Privacy Policy

LOCAL RAHI

Terms & ConditionsPrivacy PolicyCarpool Cost-Sharing PolicyPayment, Cancellation & Refund PolicyCost-Sharing Reimbursement PolicySafety & Community GuidelinesProfile & Verification PolicyAccount & Data Deletion PolicySuspension & Termination PolicyGrievance & Dispute Resolution PolicyLocation & Live Location PolicyWebsite & App Disclaimer

Company

LOCAL RAHI PRIVATE LIMITED

Website

localrahi.com

Grievance Officer

Pravin Kumar, Director & Grievance Officer

Contact

hello@localrahi.com | 8884188741

Registered Office

I-1602, Hawelia Valencia Homes, Sector-1, Greater Noida (West), Bisrakh, Gautam Buddha Nagar - 201306, Uttar Pradesh, India

Core principle: Local Rahi facilitates private carpooling for sharing eligible journey/fuel costs. Offering a pool is not intended for commercial profit or operation as a taxi/passenger transport business.

Document Status and Interpretation

This document is the expanded master policy draft for the Local Rahi private carpool platform. It is intended to align the public-facing policies with the current product architecture described by Local Rahi. It should be checked against the final production application, payment configuration, verification process and support workflow before publication.

Where this document says Local Rahi 'may' perform an action, the action should only be represented publicly if the relevant operational capability or policy is actually implemented. Nothing in this document should be interpreted as creating an exemption from transport, tax, consumer, payment, privacy, insurance or other applicable law merely because Local Rahi characterizes its service as private cost sharing.

Key Defined Terms

User: a person holding a Local Rahi account.

Offer Pool: the action by which a user offers available seats on a genuine private journey.

Find Pool: the action by which a user seeks to join a compatible private journey.

User Offering the Pool / Car Owner: the user associated with an Offer Pool. This term does not by itself mean a commercial driver.

Rider / Co-traveller: a user seeking or joining an offered pool.

Cost-Sharing Contribution: the amount attributable to eligible journey/fuel cost sharing under Local Rahi's methodology.

Cost-Sharing Reimbursement: the eligible amount Local Rahi facilitates to the user offering the pool after applicable conditions are satisfied. It is not described by Local Rahi as salary or commercial-driver earnings.

Final Total Payable: the amount shown to the rider before payment authorization. Internal Local Rahi/platform/payment-processing components are not necessarily separately itemized.

Profile Unverified: optional Government ID or Corporate ID profile verification has not been successfully completed; this is separate from mobile OTP verification.

2. Privacy Policy

2.1 Scope

This Privacy Policy explains how LOCAL RAHI PRIVATE LIMITED processes personal information in connection with the Local Rahi application, informational website, support channels and related services.

2.2 Account and Profile Data

Name and registered mobile number.

Email address if provided.

Profile photo and voluntary profile details.

Account/session status, ratings, reviews and support interactions.

Verification status and related audit information.

2.3 Authentication and Security Data

OTP verification status and provider reference.

Authentication/session identifiers.

Device/session information, IP address and login timestamps.

Security events, rate-limit and fraud-prevention information.

Users should never disclose OTPs or authentication credentials to another Local Rahi user.

2.4 Optional Government/Corporate Verification Data

Where a user voluntarily chooses optional profile verification, Local Rahi or an applicable verification provider may process an accepted Government ID or Corporate ID and related verification information. Other users should ordinarily see only the relevant verification status/badge, not the underlying document or full identification number.

Local Rahi should minimize access and retention of verification documents to what is reasonably necessary for verification, security, fraud prevention, dispute handling and applicable legal requirements. The exact verification provider, document set and retention period must be aligned with the production implementation before publication.

2.5 Vehicle Information

Where a user offers a pool, Local Rahi may process vehicle details such as registration information, make/model, colour, seating information and any vehicle/document verification status implemented by the platform. Profile verification and vehicle verification are separate.

2.6 Location, Route and Live Location

Current location when used for pickup/drop or map functionality.

Pickup, destination and via points.

Latitude/longitude, route, distance and ETA information.

