Legal

Privacy Policy

Last updated: 8 October 2026

This Privacy Policy explains how MyGarage360 — a brand of Shantiverse, a sole proprietorship registered in India ("we", "us", "our") — collects, uses, shares, keeps and protects personal data when you use our website, app and QR stickers (the "Service"). It is written to meet the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Information Technology Act, 2000 and its rules. Read it together with our Terms & Conditions.

We ask for your consent when you create your account or set a new PIN, by a tick box that is never pre-ticked. You can withdraw consent at any time by deleting your account from Profile → Your data & privacy. Withdrawing consent stops future processing; it does not affect processing already done lawfully.

1. Who this policy covers

Account holders — people who sign up and register vehicles.
Emergency contacts — a person an account holder lists to be called if the owner can't answer (see section 5).
People who scan a vehicle QR — anyone who opens a vehicle's contact page (see section 6).

2. What we collect from account holders

Account: your mobile number (to sign in with OTP/PIN), and — only if you add them — your name, email and profession. Your login PIN is stored only as a secure one-way hash.
Vehicles: make, model, year, variant, fuel/body type and registration number.
Documents: documents you upload (for example insurance, PUC, RC, driving licence) and the expiry details read from them, so we can remind you before they expire.
Vehicle registration lookup (only if you ask): when you tick the consent box and tap "Fetch my vehicle details", we send your vehicle's registration number to our verification partner (IDSPay), which returns details from government vehicle and e-challan records. We keep only vehicle details, validity dates and challan details — make, model, fuel, registration date, RC status, insurer and insurance, PUC, RC and road-tax validity, and each challan's number, date, place, offence, amount and status — and use them for your reminders. We only look these up when you ask, at most once per vehicle per calendar month; there are no automatic re-checks. We do not keep the owner's name, father's name, address, phone number, or chassis and engine numbers that the records may contain.
QR settings: contact preferences, parking mode, Do Not Disturb, location-share and stolen-vehicle status.
Scan history & alerts: when your QR is scanned: the time, device type, the scanner's message and — only if the scanner chooses to share it — location.
Orders & delivery: stickers are currently sold on marketplaces such as Amazon and Flipkart, which handle your payment and delivery details under their own privacy policies. If you later order directly from our website, we will collect your delivery address and order details; payments will go through payment providers and we will never store full card or bank account numbers.
Technical & security data: basic logs (time, request type, a one-way hash of the network address on scan records) needed to run and protect the Service.

3. Why we use it

To sign you in and run your garage dashboard, QR contact pages, document reminders, parts lookup and AI Mechanic.
To connect someone who scans your QR with you (or your emergency contact) using the settings you choose.
To process and deliver sticker orders.
To send service messages — OTPs, scan and emergency alerts, and replies to support requests.
To keep the Service secure, prevent misuse (for example rate limits on calls and messages) and meet legal duties.

We use your data only for these purposes. We do not sell personal data and we do not use it for third-party advertising.

4. Number masking

A Smart QR connects callers through our telephony partner so your number isn't printed on the sticker or shown on the contact page. A Free QR may show your number to anyone who scans it. Choose the option that suits you; you can change your contact settings anytime.

5. Emergency contacts

If an account holder adds an emergency contact, we store that person's name and mobile number. The account holder must confirm the contact has agreed before we save a new number. People who scan the QR never see the emergency contact's name or number — we only connect the call. An emergency contact can ask us to remove their number at any time by writing to the Grievance Officer (section 15), and it is deleted when the account holder removes it or deletes their account.

6. People who scan a vehicle QR

You don't need an account to use a vehicle's contact page. To connect you with the owner we process only what you give us:

Your mobile number, if you place a masked call — used to route the call and to apply fair-use limits. Limit counters (with your number and network address) are kept for the current day only.
Your message and the alert type you pick, which are delivered to the owner.
Your location, only if you tap a share-location button and allow it in your browser. It is sent to the owner.
Scan details — time, device type and a one-way hash of your network address — so the owner gets a scan alert and we can stop misuse.

Messages, alerts and shared locations are visible to the vehicle owner and are kept as described in section 9. To ask about or remove data you sent, contact the Grievance Officer.

7. AI processing

To read expiry dates from documents you upload, and to answer AI Mechanic questions, we send the document image/PDF or your question (with basic vehicle details) to AI service providers such as Groq, Google (Gemini) and Anthropic. They process it to return a result and may do so on servers outside India. Don't include unnecessary personal details in AI Mechanic questions. AI output is informational only (see our Terms).

8. Who we share data with

We share personal data only with service providers that help us run the Service, under contracts that limit them to our instructions:

Cloud hosting and storage (including Amazon Web Services).
SMS / OTP delivery (2Factor) and call connection (TeleCMI / PIOPIY).
AI providers listed in section 7.
Bot protection on sign-in (Cloudflare Turnstile), when it is shown.
Vehicle registration (IDSPay) and challan data providers, only when you request a lookup — we send the registration number only.
Payment and delivery partners, when you place an order.

We may also disclose data when required by law or a lawful order of a court or government authority. We link to official portals (IIB, VAHAN/Parivahan, Sarathi, eChallan, NETC FASTag) and to marketplaces (such as Amazon and Flipkart); those sites have their own privacy policies.

9. How long we keep data

Data	How long
Account, profile, vehicles, documents, QR settings	While your account is active. Erased when you delete your account.
Scan history, owner alerts, scanner messages and shared locations	180 days, then deleted automatically (or earlier if you delete your account).
Daily call / message limit counters (scanner number, network address)	The current day only.
Login sessions	Up to 30 days.
OTP codes	Deleted once used, or about a day after they expire.
Order and invoice records	As long as tax and accounting laws require, even after account deletion (unlinked from your account).
Security logs	Up to 180 days, as required for incident handling.

10. Your rights

Access: download a copy of your data from Profile → Your data & privacy → Download my data.
Correction: edit your profile, vehicles, documents and addresses in the app at any time.
Erasure & withdrawing consent: delete your account from Profile → Your data & privacy. Your QR stickers then stop working and cannot be reused by anyone else.
Optional features: turn location sharing, parking mode, Do Not Disturb and stolen alerts on or off.
Nomination: you may nominate a person to exercise these rights if you die or become unable to — write to the Grievance Officer.
Grievances: contact the Grievance Officer (section 15). If you are not satisfied with our response, you may complain to the Data Protection Board of India.

11. Security & data breaches

We use reasonable safeguards, including encrypted connections (HTTPS), hashed PINs, server-side encryption for archived documents, access controls and rate limits. No system is perfectly secure, so keep your PIN and device private. If a personal-data breach happens, we will inform affected users and the Data Protection Board of India, and report to CERT-In, as the law requires.

12. Cookies & local storage

We don't use advertising or analytics cookies. We use your browser's local storage to keep you signed in and to remember preferences such as light/dark theme. Clearing your browser data signs you out.

13. Children

The Service is only for people aged 18 or over. We do not knowingly collect data from children; if you believe a child has signed up, contact us and we will delete the account.

14. Changes to this policy

If we change this policy materially, we will update the date above and tell you in the app. Where the law requires, we will ask for your consent again before using your data in a new way.

15. Contact & Grievance Officer

For privacy questions, to exercise your rights, or to raise a complaint, contact our Grievance Officer. We acknowledge complaints within 24 hours and aim to resolve them within 15 days.

Grievance Officer, Shantiverse (MyGarage360)
support@mygarage360.com · hello@mygarage360.com
Phone / WhatsApp: +91 77778 06966

Home About Us Terms & Conditions Refunds & Cancellations Shipping & Delivery Contact Us Careers