Your data, protected
We collect only what we need, protect what we hold, and give you full control over your information. Here's exactly how.
What we collect — and what we don't
Full transparency, no surprises. Here's an honest breakdown of your data and how it's used.
What we collect
- Name, phone number and email (for your account)
- Trip origin, destination and route
- Payment method identifiers (never full card numbers)
- App usage patterns (to improve the product)
- Device type and OS version (for technical support)
What we never collect
- Full payment card numbers — handled by PCI-compliant processors
- Photos or recordings inside vehicles
- Your location when the app is closed
- Contacts from your phone
- Any data not listed in this policy
How we keep your data secure
Multiple layers of technical and operational security, so your information stays yours.
End-to-end encryption
All data in transit is encrypted with TLS 1.3. Sensitive data at rest uses AES-256 encryption — including your location history and payment tokens.
Masked phone numbers
Your real mobile number is never shared with drivers or other riders. All in-app calls and messages go through an encrypted relay that hides both numbers.
Access control
Only authorised team members with a legitimate operational need can access your personal data — and every access is logged and audited.
Minimal data retention
We only keep your data for as long as necessary. Trip data older than 24 months is automatically anonymised. Deleted accounts are purged within 30 days.
You're in control
Under India's PDPB framework and global best practices, you have clear rights over your data. Here's how to exercise them.
Right to access
Request a full export of all data we hold about you at any time from Account → Privacy → Download my data.
Download your data →Right to correct
Found an error in your profile? Update it directly in the app or contact support and we'll fix it within 5 business days.
Update your profile →Right to delete
Delete your Rutur account and all associated personal data from Account → Privacy → Delete account. Processing takes up to 30 days.
Delete your account →Right to portability
Export your data in a machine-readable format (JSON). Useful if you're moving to another service and want to take your history.
Export your data →Built for compliance, designed for trust
Rutur is designed to meet the requirements of India's Personal Data Protection Bill and follows international best practices aligned with GDPR principles — not because we have to, but because it's the right standard to hold ourselves to.