Privacy Policy

Application: AUTOSherpa Auction
Operated by: Yocoya Technologies & Services LLP
Last Updated: [DATE OF PUBLICATION]
Effective Date: [DATE OF PUBLICATION]

1. Introduction

AUTOSherpa Auction (“App,” “Service,” “Platform,” “We,” “Us,” “Our”) is a product of Yocoya Technologies & Services LLP (“Yocoya”). This Privacy Policy explains how we collect, use, disclose, store, and protect your personal information when you use the App (iOS and Android) and related web administration platforms.

By using the App, you consent to the collection and processing of your personal information as described here. If you do not agree, please do not use the App.

1.1 KYC Verification and What We Still Do Not Collect

We want to be upfront about this. As of the date of this Policy:

  • We collect and verify KYC (identity and business verification) documents from Buyers — specifically an Aadhaar card, GST registration certificate, PAN card, and a signed Dealer Trade Agreement — before a Buyer can bid on an Auction. See Section 4.1.1 for how these documents are collected, used, protected, and retained. Sellers are not currently required to provide KYC documents.
  • We do not collect or process any payment or Security Deposit information within the App. All deposit and vehicle-payment amounts are agreed and settled directly between Buyers and Sellers, outside the App (see our Terms and Conditions, Section 6).

We may introduce in-app payment collection, and may extend KYC verification to Sellers, in the future — if we do, we will update this Policy in advance and, where required by law, obtain your fresh consent before collecting that additional data.

2. Definitions

  • “Personal Information” means any information that identifies, relates to, or could reasonably link to you.
  • “User” means any person who registers for and uses the App, including Buyers and Sellers.
  • “Buyer” means a registered User who participates in Auctions to purchase vehicles.
  • “Seller” means a registered User (individual or dealership business) who lists vehicles for Auction.
  • “KYC” means Know Your Customer identity and business verification. For Buyers, this currently means an Aadhaar card, GST registration certificate, PAN card, and signed Dealer Trade Agreement — see Section 1.1 and Section 4.1.1.
  • “Dealership Operator” / “Tenant” means a dealership that licenses a white-labelled instance of the Platform and operates its own Super Admin/Admin over its own Buyers and Sellers.
  • “Data Controller” means the entity responsible for determining the purposes and means of processing personal data — for this App, that is Yocoya (or, for a white-labelled instance, jointly Yocoya and the relevant Dealership Operator, as described in Section 7.1).
  • “Data Processor” means a third-party service provider that processes personal data on our behalf.

3. Applicability and Scope

This Policy applies to personal information collected through the AUTOSherpa Auction mobile application, our web administration platforms, and information automatically collected by our systems.

  • Geographic Scope: Currently available in India. If we expand internationally, the applicable privacy laws of your jurisdiction will apply in addition to this Policy.
  • Applicable Law: This Policy is designed to comply with India’s Digital Personal Data Protection Act, 2023 (DPDPA) and other applicable Indian privacy regulations.
  • Multi-Tenant / White-Label Notice: AUTOSherpa Auction may be licensed to individual dealerships as a white-labelled platform. If you register under a specific dealership’s instance of the App, that dealership’s Super Admin will be able to see the personal information and activity of Users registered under their instance, for the purpose of operating and moderating that instance (see Section 7.1).

4. Information We Collect

4.1 Information You Provide

Registration & Account Information:

  • Full name / contact person name (or business name, for Sellers/dealers)
  • Email address
  • Mobile phone number
  • Password (securely hashed — never stored in plaintext)
  • State, city, PIN code, and address
  • Username

We do not currently collect date of birth. Age eligibility (18+) is a self-declaration made when you agree to our Terms, for both Buyers and Sellers.

KYC Documents (Buyers only):

  • Aadhaar card (or other accepted government-issued identity proof)
  • GST registration certificate
  • PAN card
  • Signed Dealer Trade Agreement

4.1.1 KYC Documents — Additional Safeguards

  • Purpose limitation: KYC documents are used only to verify your identity and business legitimacy as a condition of granting bidding access, and for fraud/regulatory investigations described in these Terms. They are not used for marketing, profiling, or any other purpose.
  • Restricted access: KYC documents are visible only to the Admin/Super Admin responsible for reviewing your registration. They are never shown to other Buyers or Sellers.
  • Aadhaar handling: where reasonably possible, we display and store only a masked version of your Aadhaar number (showing the last 4 digits) once verification is complete, consistent with UIDAI guidance for private entities.
  • Retention: see Section 8 for how long KYC documents are retained.
  • No automated Aadhaar authentication: we do not use UIDAI’s Aadhaar-based OTP/biometric authentication system; KYC review is a manual document check.

Vehicle Information (provided by Sellers, and viewable by approved Buyers):

  • Vehicle photographs and videos
  • Vehicle specifications (make, model, year, variant, fuel type, mileage, etc.)
  • Registration number and RC status
  • Inspection/condition ratings
  • Loan/hypothecation status and legal/police-case status
  • Accident/damage history

Financial Information: We do not currently collect Security Deposit amounts, payment details, or any other financial/payment data.

