business, whether the vehicle is blacklisted and how many challans are unpaid, never the owner; the seller's own desk sees the full answer. A business: through the GST and company registries.
To bid in an auction, once: your Aadhaar through DigiLocker (or our desk's video call, open to anyone who prefers not to use Aadhaar), of which we keep your name, year of birth, state and the last four digits of the number; and your PAN, read with the income-tax record, of which we keep your name on it, the number masked as ABCDE****F, whether it is linked to an Aadhaar and whether its Aadhaar ends in the same four digits. One PAN can hold only one bidding account, so we keep a coded form of the PAN that cannot be turned back into the number. Bidding for a firm, we read and keep the firm's PAN, GSTIN and legal name. A verification service makes these checks for us. We keep the version of the words you agreed to, and when you agreed. Only if money in your wallet cannot go back to the card, UPI or bank account it came from, we ask for a bank account in your PAN's name. We keep its number, IFSC and name in full only until the payment to it has been made and confirmed; after that we keep its IFSC, the last four digits of the number and the bank's reference for the payment, with the money records. We also keep what our staff checked (a cancelled cheque, a bank statement or a passbook), who checked it and when, but not a copy of the document, so that we pay your money to you and to nobody else.
Others see only that you are verified and the date, on your public page, your listings and the enquiries you send; never which document and never a number. A finance request to lenders needs your PAN checked once; we keep the masked number, your checked name and the date, and never ask again for this account; if the income-tax record does not answer, the request waits up to a day and then goes marked as waiting for the check. The lenders you say you are already speaking to are seen only by the lenders who get that request; a lender you named gets the request only if you tick Send it to them too. Edge counts the lenders people name only as totals by state and vehicle class, never fewer than five, never by person. Remove a verification under Account, Security, and the name, year, state and masked number go at once; the kind, the date, the provider, whether it passed and the cost stay as the record that a check ran. That short record (the account it was for, the kind of check, when, through which provider, whether it passed and the version of the words you agreed to) is kept for five years from the check, or from the last auction you took part in if that is later, even after you close your account or ask us to erase your data. We keep it only to show, if a sale, a strike or a claim is ever disputed, that a check was made, as the Digital Personal Data Protection Act, 2023 allows (section 17(1)(a)), and we use it for nothing else. Your name, the masked numbers and the provider's answer are kept apart from it and are erased with your account. If a strike is resting your account when you close it, we also keep the coded form of your PAN, which cannot be turned back into the number, until the rest ends, so that a new account cannot be used to get around it. If your account has a strike in force or a strike notice open when you close it, we keep a coded form of your phone number and of your PAN, which cannot be turned back into either, for as long as we keep the closed account's details, so that a new account on the same phone or PAN carries those strikes. We use them for nothing else. If your bidding account is closed for fraud (bidding agreement, clause 3.4), we keep the closure's record and the coded form of your PAN for five years from the closure, even after you close your account or ask us to erase your data, so that the PAN cannot open a new bidding account in that time; we use them for nothing else.
- 09
Research and training
Conversations with Ustad and posts in the Circle may be used, in aggregate and with identifying details removed, for market research and to improve Truckaurbus services, including training our own models. Nothing you say is published or shared with your name or number.
- 10
What we never do
We do not sell your data. We pass your request only to the business you sent it to, or to the businesses that can answer it (see Who sees what). We do not publish your name or number with any research. We never store an Aadhaar number, an image of an Aadhaar or its XML. We never award a verified mark for money. We use no advertising trackers, and an advertiser never receives your name or number through an advert.
