Privacy Policy
We hold documents that prove who you are. This page explains exactly what we collect, why we need it, who else sees it, how long we keep it, and how to make us delete it.
The short version. We collect only what is needed to prove you are a real, licensed, commercial driver and to run the duty exchange. We never sell your data. We never show your customer's details to anyone you did not choose. Your Aadhaar number is masked and the raw number is scrubbed before storage. You can ask us to delete your account and data at any time.
1. Who we are
Dutiess ("Dutiess", "we", "us", "our") operates the Dutiess platform: the website at www.dutiess.com and the Dutiess Android application. Dutiess is a business-to-business duty exchange for verified commercial drivers, travel agencies and fleet operators in India. There are no passengers on the platform.
Dutiess is operated by [LEGAL ENTITY NAME], registered at [REGISTERED ADDRESS], India. For the purposes of the Digital Personal Data Protection Act, 2023 (DPDP Act), we are the Data Fiduciary for the personal data described in this policy, and you are the Data Principal.
2. What data we collect
We collect only the categories below. We do not collect anything else, and we do not buy personal data from third parties.
a. Data you give us directly
| Data | Examples | Required? |
|---|---|---|
| Phone number | Your 10-digit Indian mobile number, used as your account identifier and login | Yes |
| Name and date of birth | As printed on your identity and licence documents | Yes |
| Email address | For receipts and account notices | Optional |
| Gender and preferred language | Used to set the app language among 8 Indian languages | Optional |
| Verification documents | Aadhaar scan, driving licence, vehicle RC, commercial permit, insurance - see §4 | Yes |
| Photographs | A live selfie for the face check, and five photos of your vehicle | Yes |
| Duty content | Pickup and drop locations, timing, fare, vehicle requirement, tags and notes you write | Yes, to post |
| Your customer's details | Customer name, phone and note that you enter on a duty you post | Optional - see §2c |
| Ratings, reports and messages | Star ratings you give, reports you file, and anything you write to support | Optional |
b. Data generated by using the platform
- Location - your approximate coordinates while you are on duty (see §5).
- Device information - see §6.
- Activity records - duties posted, applications made, selections, completions, cancellations, ratings given and received, your reliability score, strike count, no-show count and late-cancellation count.
- Session records - login times, refresh tokens (stored only as a hash), a device identifier per logged-in device, and OTP challenge records (the code itself is stored only as a hash and expires quickly).
- Verification audit log - a record of each verification call made about you, what it returned, and what it cost, so decisions about your account can be explained and audited.
c. Data about your customers
When you post a duty you may enter your customer's name, phone number and a note. You are responsible for having a lawful basis to share those details with us and with the driver you select.
These details are hidden from everyone - including drivers who have applied - until you select a driver and press the share button yourself. We do not use your customers' details for marketing, we do not contact them, and we do not sell or transfer them to anyone.
3. Why we collect it
Under the DPDP Act we process your personal data on the basis of the consent you give during onboarding, and for the "legitimate uses" that Act permits. Specifically:
| Purpose | Data used |
|---|---|
| Create and secure your account; log you in | Phone number, OTP records, session tokens, device identifier |
| Verify that you are a real, licensed, commercial driver - the core promise of the platform | Aadhaar scan, driving licence, RC, permit, insurance, live selfie |
| Show you duties near you and calculate distances | Approximate location while on duty |
| Run the exchange - post, apply, select, complete, rate | Duty content, applications, ratings |
| Keep the network trustworthy - reliability scores, strikes, fraud and duplicate detection | Activity records, reports, licence and registration numbers |
| Send you duty alerts and account notices | Push token, phone number |
| Provide support and respond to your enquiries | What you send us, plus your account record |
| Meet legal, tax and law-enforcement obligations | Whatever the applicable law requires |
We do not use your data for behavioural advertising, and we do not build advertising profiles.
4. Verification documents
Verification is the reason the platform works, so it is also where we are most careful.
- Aadhaar. You scan your Aadhaar so we can read your name and date of birth. We store
only a masked form (for example
XXXX XXXX 5647) plus the name and date of birth. The full Aadhaar number is scrubbed before storage and is never displayed anywhere in the app or admin. We are not an authentication user agency and we do not perform Aadhaar e-authentication. - Driving licence. Your DL number is checked against the government Sarathi database. We store the licence number, status, name, date of birth, validity, vehicle classes and the official photograph returned by that check. The DL number is unique across the platform, which is how we stop the same licence being used for two accounts.
- Vehicle RC. Your registration number is checked against VAHAN. We store the registration number, status, owner name as recorded there, maker, model, category, seats, commercial status and expiry. The registration number is also unique across the platform.
- Commercial permit and insurance. Read from the documents you upload, to confirm the vehicle is licensed for commercial use. Private vehicles cannot onboard.
- Live photo and face match. You take a live selfie. We run a liveness check to confirm you are a person rather than a photograph, then compare that selfie with the official photograph from your licence record. We store the selfie, the liveness result and confidence, and the match result and similarity score.
A mismatch never auto-rejects you. If any check disagrees with another, your application is flagged and sent to a human reviewer. We do not make solely automated decisions that block a driver from earning.
We do not compare your identity against the RC owner's name - leased and fleet-owned vehicles are normal in this industry, and treating them as suspicious would exclude honest drivers.
5. Location data
- We collect your approximate coordinates, and only while your account is switched on duty. Switch off duty and collection stops.
- We store your last known position only - we do not keep a location history or a trail of your movements, and we do not track you between duties.
- It is used for two things: showing you duties near you, and calculating the "km away" figure on each duty card. We compute this ourselves rather than sending your position to a mapping provider.
