Privacy

1. 01

   Who we are

   Truckandbus Technologies Private Limited (CIN U63120KA2026PTC227607), 10th Floor, WeWork Latitude, RMZ Latitude Commercial, Hebbal Kempapura, Bangalore 560024, Karnataka, India, runs truckaurbus.com and every desk on it (dealer, partners, fleet, yard, creators, edge, support, verify and the sign-in pages), the Truckaurbus, Truckaurbus Dealer, Nazar Driver and Nazar Driver Lite apps, and Ustad on WhatsApp and Telegram. Under the Digital Personal Data Protection Act, 2023 we decide what happens to the personal data you give us, and we answer for it. Write to [email protected]. Our Grievance Officer, S. Mitra, hears complaints at [email protected] and by post at the address above; we acknowledge a complaint within 24 hours and resolve it within fifteen days.

2. 02

   What we hold, and why

   Your account: your phone number or email, the name you give, your language, when you confirmed you are eighteen or older, and, if you sign in with Google, your Google account's id and email; we use them to sign you in and to reach you about what you asked for. Each sign-in: the time, the address your device connected from and your browser or phone model, kept to protect your account. On the site and in the apps: the PIN code you set for nearby results, the vehicles you save, compare and recently viewed, the listings, questions, answers and photos you post, your enquiries and your finance, insurance or quote requests with the replies, a random id for your device or app, and the token that lets us send you notifications. The yard: your institution's membership, your bids, the agreements you accepted with the time and the address, your bidder checks (see Verification), the EMD transfers you report (the bank's reference, the amount, the day and the receipt) with the seller's answer, any default notice on your account with your contest and our answer, the people you name for an inspection, and the settled records. The fleet desk: your fleet's name and district, its vehicles by registration number, the drivers and staff you add with their names, roles and phone numbers, the papers you upload, fuel fills, the results of the VAHAN checks you run, the campaigns and statements. The dealer and partner desks: the business you claim, its papers and people, its stock, prices and offers, the enquiries and requests it receives, the calls made through our number (the caller's number and the time, never the call itself) and its bills. Billing: your organisation's balance, top-ups, bank references, the proofs of payment you attach, the terms your organisation agreed to with who agreed and when, and the numbered documents we issue. Nazar and Nazar Driver: a paired phone's position about every 10 minutes with its speed, heading, height, accuracy, battery and charging state; the phone's motion sensor readings while the vehicle moves (a summary a minute, short raw accelerometer and gyroscope clips around hard braking or sharp turns, and short raw accelerometer windows), kept to build models that make Nazar better (never audio or video); the driver's pauses; the rolling Bluetooth identifiers a phone heard (Nazar Driver Lite); an SOS with its position; the driver's name and number; the phone's model, system and app version; the trips, stops and jobs built from them; the availability cards and offers an owner publishes; and the day anchors (hashes of the day's record, never the positions themselves). Ustad: your conversations. Our WhatsApp and Telegram numbers: what you write to them, with your number on WhatsApp and your display name on Telegram; for a photo, a document or a voice note, only that you sent one, except a dealer's message that starts with STOCK, whose photos and files are kept for that dealer's stock; for a location you share, only the PIN code, district and state it falls in; for a contact card, only that you sent one, never the names or numbers on it. Writing to us there for the first time opens a Truckaurbus account on that number. Send STOP and Ustad does not reply to that number for 30 days (nothing is deleted); send DELETE MY CHAT and your conversation with Ustad is erased. Our mailing lists: the email you subscribed with and its language.

3. 03

   What we use it for

   To sign you in and keep your account safe. To show listings, prices and answers, and to keep the alerts you asked for. To send an enquiry, a finance or insurance request or a quote request to the businesses that can answer it (see Who sees what). To run the yard, the fleet desk and Nazar for the people who use them. To check that people, businesses and vehicles are who and what they say (see Verification). To bill businesses for what they buy. To stop fraud, spam and abuse, including automatic checks of what is posted before it appears. To count visits and fix crashes. To send the weekly report, after a person at our desk approves it. For research, as set out below.