- 12
How long we keep it
Account data lives while your account does. When you close your account, you are signed out everywhere at once, nothing about you is shown to anyone, and we stop messaging you and stop using what we hold. Indian law asks us to keep a closed account's details for a while, so that we can answer the police or a court: what we hold about you is kept locked away for 180 days after you close the account (one year where the data protection rules ask for a year, from 13 May 2027), and then erased for good, except the coded form kept after a closure for a proven breach, as below. While it is kept, nobody at Truckaurbus opens it except to answer a request made under the law, and every such look is recorded; if a court or the police ask us to preserve it, it stays until they release it. Bills, receipts, credit notes and the payment records behind them are kept for eight financial years, as tax and company law require, carrying only the details the law asks for. The log of changes to money records is kept for as long as the records it describes. If you come back, the same number or email starts a fresh account, unless we closed the account for a proven breach; the old one is given back before it is erased only if you ask for it yourself. A verification's result, date and consent live with the listing, claim, key or bidding account it was made for; the provider's full answer is deleted after thirty days; when your account is erased, your name, the masked numbers and the details of each check go with it, and the short record that a check ran is kept for five years, as section 08 explains. Listings while they are live, then the record of the sale where the law asks for it. Nazar positions are kept in full for 180 days, then only the trips, distances and each day's seal stay; a fleet's owner can delete the whole record at once from the Settings room. Ustad conversations for twelve months. The words of the messages we send and receive on WhatsApp, by SMS and by email, for ninety days. Sign-in records for one year. Analytics count visits without your name: our own counter keeps its counts, and Google Analytics, unless you turned it off in Cookie settings, keeps its data for fourteen months, counted again from each new visit. Crash reports for sixty days. A settled auction's receipt stays in the register as the law requires. A strike shows on your record as a buyer for as long as it counts (six months from the day it takes effect); the notice, contest, decision and any lift or correction behind it are kept as long as the records of the auctions they concern. A report or a flag that led to no notice is kept for twelve months, then deleted. The record of a bidding account closed for fraud, with the coded form of its PAN, is kept for five years from the closure, as section 08 explains. If we close an account for a proven breach, we keep a coded form of its phone number and PAN for five years, only to stop it opening a new account. We use it for nothing else. This does not apply if you closed your own account. Encrypted backup copies are kept so that nothing is lost. We also keep an archive, so that we can improve our services, including by building models. Before anything is copied there, your name, phone number, email, address, bank details, the details of your checks and the network address you came from are taken out or replaced by a code that cannot be traced back to you without a key the archive does not hold. When your account is erased, anything left in the archive that could identify you is erased too, within a month. We never use the archive to take a decision about you.
- 13
Your rights and how to use them
Under the Digital Personal Data Protection Act you may ask for a summary of what we hold about you, what we do with it and who we shared it with; have it corrected, completed or updated; have it erased; withdraw a consent you gave, as easily as you gave it; nominate someone to act for you if you die or cannot act; and complain. Much of this is in your hands: change your name and language under Account; remove a verification under Account, Security, which also withdraws your bidder checks: we delete what we read from your Aadhaar, tell you it is done, and you cannot bid until you check again; stop the weekly report from the link in it; write STOP or DELETE MY CHAT to Ustad; delete a listing, a saved vehicle, a question or an answer; and close your account under Account, which signs you out everywhere at once. Contest a strike notice within its 7 days, and ask for a fact on your record as a buyer to be corrected, both from your account under Auctions; a person at Truckaurbus answers in writing, a correction within 7 days, and if you are not satisfied our Grievance Officer hears it (bidding agreement, clause 7.4). For anything else, write to privacy@truckaurbus.com from the number or email on your account, and we answer within thirty days. Erasure removes what identifies you, after the period the law sets for a closed account (above); records the law requires us to keep stay for as long as it requires. If you are not satisfied, our Grievance Officer hears it, and after that the Data Protection Board of India.
- 14
Keeping it safe
Everything travels encrypted. Our backups are encrypted. Papers and documents you upload sit in private storage that only the desk that needs them can open. Staff access is limited, and what staff change is recorded. Our money records are written once. When a line is added to a balance or a wallet, our software cannot edit or delete it; a mistake is put right by a new line that says what it corrects. Every change to a payment, a refund, a hold or an invoice is also written down in a log that our software can only add to, never edit. The log keeps the money facts: amounts, states, references, dates and who made the change. It never keeps a person's details: where a name, an account number or a note changed, it records only that it changed. If a breach affects your personal data, we tell you and the Data Protection Board of India, as the law requires.
- 15
Children
Truckaurbus is for people of eighteen and over who buy, sell, run and drive commercial vehicles, and signing up asks you to confirm you are eighteen or older. We do not knowingly hold a child's data; if you think we do, write to us and it is erased.
- 16
Changes
This page is dated. When we change it in a way that matters, we say so here and on the blog before the change takes effect. The English version governs; Hindi and Tamil are provided for convenience.
As of 12 Nov 2026 · The English version governs; Hindi and Tamil versions are provided for convenience.