- Your exact coordinates are never shown to other users - they see a distance, not a location.
- You can refuse or revoke the location permission in Android settings. The app still works; you will see duties without distance sorting.
6. Device information
We collect a limited set of technical information: device model and operating-system version, app version, preferred language, a device identifier tied to your login session, a push-notification token, and IP address and standard log data when your device contacts our servers.
This is used to deliver notifications, keep sessions secure, detect abuse such as one person operating many accounts, and diagnose crashes. We do not use device advertising identifiers.
7. Cookies
The Dutiess Android app does not use cookies. It stores your session token in the device's secure storage so that you are not logged out every time you close the app.
The website uses only what is strictly necessary to serve pages and keep them secure. We do not run advertising or cross-site tracking cookies. Full detail, including how to control them, is in our Cookie Policy.
8. How data is stored
- Where. Data is stored on servers located in India. We do not routinely transfer personal data outside India; if that ever changes, we will update this policy and comply with the restrictions under the DPDP Act.
- In transit. All traffic between your device and our servers is encrypted with TLS 1.2 or higher. The website is served over HTTPS only.
- At rest. Databases and document storage sit on encrypted volumes with restricted network access.
- Secrets. Passwords are not used - login is by OTP. OTP codes and refresh tokens are stored only as one-way hashes, never in readable form.
- Access. Documents and audit trails are reachable only through an authenticated admin interface, limited to the small number of staff who run verification review, and every access is logged.
- Backups. Encrypted backups are taken regularly and are subject to the same retention rules as live data.
More detail is on our Security page.
9. Who we share data with
We do not sell your personal data, and we never will. We share it only in these situations:
- With other users, deliberately. Your driver card - photo, name, vehicle, verification badges, star rating, reliability score and duty count - is visible to other verified users on the platform. Your phone number becomes visible to the other party once a duty is agreed, because the two of you have to coordinate.
- With the driver you select. Your customer's details go to exactly one driver, only when you press share.
- With verification and infrastructure providers. See §10. They act on our instructions and may not use your data for their own purposes.
- With authorities. Where we are legally required to, or where it is necessary to investigate fraud, a safety incident or a crime.
- In a business transfer. If Dutiess is acquired or merged, data may transfer to the acquirer, who will remain bound by this policy. We will notify you.
10. Third-party services
| Service | What it does | What it receives |
|---|---|---|
| eKYC verification provider | Runs the Sarathi licence check, the VAHAN registration check, document OCR, the liveness check and the face match | Your licence number, registration number, document images and selfie |
| SMS provider | Delivers your login OTP | Your phone number |
| Push notification service | Delivers duty alerts and URGENT alerts to your device | Your push token and the notification content |
| Cloud hosting and CDN | Runs our servers, database and website | All platform data, encrypted, under contract |
| Google Fonts | Serves the typefaces used on this website | Your IP address and browser type when a font loads |
Government databases (Sarathi, VAHAN) are queried through our verification provider. We do not send them anything beyond the identifiers required for the check.
11. How long we keep data
| Data | Retention |
|---|---|
| Account profile and verification documents | While your account is active, then up to 90 days after deletion |
| Verification audit log | Up to 3 years, to evidence why a driver was approved or rejected |
| Duty, application and rating records | Up to 3 years - they underpin reliability scores and dispute resolution |
| Customer details on a duty | Deleted 90 days after the duty is completed or cancelled |
| Reports, strikes and safety investigations | Up to 5 years, or until an investigation closes, whichever is later |
| OTP challenges | Minutes - they expire and are purged |
| Session and refresh tokens | Until expiry or logout, then purged |
| Location | Last known position only; overwritten each update, cleared when you go off duty |
| Support correspondence | 2 years |
Where an account has been removed for fraud or a serious safety breach, we retain the minimum identifiers needed to stop that person re-registering.
12. Your rights
Under the DPDP Act you have the right to:
- Access - get a summary of the personal data we hold about you and what we do with it.
- Correction - have inaccurate or incomplete data corrected, and outdated data updated.
- Erasure - have your data deleted where we no longer need it for the purpose it was collected, or where you withdraw consent, subject to §11.
- Withdraw consent - as easily as you gave it. Note that verification consent is fundamental to the service: withdraw it and the account can no longer operate.
- Nominate - name someone to exercise these rights on your behalf if you die or become incapacitated.
- Grievance redressal - complain to us first (see §15), and escalate to the Data Protection Board of India if you are not satisfied with our response.
To exercise any of these, email hello@dutiess.com from your registered email address, or write from the phone number on your account. We respond within 30 days. We may ask you to confirm your identity first - that check protects you.
13. Children
Dutiess is only for licensed commercial drivers and the businesses that employ them. You must be 18 or older to hold an account. We do not knowingly collect data from anyone under 18; if we discover that we have, we delete it and close the account.
14. Changes to this policy
We will update this page when the product or the law changes. The "last updated" date at the top always reflects the current version. For any change that materially affects your rights, we will give notice in the app before it takes effect.
15. Contact and grievances
For any privacy question, request or complaint, contact our Grievance Officer:
- Email - hello@dutiess.com (subject line: "Privacy")
- Grievance Officer - [GRIEVANCE OFFICER NAME], [LEGAL ENTITY NAME]
- Address - [REGISTERED ADDRESS], India
- Response time - acknowledgement within 72 hours, resolution within 30 days
If we do not resolve your complaint, you may escalate it to the Data Protection Board of India under the DPDP Act.
Related: Terms & Conditions · Cookie Policy · Verification Policy · Security