Privacy policy

Who we are

Cosmic Cabs operates a self-drive vehicle rental platform in Goa. For privacy queries, contact info@cosmiccabs.com.

Data we collect

• Identity & contact: name, mobile number, email, driving licence, government ID
• Booking & trip: pickup/drop locations, dates, vehicle details, condition photos
• Payment: transaction references via Razorpay (we do not store full card numbers)
• Vendor/fleet: business name, KYC documents, payout details
• Technical: session cookies, device tokens, server logs, error reports

Why we use it

• Verify identity and eligibility (21+, valid licence)
• Create and fulfil bookings; share necessary contact details with your assigned fleet partner when you consent
• Process payments, settlements, and support requests
• Send booking updates (transactional SMS/email/WhatsApp/push)
• Comply with law, resolve disputes, and prevent fraud

Processors & sharing

We do not sell personal data. We share data only as needed to operate the service:

• Fleet partners: your name and phone (when you consent at checkout) so they can coordinate pickup and handover
• MSG91: OTP SMS (India)
• Razorpay: Payments & vendor payouts (India)
• Cloud storage (AWS S3 / Supabase): ID/KYC & booking media (Configurable region)
• Email provider: Transactional email (As configured)
• Sentry (optional): Error monitoring (United States — PII scrubbed)

Where data may be processed outside India (e.g. optional error monitoring), we use contractual safeguards and minimise personal data in transit.

Retention

• OTP requests: 48 hours after expiry
• Email verification OTPs: 48 hours after expiry
• Revoked/expired refresh tokens: 30 days
• Audit logs: 24 months
• Webhook events: 90 days
• Read in-app notifications: 90 days
• Server/access logs: 30–90 days (rotation)
• Database backups: ~14 days roll-off; disaster recovery only
• Bookings, payments, settlements: Retained for legal/accounting (PII scrubbed on account delete)
• ID/KYC images: Deleted on account closure; otherwise while account active

When you delete your account, we scrub profile PII and remove ID images from storage. Bookings and payment records are retained in anonymised/tombstone form for legal and accounting requirements. Backup snapshots may retain deleted data until they roll off (~14 days); they are used for disaster recovery only, not to restore closed accounts.

Cookies & sessions

We use httpOnly session cookies for sign-in. Razorpay checkout may set cookies/scripts on the payment page. See your browser settings to manage cookies.

Your rights

• Access: export your profile and booking list from Account settings or email us
• Correction: update profile or re-upload ID documents in the app
• Erasure: delete your account in Account settings (subject to active booking/settlement blockers)
• Withdraw consent: opt out of optional marketing channels in notification preferences; contact-share consent for an active booking generally cannot be withdrawn after a fleet partner is assigned

Grievance redressal

Grievance Officer
Email: info@cosmiccabs.com
Address: Goa, India
We aim to respond within 90 days.

For privacy requests, include “privacy-request” in the subject. See also our contact page.

Photos & third parties

Condition and dispute uploads should show only the vehicle and booking-related damage. Photos may incidentally capture bystanders or licence plates — upload only what is necessary. Dispute photos may be retained until the dispute is resolved.