4. 04

   Who sees what

   When you send an enquiry or a request, the business you sent it to sees it. A finance or insurance request goes to the lenders or insurers that serve your area, with your vehicle and your verified name if you have one; your number is shown to a business only when it accepts your request, and some businesses pay us a fee when they accept one. Listings show what you publish; your number stays masked until you choose to share it. The Circle shows your name on your questions and answers, never your number. When you book a yard visit, the yard's host sees your verified name and your slot. A seller deciding on your bid sees your record as a bidder on Truckaurbus: completed wins, defaults, strikes in effect and any notice still open. It never sees the details of your checks. Once the seller confirms your win, it sees your name as on your PAN, your phone and the last four characters of your PAN (bidding for a firm, also the firm's name and GSTIN), to arrange payment and handover, and each look is recorded on the seller's own log. While the bidding is on, the seller never sees who you are. Nazar positions are seen by the fleet's owner and the people the owner gives keys to, and not by other fleets, insurers or lenders unless the owner hands them a record. A mechanic or a shop who is read the driver's proof code sees that vehicle's position and can reach the owner only while the owner's providers switch is on (it is on until the owner turns it off). The public owner profile shows only what the owner turns on. Truckaurbus staff see what they need to run the desks, check what is posted and answer you; their tools sit behind a second sign-in. The register's counts and the wire are public and carry no personal data.

5. 05

   Photographs

   Before a photo you post appears on Truckaurbus, we look for number plates and faces and blur them, and we remove the camera's location from the file. Photos a maker gives us of its own vehicles are not blurred. If you see a plate or a face we missed, tell us and we will remove it.

6. 06

   The services we use

   We run on our own servers, rented from OVH in Gravelines, France: one for the site and the desks, one for sign-in and one for Nazar; your photos and documents are stored there too. Other companies do specific jobs for us, each with only what that job needs. Cloudflare carries every visit to the site and protects it from attacks (it may set its own security cookies), checks forms against robots, keeps our encrypted backups, and runs verify.truckaurbus.com, which records each document check's address, city, network and browser for ninety days. Twilio sends sign-in codes by SMS (Exotel takes over once its account is approved). Meta carries our WhatsApp messages, including Ustad's replies and the alerts and enquiries you asked for. Telegram carries Ustad on Telegram. Resend sends our emails; Google Workspace holds our own mailboxes, privacy@ among them. Google also runs sign in with Google, counts visits on the site (Google Analytics, unless you turn it off in Cookie settings) and screens in the apps (Firebase), delivers notifications to Android phones (Firebase Cloud Messaging), and its Gemini models check adverts before they run and read makers' brochures and public videos. Apple delivers notifications to iPhones. Anthropic's models write Ustad's answers, check listings, questions, answers and comments before they appear, sort messages sent to our support desk, and read photos you upload to price a vehicle; what reaches them is your question, the conversation so far and the register's facts, your number and name when you write on WhatsApp, your display name on Telegram, and, when you are signed in and ask about your own things, the records you asked about, such as your bids, listings or fleet ledger. Surepass Technologies, Delhi, runs the checks against the vehicle registry, DigiLocker and the GST, company and income-tax records (see Verification). Expo delivers app updates and sees your phone's address and app version when an app starts. OpenStreetMap serves map tiles and sees the area of a map you open; where a PIN code sits comes from GeoNames' PIN centres (CC BY) and OpenStreetMap's postcode locations (ODbL), both copied to our own servers, so your PIN code reaches neither; Open-Meteo and Google's route service get points along a corridor, rounded, for weather and routes; the India Post PIN lookup gets a PIN code a dealer types in the Dealer app; your phone's own speech and location services work when you speak to Ustad or use your location. YouTube serves the videos and thumbnails on our pages, without its tracking cookie. OpenTimestamps and freetsa.org receive hashes of Nazar's and the yard's daily records, from which nothing can be read back. CrowdSec receives the addresses that attack our servers. Crash reports and our own visit counts stay on our servers (GlitchTip and Umami). We do not take payments online yet; when we do, the payment company will get only what it needs to take the payment. Each of these companies works under its own terms and privacy policy.

7. 07

   Where your data is kept

   Our servers are in France. Several of the companies above work from other countries, including the United States and Japan. Indian law lets personal data go abroad except to countries the government restricts; ours goes only to do the jobs above. Our backups are encrypted before they leave our servers and are kept on Cloudflare's storage.