Communication Data:

  • Chat messages between Buyers and Sellers, including any shared documents.
  • Support messages sent to Admin/Super Admin.
  • Ratings and reviews you provide.

4.2 Information Automatically Collected

Device Information: device model/manufacturer, operating system and version, app version, device language.

Network & Usage Information: IP address, mobile network/ISP information, screens accessed, features used, bidding history, session duration.

4.3 Location Information

  • Precise location (GPS): collected only during registration, and only if you grant permission.
  • If you do not grant permission: you can enter your location manually instead.
  • How to control: you can disable location permission at any time via your device settings.

4.4 Device Permissions

  • Camera / Photo Library: used to upload vehicle photos and documents.
  • Location: registration only, with permission.
  • Contacts: we do not access your device contacts.

4.5 Third-Party Services That Process Data On Our Behalf

Provider What It Processes Purpose
MongoDB Atlas All account, vehicle, auction, and chat data Database hosting
Firebase (Google) Device push-notification tokens Delivering push notifications
Zoho Mail Your email address, message content Sending transactional emails
Socket.IO Chat messages, live bid updates Real-time chat and live auction updates
  • Contractual necessity: creating and managing your account, enabling auctions.
  • Legitimate interests: platform security, fraud prevention, service improvement.
  • Legal obligations: responding to lawful court orders, DPDPA compliance.
  • Consent: collection of KYC documents, optional notifications.

6. How We Use Your Information

  • Service delivery: managing your account, facilitating chat and bids.
  • Buyer identity verification: reviewing KYC documents.
  • Security & fraud prevention: detecting abuse, fake listings, shill bidding.
  • Legal & compliance: responding to lawful requests.
  • Service improvement: analyzing usage patterns.
  • Communications: sending transactional notices.

7. Data Sharing & Disclosure

7.1 With Your Dealership Operator

If registered under a white-labelled instance, that dealership’s Admin can see necessary information to moderate and verify users.

7.2 Between Platform Users

  • Visible to other Users: Seller business name, location, vehicle listings.
  • Never shared: your password, KYC documents, and full address (except for delivery).

7.3 Service Providers

We share information with third-party providers strictly to enable their services (Section 4.5).

7.4 Legal & Regulatory Disclosures

We may disclose information where required by court order or law enforcement.

7.5 Business Transfers

In the event of a merger or acquisition, personal information may be transferred.

7.6 What We Do Not Do

We do not sell your personal information to data brokers or advertisers.

8. Data Retention

Data Category Retention Period Reason
Active account data Duration of your account Service delivery
Buyer KYC documents [Placeholder — up to 5 years after account closure] Regulatory/audit trail, fraud investigation
Vehicle listing data Duration of listing/auction Platform record-keeping
Chat messages Up to 2 years Dispute resolution
Usage/device data Up to 1 year Service improvement
Deleted accounts Grace period of 30 days for recovery Recovery window, legal requirements

8.1 Deleting Your Account (Self-Service)

You can permanently delete your account directly within the App. Upon deletion, your profile is removed, but certain regulatory records (like KYC) are retained for audit purposes.

9. Data Security

We use HTTPS/TLS encryption for data in transit and encrypt data at rest. Passwords are securely hashed. Buyer KYC documents are stored encrypted, with restricted access. If a confirmed security incident occurs, we will notify affected Users.

10. Your Privacy Rights

Under applicable law, you have the right to Access, Correction, Deletion, Data Portability, and Consent Withdrawal. You can exercise these rights via App Settings or by emailing [CONFIRM PRIVACY EMAIL ADDRESS].

11. Children’s Privacy

The App is intended for Users 18 years and older only. We do not knowingly collect data from minors.

12. International Data Transfers

Some of our service providers may process data outside India. We rely on their standard data-protection safeguards.

13. Third-Party Links

The App may contain links to third-party websites. We are not responsible for their privacy practices.

14. Sensitive Information We Handle

We handle government identity information (Aadhaar, GST, PAN) as part of KYC verification. We do not handle financial/banking or payment card information.

15. Platform Moderation & Reporting

Vehicle listings are reviewed by an Admin. You can report objectionable content or block other users through the App’s reporting features. Chat messages are not pre-screened.

16. Marketing & Communications

Transactional communications cannot be disabled. Promotional communications are optional and can be managed in App Settings.

17. Policy Changes

We may update this Policy from time to time. Material changes will be communicated in advance.

18. Contact Information & Grievance Redressal

Yocoya Technologies & Services LLP
3rd Floor, No. 19/3, Srinivasa Industrial Estate, Kanakapura Main Road, Konankunte, Bengaluru, Karnataka, 560062, India

  • Privacy inquiries / data requests: [CONFIRM EMAIL]
  • General support: [CONFIRM EMAIL]

19. Acknowledgment

By using the App, you acknowledge that you have read and understood this Privacy Policy.