Privacy Policy

Yantram is operated by [REGISTERED COMPANY NAME], a company incorporated in India with its registered office at [REGISTERED ADDRESS] (“Yantram”, “we”, “us”). We run a marketplace connecting construction firms with vendors of building materials and equipment.

For the purposes of India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”), we are the Data Fiduciary for the personal data described below. This policy explains what we collect, why we collect it, how long we keep it, and what you can require us to do with it.

Every item below is collected for a stated purpose and kept only for as long as that purpose or the law requires. We do not collect anything for a purpose not listed here.

The eight-year retentions are not our choice. Section 36 of the Companies Act, 2013 and the GST rules require books of account and tax records to be preserved for that period, and a delivery photograph is part of the record supporting an invoice.

Separately from the data we collect to run your account, we log a small set of in-app actions — a screen opened, a booking flow started, a quote viewed, support contacted — against your account. This is the one purpose on this page that is not necessary to fulfil an order: we use it to understand usage patterns across our customers and to identify, early, when a company’s engagement looks like it is heading toward churn, so our team can reach out before a relationship lapses rather than after.

Every one of these events is something you did in the product, not a page you were merely shown, and none of it is shared with any third party or used for advertising. Server-recorded facts about your own orders — a delivery completing, a claim being raised — are logged alongside the same way; a browser is never allowed to assert one of those happened, only a completed transaction is.

Because this is a distinct purpose from operating your account, it is also the one thing on this page you can switch off independently: turn off “Usage analytics” in Settings and no further behavioural events are recorded against your account. Doing so does not affect order history, invoices, or anything needed to run your account — it only stops the usage signal described above.

Location is the most sensitive thing we handle, so it is worth being precise. A browser will not give us a device’s position unless the person using it grants permission, on that device, for this site. There is no way for us to override that from our side, and we do not attempt to.

We ask for it in exactly two situations: when a builder chooses to drop a pin for a new site, and while a vendor’s delivery is actually in motion. In the second case tracking starts when the order is dispatched and stops when it is marked delivered — not between jobs, not overnight, not when the app is closed. Each stored position is tied to the specific order it was captured for, so the question “why do you hold this?” always has an answer, and rows are deleted automatically after 30 days.

You can withdraw the permission at any time in your browser’s site settings. Doing so stops collection immediately. It also stops live tracking working, which is the only thing it is used for.

We do not sell personal data, and we do not share it for anyone else’s advertising. We share it only:

• Between the parties to a transaction. A vendor you have accepted sees the delivery address, the site contact and the order. A builder sees the assigned vendor and driver. Neither sees anything about your other orders.
• With service providers who act on our instructions. Our hosting and database provider (Google Cloud, in their Mumbai region), our SMS and WhatsApp messaging providers for delivering one-time codes and order updates, and our payment and settlement partners. Each is bound to use the data only to provide that service.
• Where the law requires it — a court order, a tax authority, or a lawful request from a government agency.

Your data is stored in India. If that ever changes we will say so here before it happens, and only to a country not restricted by the Central Government under the DPDP Act.

Under the DPDP Act you can, at any time:

• Ask what we hold — a summary of your personal data and who we have shared it with.
• Have it corrected or completed if it is wrong or out of date. Most of it you can edit yourself in the app.
• Have it erased, unless we are required to keep it — which, for invoices, payments and the delivery records supporting them, we are, for eight years.
• Withdraw consent as easily as you gave it. Location permission is revoked in your browser; notification consent in the app’s settings.
• Nominate someone to exercise these rights on your behalf in the event of your death or incapacity.
• Complain — to our Grievance Officer first, and to the Data Protection Board of India if we do not resolve it.

Write to [PRIVACY EMAIL] and we will respond within 30 days. We may need to confirm your identity first, which for most requests means a one-time code to your registered number.

Traffic is encrypted in transit and data is encrypted at rest. Access within Yantram is scoped by role, so an operations executive who handles deliveries cannot see credit limits or record payments. Every change to an order, an invoice or a credit line is written to an audit trail with the person who made it.

If a breach affects your data we will notify you and the Data Protection Board as the DPDP Act requires, without waiting to complete our own investigation first.

Yantram is a tool for businesses and is not directed at anyone under 18. We do not knowingly create accounts for children. If you believe a child’s data has reached us, tell us and we will delete it.

If we change this policy in a way that affects what we collect or why, we will tell you in the app before it takes effect, not only by editing this page.

Grievance Officer: [NAME], [PRIVACY EMAIL], [REGISTERED ADDRESS]. As required by section 13 of the DPDP Act, this is the person responsible for answering questions about how we handle your data.