8. 08

   Verification

   When a listing, a bid, a claim or a key needs a verified person or vehicle, or you want a finance or insurance request to carry a verified name, we ask you to verify. Each check runs only after you say yes to it, in your language, and we record that yes with the result. Yourself: through DigiLocker (you sign in there yourself and we receive your name, year of birth and address details from your e-Aadhaar, never the Aadhaar number), or through your PAN with your name as on the card, both through Surepass. We keep only the kind and the date of the check, your verified name, your year of birth and, for DigiLocker, your state; for PAN, your name and the number masked as ABCDE****F. Never the Aadhaar number, the photograph, the full address or the document. If you have no Aadhaar or DigiLocker, our desk can check a driving licence, a passport or a voter ID on a short video call; the staff member records your name, year of birth and state as the document shows them, which document it was, and who checked and when, and copies nothing. A vehicle: only its registration number goes to the vehicle registry, through Surepass. For a listing we keep the vehicle's own facts, the registered owner's name (only to match it with your declaration; a buyer sees that it matches, never the name), the financer and the dates on the papers. The registry's full answer, which also carries the owner's address and contact details, is kept locked for thirty days in case of a dispute, shown to no one, and then deleted. A number asked twice within thirty days is answered from our own record, except for a sale or a transfer. On the fleet desk, Verify with VAHAN sends only the truck's registration number, and you confirm this once before the first check; we keep what the registry says about the truck and its papers (dates, status, insurer, permit, challans, the financer, and on your own desk the registered owner's name), never the full answer, and read one truck at most once a day. A lot in the yard is checked the same way, with only its registration number sent: when its seller lists it, and again before its auction if the last check is more than a month old. Bidders see the papers' dates and status, the financier if it is a business, whether the vehicle is blacklisted and how many challans are unpaid, never the owner; the seller's own desk sees the full answer. A business: through the GST and company registries.

   To bid in an auction, once: your Aadhaar through DigiLocker (or our desk's video call), of which we keep your name, year of birth, state and the last four digits of the number; and your PAN, read with the income-tax record, of which we keep your name on it, the number masked as ABCDE****F, whether it is linked to an Aadhaar and whether its Aadhaar ends in the same four digits. One PAN can hold only one bidding account, so we keep a coded form of the PAN that cannot be turned back into the number. Bidding for a firm, we read and keep the firm's PAN, GSTIN and legal name. Surepass makes these checks for us. We keep the version of the words you agreed to, and when you agreed. Only if money in your wallet cannot go back to the card, UPI or bank account it came from, we ask for a bank account in your PAN's name. We keep its number, IFSC and name in full, what our staff checked (a cancelled cheque, a bank statement or a passbook), who checked it and when, so that we pay your money to you and to nobody else.

   Others see only that you are verified and the date, on your public page, your listings and the enquiries you send; never which document and never a number. A finance request to lenders needs your PAN checked once; we keep the masked number, your checked name and the date, and never ask again for this account; if the income-tax record does not answer, the request waits up to a day and then goes marked as waiting for the check. The lenders you say you are already speaking to are seen only by the lenders who get that request; a lender you named gets the request only if you tick Send it to them too. Edge counts the lenders people name only as totals by state and vehicle class, never fewer than five, never by person. Remove a verification under Account, Security, and the name, year, state and masked number go at once; the kind, the date, the provider, whether it passed and the cost stay as the record that a check ran. That short record (the account it was for, the kind of check, when, through which provider and whether it passed) is kept for five years, even after you close your account or ask us to erase your data, so that we can show a check was made. Your name, the masked numbers and the provider's answer are kept apart from it and are erased with your account.

9. 09

   Research and training

   Conversations with Ustad and posts in the Circle may be used, in aggregate and with identifying details removed, for market research and to improve Truckaurbus services, including training our own models. Nothing you say is published or shared with your name or number.

10. 10

    What we never do

    We do not sell your data. We pass your request only to the business you sent it to, or to the businesses that can answer it (see Who sees what). We do not publish your name or number with any research. We never store an Aadhaar number, an image of an Aadhaar or its XML. We never award a verified mark for money. We use no advertising trackers, and an advertiser never receives your name or number through an advert.

11. 11

    Cookies and app storage

    On the site: your sign-in (from one hour to ninety days), your PIN code, your language and display choices, the vehicles you compare and recently viewed, a random device id, your Ustad conversation handle, your cookie settings, and a few cookies that remember a choice on a desk. These are ours. We use cookies to keep you signed in and to understand how the site is used: Google Analytics, and any measurement tag we add later, counts visits and sets its cookies from your first page, unless you turn Analytics and measurement off in Cookie settings at the foot of any page; that choice is kept for a year. Google Analytics keeps what it counts for 14 months. Our own counter uses no cookie and runs either way. Cloudflare sets security cookies to tell people from robots, and signing in with Google sets Google's. The apps keep on your phone your sign-in, an install id, your language and PIN code, the vehicles you saved, compared and viewed, the papers you keep in the app's locker, your reminders, your notification token and messages waiting to send. Nazar Driver and Nazar Driver Lite keep their key and the pings waiting to send.

