1. Who we are
CarTogether is a community car buying platform for Delhi NCR. We organise verified buyer groups and a structured dealer bidding process. We do not sell vehicles and do not collect the vehicle purchase price. References to "CarTogether", "we", "us" or "our" mean the CarTogether platform operated for this service.
2. Information we collect
Buyer account and profile
- Name, Indian mobile number, optional email address, city and account status.
- Password hash if you set a password. We do not store plaintext passwords.
- OTP verification records, hashed OTP codes, attempts, expiry and related security data.
- Notification and contact preferences, language and purchase timeline.
Group and buying activity
- Car brand, model, variant, city, budget preference, financing preference and purchase window.
- Group memberships, verification status, withdrawal status and verification notes.
- Consent records, including the type, policy version, time and related group.
- Group activity events, status history and any notes you provide.
- Offers selected, handoff consent, bookings, delivery verification and related support records.
Dealer and dealership information
- Dealership legal and display name, contact person, business mobile, email, address and city.
- Authorized brands, service areas, business registration and manufacturer authorization details you submit.
- Documents uploaded for verification, offer data, review notes and fee agreement records.
Support and communications
- Support ticket content, contact details, category, subject, description and messages.
- In-app notifications and delivery attempt records. Where an external provider is configured, delivery metadata may be stored.
Technical and security data
- Session authentication cookie data, security logs, audit events and error diagnostics.
- Basic request metadata needed to operate and protect the service. The current product does not include advertising trackers or third-party analytics scripts.
3. Why we use personal information
- To create and secure accounts, verify mobile numbers and authenticate sessions.
- To form groups, check eligibility, verify memberships and coordinate dealer bidding.
- To prepare and review dealer offers and publish approved offers to eligible members.
- To record offer selections and handoff consent, and to support bookings and delivery verification.
- To provide support, investigate disputes, prevent fraud and abuse, and maintain platform security.
- To send transactional notifications and, where enabled, external email or WhatsApp messages you have requested.
- To maintain dealer commission and financial records and comply with applicable legal obligations.
- To improve the product using aggregated or de-identified operational data.
4. Consent and choices
Where consent is required, we ask for it separately and record the policy version and time. Group membership consent covers processing your membership for group verification and dealer bidding. Handoff consent is a separate action when you select a dealer offer. Marketing consent is optional and is not bundled with essential account processing.
You can withdraw group membership while withdrawal is permitted by the group workflow. Withdrawing consent for essential processing may mean we cannot continue providing the related service. External notification preferences can be changed in account settings where available.
5. When we share information
- With a dealership only after you select its published offer and consent to the handoff. The dealer receives the buyer details needed to continue the conversation and complete the sale.
- With service providers that help operate the platform, such as hosting, database, authentication, OTP, email, WhatsApp, storage and security providers, when configured for the environment. They process information for the service we request.
- With platform operations for membership verification, offer review, support, disputes, fraud prevention and compliance.
- For legal reasons where disclosure is required by law, court order or a lawful request, or necessary to protect rights, safety and platform integrity.
- In a business transaction such as a merger or acquisition, subject to appropriate confidentiality protections.
We do not sell personal information. Other public visitors see aggregate group counts, not your name or contact details.
6. Cookies and local storage
We use an essential, HTTP-only session cookie to keep you signed in. The current product does not use advertising cookies. If we add analytics or marketing tools in future, we will update this policy and any required choices before enabling them.
7. Retention
We keep personal information for as long as needed to provide the service, maintain security, resolve disputes and meet legal, tax and accounting obligations. Group and consent records may be retained to preserve membership history and demonstrate consent. Demo or seed data is separate from real user data and should be removed before production use.
8. Security
We use measures appropriate to the service, including password hashing, hashed OTPs, signed session tokens, restricted access, audit logs and database constraints. No internet service can be guaranteed fully secure. Protect your OTP and password, and contact us immediately if you suspect account misuse.
9. Your rights
Subject to applicable law, you may request access to your personal information, correction of inaccurate details, deletion, withdrawal of consent, or grievance redressal. Use the contact page and choose "Privacy request". We may verify your identity through your registered mobile number before acting. Some records may be retained where required by law or for legitimate dispute and fraud prevention purposes.
10. Children
The platform is intended for adults who can legally enter into vehicle purchase discussions. You must be at least 18 years old to create an account. We do not knowingly collect personal information from children.
11. Changes to this policy
We may update this policy as the product or legal requirements change. Material changes will be reflected in the policy version and, where appropriate, communicated in the app. The version and effective date at the top of this page apply.
12. Contact
For privacy questions or requests, contact us at hello@cartogether.example or through the contact page. The contact details published in this demo environment are placeholders until production details are confirmed.