Location used for matching and pickup coordination.

Live location during an active ride where enabled and permitted.

Relevant location evidence used for attendance, safety or dispute investigation.

Where sensitive/background location access is required, Local Rahi should provide an appropriate prominent in-app disclosure and request the relevant device permission before collection.

2.7 Ride, Booking and Recurring Data

Find Pool and Offer Pool details.

Requests, invitations, matches and booking states.

Trip date/time, seats and recurring-series preferences.

Ride start/completion/cancellation status.

Attendance/check-in status and associated audit events.

2.8 Communication Data

Local Rahi may process in-app messages, communication metadata and call-related information needed to provide or secure communication features. Direct calling may reveal a participant's telephone number to the other legitimate participant depending on the implementation. Future masked calling would require this Policy to be updated to reflect the provider and processing.

2.9 Payment, Refund and Reimbursement Data

Gateway order/payment/refund/transfer references.

Payment and refund amount/status/timestamps.

Internal transaction allocation used for accounting/reconciliation.

Cost-sharing reimbursement amount/status.

Where required, account-holder name, bank/UPI details, IFSC, beneficiary reference and verification status.

Local Rahi does not intend to collect or store card CVV, UPI PIN, ATM PIN, online-banking password or similar secret payment credentials. Such credentials are handled through the applicable payment interface/provider.

2.10 Device, Notification and Diagnostic Data

Device type, operating system and app version.

Device/application identifiers and FCM/push token.

IP/session/security information.

Crash and technical diagnostic information where implemented.

2.11 Purposes of Processing

Create, authenticate and secure accounts.

Provide Find Pool, Offer Pool, matching, recurring rides and booking functionality.

Provide maps, route, distance, ETA and active-ride functionality.

Facilitate ride-related messaging/calling.

Process and reconcile payments, refunds and cost-sharing reimbursements.

Operate optional profile verification.

Send ride, payment, safety, message and account notifications.

Prevent fraud, abuse, unauthorized access and commercial misuse.

Resolve complaints, attendance disputes and payment issues.

Maintain accounting, transaction, audit and compliance records.

Improve, troubleshoot and operate the platform and comply with applicable law.

2.12 Information Visible to Other Users

Depending on the interaction, Local Rahi may show appropriate profile information, verification status, rating, vehicle identification information, ride details, pickup/drop information and communication options. Underlying Government/Corporate ID documents should not be displayed to other users.

2.13 Service Providers

Local Rahi may use service providers such as Cashfree Payments for payment/refund/reimbursement functions, MSG91 for OTP/communications, Google Maps Platform for maps/routes/location, Google Firebase services such as Firebase Cloud Messaging for notifications, and hosting/security/support providers. If additional verification, analytics, crash-reporting or communication providers are introduced, the published policy should be updated accordingly.

2.14 Disclosure to Authorities and Others

Information may be disclosed where reasonably necessary to service providers, professional advisers, regulators, courts, law-enforcement authorities or other parties to operate the service, protect users, investigate misuse, enforce terms, comply with law or respond to lawful requests.

2.15 Security

Local Rahi uses reasonable technical and organizational safeguards intended to protect personal information, including authentication, access controls, encrypted network communication, restricted production access and credential management. No internet-connected service can guarantee absolute security.

2.16 Retention

Information may be retained for as long as reasonably necessary for account operation, rides, transactions, refunds/reimbursements, fraud prevention, safety, disputes, accounting, audit and legal obligations. Different categories may require different periods. The production retention schedule should be documented before launch, especially for optional identity documents and location evidence.

2.17 Account Deletion

Users may request deletion through the available in-app process and a designated public web resource. Data no longer required should be deleted or anonymized, while information legitimately required for payment, refund, reimbursement, accounting, fraud, safety, disputes or law may be retained for the applicable purpose and period.

2.18 User Choices and Rights

Request correction of inaccurate account information.

Request account/personal-data deletion where applicable.

Manage device permissions.

Withdraw optional consent where applicable, subject to consequences for features requiring that data.

Raise a privacy grievance using the contact information below.

