Pitbay — Privacy Policy

Effective: 12 May 2026 · Last updated: 12 May 2026

This Privacy Policy explains what information Pitbay ("we", "us") collects when you use our applications — the Pitbay customer app, the Pitbay center app, and the Pitbay admin console — and how that information is used, shared, and protected. It applies to all three apps. If a section applies to only one app, we say so.

In short: we collect what we need to run a car-wash booking marketplace — your name, mobile, vehicle plate, booking history, and (for centers) bank details for settlement. We don't sell your data. We share only what the other side of a booking needs to fulfill it.

1. Who runs this service

Pitbay is operated by the team listed below. If you have any privacy question, write to us at support@pitbay.in.

Operator: Pitbay Technologies (placeholder — to be updated when legal entity is registered)
Country: India
Contact: support@pitbay.in

2. Information we collect

2.1 Customer app

Identity: full name, mobile number, email address (used as your login identifier and for booking confirmations).
Vehicles: registration plate, make/model, colour, primary-vehicle flag.
Addresses: labels (Home / Office / etc.), full address and pincode you save for door-to-door bookings.
Bookings: chosen center, package, slot date and time, vehicle used, promo code applied.
Ratings & reviews: stars and optional comment you submit after a wash.
Chat messages: messages you send to Pitbay support, plus replies.
Device data: a long-lived authentication token stored locally on your device (browser localStorage or app secure storage). We do not use third-party advertising or analytics cookies.

2.2 Center app (wash center owners / staff)

Center identity: business name, owner name, mobile number, email, address, city, GSTIN (if provided), wash types offered, opening hours.
Bank details: account number, IFSC code, account-holder name, bank name — used to credit Pitbay settlements to your account.
Geo-coordinates: latitude and longitude of your center, so the customer app can show you on a map.
Operational data: bookings received, packages offered, slot blocks, photos taken before and after a wash (uploaded by your staff), responses to customer reviews.

2.3 Admin / super-admin console

Authentication: a shared API key (no per-user login at this stage).
Audit log: every action taken by an admin (e.g. "marked settlement", "edited center info") is recorded with the actor's name, the change made, and a timestamp.

2.4 Information we do not collect

We do not collect your precise GPS location unless you explicitly enable it for a door-to-door booking.
We do not currently process payments inside the app — payment is collected directly at the wash center. When we add in-app payments we will update this policy and ask for your consent.
We do not use third-party advertising trackers or fingerprinting.

3. How we use this information

To create and operate your account (one-time password login, session management).
To send your booking to the wash center and let them prepare for your arrival.
To show you historical bookings, ratings, vehicles, and saved addresses.
To send transactional messages (booking confirmation emails, OTPs for login) via our email provider (Resend) and, in future, SMS / WhatsApp delivery providers.
To compute settlements due to wash centers from Pitbay promo discounts.
To investigate fraud, abuse, or violations of our Terms of Service.
To improve the product (aggregate statistics like "average booking value this week"). We do not use personal identifiers for analytics.

4. Who we share information with

4.1 The other side of a booking

When you make a booking, the chosen wash center receives your name, mobile number, vehicle plate and model, slot, and chosen package so they can serve you. They do not receive your email, address, or other unrelated data.

4.2 Service providers

Resend (transactional email) — your email address and booking content for OTPs and confirmations.
Railway (server hosting) — server logs may contain your IP address.
Netlify (admin console hosting only) — does not receive customer data.

We do not sell your data, share it for advertising, or send it to data brokers.

4.3 Law and safety

We may disclose information if compelled by law, or if needed to prevent imminent harm to a person or to investigate fraud.

5. How long we keep your data

Active account data: kept while your account is active.
Booking history: retained for at least 7 years to support tax / GST records and dispute resolution.
OTPs: deleted within 24 hours of use or expiry.
Chat support transcripts: retained for 1 year then anonymised.
Account deletion: on request (see "Your rights" below) we delete identifying data within 30 days, retaining only what's required for tax records as anonymised aggregates.

6. How we protect your data

All API traffic is encrypted in transit over HTTPS.
Authentication uses signed JWT tokens stored on your device, with a sliding-window refresh that requires re-login on a new device.
Sensitive fields (mobile number, email) are masked by default in the admin console — admins must explicitly tap to reveal them, and reveals are logged in our audit trail.
Bank details are stored at rest and only revealed to authorised super-admin users.
One-time passwords are stored hashed and expire after 5 minutes.

7. Your rights

Under India's Digital Personal Data Protection Act and applicable international laws, you can ask us to:

Access the data we hold about you.
Correct inaccurate data (you can also self-edit name, email, vehicles and addresses inside the app).
Delete your account and personal data (subject to our retention rules in section 5).
Withdraw consent for marketing communications at any time. (Transactional messages — like booking confirmations — cannot be turned off while you have an active booking.)
Port your data — we provide an export in JSON or CSV on request.

To exercise any of these rights, email support@pitbay.in from the address registered on your account. We respond within 7 working days.

8. Children's privacy

Pitbay is intended for users aged 18 and above. We do not knowingly collect data from anyone under 18. If we learn that we have, we delete it.

9. Cookies and local storage

We use a small number of strictly functional items in your browser's local storage (e.g. sw_auth_token, sw_user, language preference). We do not use third-party cookies for tracking or advertising.

10. Changes to this policy

We may update this policy as the service grows. When we make a material change we will notify you via the app (and by email for active customers) at least 7 days before the change takes effect. The Last updated date at the top of this page always reflects the most recent revision.

11. Contact

Questions, requests, or complaints — write to support@pitbay.in. We reply within 3 working days. For unresolved complaints under the DPDP Act you may also approach the Data Protection Board of India.