12. 12

    How long we keep it

    Account data lives while your account does. When you close your account, you are signed out everywhere at once, nothing about you is shown to anyone, and we stop messaging you and stop using what we hold. Indian law asks us to keep a closed account's details for a while, so that we can answer the police or a court: what we hold about you is kept locked away for 180 days after you close the account (one year where the data protection rules ask for a year, from 13 May 2027), and then erased for good. While it is kept, nobody at Truckaurbus opens it except to answer a request made under the law, and every such look is recorded; if a court or the police ask us to preserve it, it stays until they release it. Bills, receipts, credit notes and the payment records behind them are kept for eight financial years, as tax and company law require, carrying only the details the law asks for. The log of changes to money records is kept for as long as the records it describes. If you come back, the same number or email starts a fresh account; the old one is given back before it is erased only if you ask for it yourself. A verification's result, date and consent live with the listing, claim, key or bidding account it was made for; the provider's full answer is deleted after thirty days; when your account is erased, your name, the masked numbers and the details of each check go with it, and the short record that a check ran is kept for five years. Listings while they are live, then the record of the sale where the law asks for it. Nazar positions are kept in full for 180 days on the Nazar server, then only the trips, distances and day anchors stay there; a fleet's owner can delete the whole record at once from the Settings room. Ustad conversations for twelve months. The words of the messages we send and receive on WhatsApp, by SMS and by email, for ninety days. Sign-in records for one year. Analytics count visits without your name: our own counter keeps its counts, and Google Analytics, only where you said yes to it, keeps its data for fourteen months, counted again from each new visit. Crash reports for sixty days. A settled auction's receipt stays in the register as the law requires. Encrypted backup copies are kept so that nothing is lost if a server fails. The periods above are for our working servers: a copy of what we hold, including what those periods remove, is kept in our own archive on Cloudflare's storage, so that we can improve our services from it.

13. 13

    Your rights and how to use them

    Under the Digital Personal Data Protection Act you may ask for a summary of what we hold about you, what we do with it and who we shared it with; have it corrected, completed or updated; have it erased; withdraw a consent you gave, as easily as you gave it; nominate someone to act for you if you die or cannot act; and complain. Much of this is in your hands: change your name and language under Account; remove a verification under Account, Security; stop the weekly report from the link in it; write STOP or DELETE MY CHAT to Ustad; delete a listing, a saved vehicle, a question or an answer; and close your account under Account, which signs you out everywhere at once. For anything else, write to [email protected] from the number or email on your account, and we answer within thirty days. Erasure removes what identifies you, after the period the law sets for a closed account (above); records the law requires us to keep stay for as long as it requires. If you are not satisfied, our Grievance Officer hears it, and after that the Data Protection Board of India.

14. 14

    Keeping it safe

    Everything travels encrypted. Our backups are encrypted before they leave our servers. Papers and documents you upload sit in private storage that only the desk that needs them can open. Our staff tools sit behind a second sign-in, and what staff change is recorded. Our money records are written once. When a line is added to a balance or a wallet, our software cannot edit or delete it; a mistake is put right by a new line that says what it corrects. Every change to a payment, a refund, a hold or an invoice is also written down in a log that cannot be changed. The log keeps the money facts: amounts, states, references, dates and who made the change. It never keeps a person's details: where a name, an account number or a note changed, it records only that it changed. If a breach affects your personal data, we tell you and the Data Protection Board of India, as the law requires.

15. 15

    Children

    Truckaurbus is for people of eighteen and over who buy, sell, run and drive commercial vehicles, and signing up asks you to confirm you are eighteen or older. We do not knowingly hold a child's data; if you think we do, write to us and it is erased.

16. 16

    Changes

    This page is dated. When we change it in a way that matters, we say so here and on the blog before the change takes effect. The English version governs; Hindi and Tamil are provided for convenience.

As of 27 Oct 2026 · The English version governs; Hindi and Tamil versions are provided for convenience.