2.19 Website

localrahi.com currently provides company, service, policy and contact information. Ride booking/payment functionality is currently intended primarily for the mobile application. The website may gain additional functionality in the future, at which time the relevant privacy disclosures must be updated.

2.20 Grievance Contact

Grievance Officer: Pravin Kumar, Director & Grievance Officer, LOCAL RAHI PRIVATE LIMITED. Email: hello@localrahi.com. Phone: 8884188741. Registered Office: I-1602, Hawelia Valencia Homes, Sector-1, Greater Noida (West), Bisrakh, Gautam Buddha Nagar - 201306, Uttar Pradesh, India.

7. Profile & Verification Policy

7.1 Verification Layers

Mobile OTP Verified: confirms control of the registered mobile number.

Profile Unverified: optional Government/Corporate verification not completed.

Government ID Verified: the applicable Government ID verification process was successfully completed.

Corporate Verified: the applicable corporate identification/affiliation verification process was successfully completed.

7.2 Optional Nature

Government ID and Corporate ID profile verification are optional unless Local Rahi specifically requires additional verification for a feature, safety measure, payment requirement, legal requirement or risk-control process.

7.3 Meaning of Unverified

'Unverified' does not mean the user's mobile number is necessarily unverified and does not by itself mean the user is fraudulent or unsafe.

7.4 Badge Limitations

A verification badge confirms only the relevant verification process. It is not a guarantee of character, conduct, driving skill, vehicle safety, reliability, background or future behaviour.

7.5 Corporate Badge

'Corporate Verified' does not mean the employer or organization endorses, guarantees, sponsors or accepts responsibility for the user's carpool unless Local Rahi expressly states otherwise under an actual corporate arrangement.

7.6 Document Privacy

Underlying Government/Corporate ID documents and full ID numbers should not be displayed to other users. Access should be restricted to authorized processing/support/security purposes.

7.7 False Documents

Submission of materially false, altered, unauthorized or fraudulent verification information may result in rejection, badge removal, investigation, suspension or termination.

7.8 Vehicle Verification Is Separate

Government/Corporate profile verification does not verify the user's vehicle, driving licence, insurance or driving ability. Any future vehicle/document verification should use a separate status.

7.9 Production Verification Details

The final accepted document types, verification provider/process, failure/retry process and retention schedule must be documented before public launch and reflected in the Privacy Policy.

8. Account & Data Deletion Policy

8.1 What Account Deletion Means

Account deletion is a user-requested process to permanently close the Local Rahi account and delete or anonymize associated personal information that no longer needs to be retained. It is different from logout, uninstalling the application, suspension or termination.

8.2 How to Request

Users should be able to request deletion from within the application and through a publicly accessible website resource such as localrahi.com/account-deletion.

8.3 Verification of Request

Local Rahi may use reasonable account-control verification, such as registered-mobile verification, before processing deletion. Users should never be asked to provide UPI PIN, card CVV or banking password.

8.4 Active Rides and Transactions

A deletion request does not require Local Rahi to prematurely destroy information still reasonably needed to complete an active ride, payment, refund, reimbursement, chargeback, safety investigation, complaint or legal dispute.

8.5 Data Deleted or Anonymized

After valid processing, account/profile data and other personal information no longer required should be deleted or anonymized in accordance with the applicable retention process.

8.6 Data That May Be Retained

Payment, refund and reimbursement records.

Accounting, tax and audit records.

Fraud/security/abuse-prevention records.

Records needed for complaints, claims, investigations or disputes.

Records required by applicable law, authorities or payment providers.

8.7 Effect of Deletion

The user may lose access to ride history, messages, ratings, preferences and other account-linked features. Some historical information may remain in de-identified form or where required as part of another user's legitimate transaction/record.

8.8 Re-registration

Where permitted, a former user may later create a new account. Local Rahi does not guarantee restoration of deleted content or history.

8.9 Deletion Contact

Requests/questions may be submitted through the designated deletion page or hello@localrahi.com.

11. Location & Live Location Policy

11.1 Why Location Is Used

Pickup and destination selection.

Route/distance/ETA calculation.

