Privacy Policy

Vaya Mobility Private Limited · Last updated 31 October 2026

Effective date: [EFFECTIVE DATE]

This policy explains what personal data Fleito collects, why, who it is shared with, how long it is kept and what your rights are. It covers the website https://fleito.com, the Fleito fleet console and the Fleito Rider app.

Fleito is a product of Vaya Mobility Private Limited ("Vaya", "we", "us"), registered office [REGISTERED OFFICE ADDRESS], CIN [CIN].

We handle personal data under Indian law, including the Digital Personal Data Protection Act, 2023 and its Rules, the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

1. Who is responsible for your data

Fleito is used by businesses that rent electric vehicles to riders ("operators"). Who decides how your data is used depends on the activity:

• Your rental. Your operator decides what it needs from you to rent you a vehicle - your documents, rental agreement, payments and vehicle use - and reviews that information. We provide the software and handle this data to run the service for your operator. Questions about how your operator uses your data can go to your operator or to us, and we will help route them.
• Running Fleito itself. Where we decide the purpose ourselves - for example securing sign-in, keeping the platform safe, processing payments through our payment accounts, supporting operators, and meeting our own legal duties - Vaya is responsible.

Either way, you can contact us using the details at the end of this policy.

2. What we collect

Account and profile (riders)

• Mobile number, first and last name, preferred language
• Alternate contact: name, relationship and phone number
• Address, given when you sign your rental agreement

Identity verification (riders)

• Photos of your identity documents (such as Aadhaar card front and back, and PAN card) and a selfie, which your operator reviews
• We do not record your Aadhaar or PAN number as a data field. When you sign your rental agreement, the app checks your Aadhaar number on your phone and only the last 4 digits are sent and kept. Note that a photo of a card shows whatever is printed on it, so we recommend uploading a masked Aadhaar, which shows only the last 4 digits.

Rental agreement (riders)

• Your drawn signature, the agreement text you signed and its version
• A record of the signing: date and time, IP address and device information

Vehicle and rental (riders)

• Vehicle inspection photos you take
• The vehicle assigned to you, your hub, your rent plan, pause and exit requests, and support tickets
• Location, status and battery information reported by the vehicle's tracking device. While a vehicle is assigned to you, its location shows where the vehicle is, and so may show where you are
• Battery swap history from our battery swap partner, linked to the vehicle

Payments (riders)

• Amounts owed and paid, payment references, payment method type, and cash payments you record
• Payments are processed by our payment partners. We do not receive or store your full card number, bank account login or UPI PIN

Device (riders)

• A push notification token so we can send app notifications
• We do not collect your phone's own location, contacts or photos other than the ones you choose to upload [CONFIRM]

Operator staff and website visitors

• Staff: name, work email, phone, role, and sign-in and activity records
• Anyone who writes to us: your name, contact details and message

3. Why we use it

• To create your account and sign you in securely
• To let your operator verify you, rent you a vehicle and keep a signed agreement
• To work out what you owe, take payments, refund deposits and keep accurate records
• To send sign-in codes, rent reminders, payment updates and service notices
• To track and maintain vehicles, handle damage and battery swap charges and disputes
• To answer support requests and complaints
• To keep Fleito secure, prevent fraud and fix problems
• To meet legal, tax and regulatory duties

We use your data for these purposes on the basis of your consent, which you give when you sign up and when you submit your documents, and where the law otherwise allows. We do not sell your personal data and we do not use it for advertising.

4. Who we share it with

• Your operator and its authorised staff, who see your profile, documents, agreement, payments and vehicle information. Access is limited by role.
• Fleito support staff, who can open an operator's account for a limited time to help with a problem. These sessions are time-limited and logged.
• Service providers who help run Fleito, only for that purpose:
• Amazon Web Services - hosting and storage, in the Mumbai (India) region
• Cashfree Payments and Razorpay - payments and refunds
• Meta (WhatsApp Business) - sign-in codes and reminders
• Google Firebase Cloud Messaging - app notifications
• PathSecureX - vehicle tracking (location and status)
• Battery Smart - battery swap history
• Authorities, when the law requires it.

5. Where it is stored and how it is protected

Your data is stored in India, in Amazon Web Services' Mumbai region. Some providers above, such as WhatsApp and Firebase, may process message or notification data outside India.

We protect data with encryption in storage and in transit, role-based access, short-lived download links for documents, and access logs. No system is perfectly secure. If a breach affects your data, we will tell you and the authorities as the law requires.

6. How long we keep it

• Rejected identity documents: deleted about 30 days after rejection
• Identity documents after your rental ends: deleted about 60 days after you leave your operator
• Signed rental agreements: kept for [AGREEMENT RETENTION PERIOD] after the rental ends, as evidence of the contract
• Vehicle inspection photos: kept for [INSPECTION PHOTO RETENTION PERIOD], as evidence of the vehicle's condition
• Payment and billing records: kept as long as tax and accounting law requires
• App notifications: about 90 days. Activity logs: about 180 days

After that, data is deleted or anonymised, unless the law requires us to keep it longer or it is needed for an open dispute.

7. Your rights

You can ask to:

• see the personal data held about you and who it has been shared with;
• correct or complete it;
• delete it, where it is no longer needed and no law or open dispute requires us to keep it;
• withdraw your consent. This does not affect what was done before, but we may then be unable to continue your rental account;
• name someone to exercise these rights for you if you die or cannot act;
• complain to us, and then to the Data Protection Board of India.

Write to [email protected] with your registered mobile number, or ask through your operator. We may need to confirm who you are. We will respond within [RESPONSE PERIOD - no more than 90 days].

8. Children

Fleito is for people aged 18 and over. We do not knowingly collect data from children.

9. Changes

We may update this policy. We will post the new version here with a new effective date and, for important changes, tell you in the app.

10. Grievance officer and contact

• Name: [GRIEVANCE OFFICER NAME]
• Designation: [GRIEVANCE OFFICER DESIGNATION]
• Email: [email protected]
• Phone: [SUPPORT PHONE]
• Address: Vaya Mobility Private Limited, [REGISTERED OFFICE ADDRESS]

We acknowledge complaints within 48 hours and aim to resolve them within one month.