1. Scope
This policy covers the Sarathi mobile application, public website and Sarathi API. Sarathi is an independent Bengaluru public-transport companion. It is not an official BMTC, BMRCL, Indian Railways or government service.
2. Data we handle
| Data | Where and why | Typical retention |
|---|---|---|
| WhatsApp mobile number | Received during login and sent to the configured WhatsApp delivery provider. The account database stores the normalized full number (E.164), a keyed hash, and last-digit display fields. | Retained with the account until deletion. Also processed by the delivery provider according to its service terms. |
| OTP challenge | Hashed code, challenge ID, attempt count and installation binding in Redis. | About 5 minutes. Abuse counters last from minutes to one day. |
| Account and session | Random user ID, full normalized phone number, phone lookup hash, last-digit display fields, accepted policy version, login timestamps, installation ID and hashed rotating refresh token. | Until account deletion. Sessions remain until logout, revocation, account deletion or operational cleanup. |
| Official-app proof | Installation ID, public verification key, app version and Google Play Integrity verdict. Private device keys never leave Android Keystore. | While the installation is active, then according to security cleanup procedures. |
| Journey inputs | Origin, destination, time and preferences are processed to calculate routes. Raw coordinates are not intended for analytics logs. | Request processing and short caches. Coarse location cells may be used for operational measurement. |
| Saved places and recent journeys | Stored locally on your device by default. | Until you clear them, clear app data or uninstall. |
| Feedback and diagnostics | Feedback text, affected route/stop, app and dataset version, and a request reference when you choose to send it. | Until reviewed and purged under the operator’s support schedule. |
3. Why we use data
- Authenticate the person controlling the WhatsApp number and keep their installation signed in.
- Calculate, display and improve requested public-transport journeys.
- Detect OTP abuse, automated scraping, repacked apps, request tampering and stolen-session reuse.
- Respond to feedback, investigate failures and maintain reliable datasets.
- Meet applicable legal, security and incident-response obligations.
Sarathi does not sell personal data. Journey inputs are not used to build advertising profiles.
5. Retention and deletion
OTP material expires automatically. Access tokens expire after a short period. Refresh sessions rotate and can persist so normal users are not repeatedly logged out. The app stores the current refresh token in protected device storage; the server stores only a keyed hash.
Deleting the app removes the device copy of the login token, but the server cannot reliably detect an uninstall. To remove the server account, sign in again with the same number and use Settings → Delete account. This deletes the account and its login-session records. Security or incident records may be retained separately where reasonably necessary or legally required.
6. Your choices
- Access: see the masked account number and session status in Settings.
- Withdraw from the service: log out or delete the account from Settings.
- Local data: clear recent places in Settings; remove other local data through the relevant saved-items screen or app-data controls.
- Analytics: use the Settings control to turn optional product analytics off.
- Correction or grievance: use Settings → Send feedback and state that the request concerns personal data.
7. Security
Sarathi uses short-lived access tokens, rotating refresh tokens, keyed hashes, OTP attempt limits, replay detection, per-installation request signatures and Google Play Integrity checks. Private signing keys remain in Android Keystore when supported. Transport encryption and production secret management are deployment requirements.
No system is risk-free. If we confirm an incident affecting personal data, we will follow the notification and remediation requirements that apply to the service at that time.
8. Age
Sarathi account creation is currently intended for people aged 18 or older. We do not currently provide the verified parent or guardian consent flow needed for a child’s account. A younger traveller should use the service with a parent or guardian and should not create an account independently.
9. Questions, rights and grievances
Open the Sarathi app and use Settings → Send feedback. Include “Privacy request” at the beginning and describe whether you want access, correction, deletion or another review. Do not place OTPs, refresh tokens or unrelated sensitive information in the message.
Privacy questions, access, correction or deletion requests can be sent to:
AUMLayer Cloud Labs LLP
Email: [email protected]
Phone: +91 81510 39365
Website: aumlayer.com
Please identify the request as a “Privacy request” and do not send OTPs, access tokens, refresh tokens or other authentication secrets.
10. Changes to this policy
Material changes will receive a new version and effective date. When consent is required again, the app will ask before completing the next login. Older copies remain in source control for audit history.