Matching users travelling in compatible directions.

Pickup coordination.

Active-ride/live-location functionality.

Attendance and safety/dispute evidence where appropriate.

11.2 Permission

Local Rahi should request device location permission only when relevant to the feature. Where background or other sensitive location collection is required, a prominent disclosure should explain what is collected, why it is needed, and when it operates before the relevant permission request.

11.3 Live Location

During an active ride, Local Rahi may use live location to support pickup coordination, ETA and ride progress. Live location should be limited to legitimate ride participants and operational systems as appropriate.

11.4 When Live Sharing Stops

The production implementation should stop or materially reduce active live-location sharing when the relevant ride/feature ends, is cancelled, or no longer requires it, subject to limited retention of audit information legitimately needed for safety/disputes.

11.5 Accuracy

GPS, network conditions, device settings and map-provider data can be inaccurate or delayed. Local Rahi does not guarantee exact location, route, distance or ETA.

11.6 Location Evidence

Where a car owner records UNJOINED or a safety/attendance dispute occurs, Local Rahi may retain relevant location/timestamp evidence for investigation and audit, consistent with the Privacy Policy.

11.7 Denied Permission

Users may deny or revoke device permissions, but features that depend on location may become unavailable or limited.

11.8 Maps Provider

Maps/routes may rely on Google Maps Platform or another configured provider and are also subject to provider availability and applicable terms.

33. Privacy Data Inventory & Purpose Matrix

33.1 Identity/Profile

Name, mobile, optional email/photo and verification status are used for account operation, participant identification, security and support. Optional identity documents, where processed, require narrower access and retention.

33.2 Ride/Location

Pickup, destination, route, dates, times, matching data and live location are used to provide matching, navigation/ETA, active-ride coordination, attendance and dispute support. Live location should not be repurposed for unrelated tracking.

33.3 Financial

Payment/refund/reimbursement references and payout destination information are used to process transactions, reconcile providers, resolve disputes, prevent fraud and meet accounting/compliance needs.

33.4 Communications

Messages, call metadata and support communications are used to deliver communication functionality, investigate misuse and resolve disputes where appropriate. Access should be restricted and proportionate.

33.5 Device/Security

Device/session identifiers, IP information, notification tokens and security events are used for authentication, one-device enforcement, push notifications, abuse prevention and technical support.

34. Data Retention & Deletion Schedule Framework

34.1 Retention Principle

Local Rahi should not retain every data category indefinitely. Retention should be tied to account operation, active transactions, accounting/legal requirements, safety/fraud needs and dispute periods. The final schedule should identify category, purpose, normal retention period, deletion/anonymization action and lawful exception.

34.2 Identity Documents

Optional Government/Corporate verification documents require particularly careful retention. If a verification provider can return a verification result without Local Rahi storing a full document, Local Rahi should consider data minimization. The production provider and legal requirements must determine the final approach.

34.3 Location Evidence

Routine live-location data should not be retained longer than needed for the feature, while limited attendance/safety evidence may require a different retention period. The final policy should distinguish active location processing from retained audit evidence.

34.4 Transaction Records

Payment, refund and reimbursement records may need longer retention for accounting, tax, audit, fraud, chargeback and provider obligations even after account deletion. Such retention does not justify continued use for unrelated purposes.

34.5 Deletion Execution

Deletion should propagate through primary systems and, where feasible, downstream systems according to the retention policy. Backups may expire through normal backup rotation rather than immediate selective deletion if appropriately protected and not restored for ordinary use.

35. Location Permission & Disclosure Rules

35.1 Foreground Location

When the user actively selects pickup/drop, views a map or uses a ride feature, foreground location may be requested if needed. The app should still permit manual location selection where reasonably feasible.

35.2 Background/Sensitive Location

If production functionality requires background location, Local Rahi must provide a prominent in-app disclosure before the permission request explaining the data, purpose and circumstances of collection. App-store declarations must match actual behavior.

35.3 Participant Visibility

A rider should receive only the live-location information reasonably needed for the relevant active ride. Random unmatched users should not be able to track another user's precise live location.

35.4 End of Sharing

Live sharing should stop or materially reduce when the ride is completed/cancelled or the feature no longer needs it. Any retained location audit should follow a defined retention purpose.

36. Messaging, Calling & Contact Privacy

36.1 In-App Messaging

Messaging should be scoped to legitimate ride-related interactions. Separate chat rooms should be maintained where necessary so conversations with different riders are not mixed or disclosed to each other.

36.2 Direct Calling

Current direct calling may reveal actual telephone numbers depending on device implementation. Users should be informed of this in the Privacy Policy and relevant UI. Masked calling is a future capability and should not be claimed until implemented.

36.3 Contact Misuse

Phone numbers or communication channels obtained through Local Rahi must not be scraped, sold, published, used for spam or used to harass another person.

36.4 Evidence

Where permitted and technically available, relevant message/support records may be reviewed for a reported safety or policy issue. Local Rahi should not represent private communications as routinely monitored if they are not.

37. Optional Verification Operational Rules

37.1 Mobile OTP vs Profile Verification

The product must keep these concepts separate. OTP confirms control of the mobile number. Government ID Verified or Corporate Verified means only the applicable optional verification workflow succeeded.

37.2 User-Facing Labels

Use precise labels such as 'Mobile Verified', 'Government ID Verified', 'Corporate Verified' and 'Profile Unverified'. Avoid a broad 'Verified User' badge if it could imply background, vehicle or safety verification that Local Rahi did not perform.

37.3 Corporate Verification Limitation

Corporate verification should not imply employer sponsorship, endorsement or responsibility unless an actual arrangement exists and is clearly disclosed.

37.4 Revocation

A badge may be removed if the underlying verification expires, is found invalid, was obtained through false information or no longer satisfies the applicable verification criteria. Badge removal should not silently rewrite historical transaction records.

42. Account Deletion Operational Workflow

42.1 User Request

Provide an in-app Delete Account entry and a public web deletion resource. The user should be told that deletion is different from logout and that active financial/safety matters may need to finish or be retained.

42.2 Identity Confirmation

Use reasonable account-control verification such as a fresh OTP or authenticated session. Do not require payment secrets.

42.3 Transaction Check

Before final deletion, identify active rides, pending payments, refunds, reimbursements, chargebacks, disputes or safety investigations. The account may be closed to new activity while necessary records remain under restricted retention.

42.4 Deletion/Anonymization

Delete or anonymize profile and other personal data no longer needed. Preserve only categories supported by a legitimate retention purpose. Record that the deletion request was completed without retaining unnecessary deleted content.

42.5 External Providers

Where Local Rahi controls data held by processors, deletion/retention instructions should follow contractual/provider capabilities. Independent financial providers may retain records under their own legal obligations.

44. Security & Access-Control Policy

44.1 Secrets

Production API keys, payment secrets, OTP auth keys, database credentials and signing material must be stored in protected server/environment secret management and excluded from Flutter source, screenshots, logs and public repositories.

44.2 Least Privilege

Administrative and provider credentials should use the minimum permissions necessary. Production database and support access should be limited by role and reviewed periodically.

44.3 Authentication Abuse

OTP send/verify endpoints should enforce expiry, resend cooldown, attempt limits and rate limits by mobile/device/IP as appropriate. Development fixed OTPs must never be enabled in production.

44.4 Logging

Security logs should capture material authentication, payment and administrative events without logging sensitive credentials. Logs themselves are personal/security data and require access control and retention.

44.5 Incident Response

Local Rahi should maintain a practical process to identify, contain, investigate and recover from security incidents and to make any notifications required by applicable law or provider obligations.

Show the final total payable before authorization. Do not expose internal accounting components as separately itemized charges if the production UI does not itemize them. Show refund/cancellation information accessible before payment.

49.4 Profile Screen

Show precise verification labels and provide access to payout profile settings where applicable. Keep profile verification and vehicle verification separate.

49.5 Delete Account Screen

Explain permanent account closure, identity confirmation, effect on access and the possibility of lawful retention for transactions, fraud, safety, disputes and accounting.