Pitbay — Privacy Policy

Effective: 12 May 2026 · Last updated: 15 August 2026

This Privacy Policy explains what information Pitbay ("we", "us") collects when you use our applications — the Pitbay customer app, the Pitbay center app, and the Pitbay admin console — and how that information is used, shared, and protected. It applies to all three apps. If a section applies to only one app, we say so.

In short: we collect what we need to run a car-wash booking marketplace — your name, mobile, vehicle plate, booking history, and (for centers) bank details for settlement. We don't sell your data. We share only what the other side of a booking needs to fulfill it.

1. Who runs this service

Pitbay is operated by the team listed below. If you have any privacy question, write to us at support@pitbay.in.

Operator: Pitbay (India)
Country: India
Contact: support@pitbay.in

Grievance Officer

In line with India's Information Technology Act and the Digital Personal Data Protection Act, 2023, our Grievance Officer handles privacy questions, complaints, and data-rights requests:

Name: Boddu Ravi Teja
Email: support@pitbay.in
Response time: we acknowledge complaints within 48 hours and work to resolve them promptly.

2. Information we collect

2.1 Customer app

Identity: full name, mobile number, email address (used as your login identifier and for booking confirmations).
Vehicles: registration plate, make/model, colour, primary-vehicle flag.
Addresses: labels (Home / Office / etc.), full address and pincode you save for door-to-door bookings.
Bookings: chosen center, package, slot date and time, vehicle used, promo code applied.
Ratings & reviews: stars and optional comment you submit after a wash.
Chat messages: messages you send to Pitbay support, plus replies.
Device data: a long-lived authentication token stored locally on your device (browser localStorage or app secure storage); a device push token (Google Firebase Cloud Messaging) used to send you booking notifications; and product-analytics events (Google Firebase / Google Analytics) such as which screens you view and app errors, which include a Google-assigned app-instance identifier. We do not use advertising cookies, ad identifiers, or fingerprinting.

2.2 Center app (wash center owners / staff)

Center identity: business name, owner name, mobile number, email, address, city, GSTIN (if provided), wash types offered, opening hours.
Bank details: account number, IFSC code, account-holder name, bank name — used to credit Pitbay settlements to your account.
Geo-coordinates: latitude and longitude of your center, so the customer app can show you on a map.
Operational data: bookings received, packages offered, slot blocks, photos taken before and after a wash (uploaded by your staff), responses to customer reviews.

2.3 Admin / super-admin console

Authentication: a shared API key (no per-user login at this stage).
Audit log: every action taken by an admin (e.g. "marked settlement", "edited center info") is recorded with the actor's name, the change made, and a timestamp.

2.4 Payments

Online payments (UPI, cards, net-banking, wallets) are processed by our payment partner Razorpay. Payment details are entered on Razorpay's secure gateway and handled under Razorpay's own privacy policy; Pitbay does not store your full card or bank credentials.
For wash centers, we store bank/UPI settlement details (see 2.2) to pay out their share after a completed booking.

2.5 What we do not do

We use your precise GPS location only when you tap to detect it (to show nearby centers, or to fill a door-to-door address). We do not track your location in the background.
We do not use advertising trackers, ad identifiers, or fingerprinting.
We do not sell your personal data.

3. How we use this information

To create and operate your account (one-time password login, session management).
To send your booking to the wash center and let them prepare for your arrival.
To show you historical bookings, ratings, vehicles, and saved addresses.
To send transactional messages (booking confirmation emails, OTPs for login) via our email provider (Resend) and, in future, SMS / WhatsApp delivery providers.
To compute settlements due to wash centers from Pitbay promo discounts.
To investigate fraud, abuse, or violations of our Terms of Service.
To improve the product, we use Google Firebase / Google Analytics to understand aggregate usage (e.g. screens viewed, features used) and to capture app errors and crashes. This may include a Google-assigned app-instance identifier; we do not use it to target advertising.
To send you booking-related push notifications via Google Firebase Cloud Messaging (using your device push token).

4. Who we share information with

4.1 The other side of a booking

When you make a booking, the chosen wash center receives your name, mobile number, vehicle plate and model, slot, and chosen package so they can serve you. They do not receive your email, address, or other unrelated data.

4.2 Service providers

Razorpay (payments) — processes your online payment; receives the payment amount and the details you enter on its gateway.
Google Firebase (analytics, crash reporting & push notifications) — receives app-usage/error events and your device push token, with a Google-assigned app-instance identifier.
Resend (transactional email) — your email address and booking content for OTPs and confirmations.
Railway / Fly.io (server hosting) — server logs may contain your IP address.
Netlify (admin console hosting only) — does not receive customer data.

Cross-border processing: Razorpay is India-based, while Google, Resend, and our hosting may process data on servers outside India. Where data is processed outside India, we rely on the provider's safeguards and applicable law.

We do not sell your data, share it for advertising, or send it to data brokers.

4.3 Law and safety

We may disclose information if compelled by law, or if needed to prevent imminent harm to a person or to investigate fraud.

5. How long we keep your data

Active account data: kept while your account is active.
Booking history: retained for at least 7 years to support tax / GST records and dispute resolution.
OTPs: deleted within 24 hours of use or expiry.
Chat support transcripts: retained for 1 year then anonymised.
Account deletion: on request (see "Your rights" below) we delete identifying data within 30 days, retaining only what's required for tax records as anonymised aggregates.

6. How we protect your data

All API traffic is encrypted in transit over HTTPS.
Authentication uses signed JWT tokens stored on your device, with a sliding-window refresh that requires re-login on a new device.
Sensitive fields (mobile number, email) are masked by default in the admin console — admins must explicitly tap to reveal them, and reveals are logged in our audit trail.
Bank details are stored at rest and only revealed to authorised super-admin users.
One-time passwords are stored hashed and expire after 5 minutes.

7. Your rights

Under India's Digital Personal Data Protection Act and applicable international laws, you can ask us to:

Access / download the data we hold about you — get a machine-readable copy anytime from Profile → Download my data, or request one from us.
Correct inaccurate data (you can also self-edit name, email, vehicles and addresses inside the app).
Delete your account and personal data (subject to our retention rules in section 5) — self-service from Profile → Delete account.
Withdraw consent for marketing communications at any time. (Transactional messages — like booking confirmations — cannot be turned off while you have an active booking.)
Nominate another individual to exercise these rights on your behalf in the event of death or incapacity (DPDP Act, 2023) — contact the Grievance Officer.

To exercise any of these rights, email support@pitbay.in (attention: Grievance Officer) from the address registered on your account. We acknowledge within 48 hours and action verified requests within 7 working days.

8. Children's privacy

Pitbay is intended for users aged 18 and above. We do not knowingly collect data from anyone under 18. If we learn that we have, we delete it.

9. Cookies and local storage

We use a small number of strictly functional items in your browser's local storage (e.g. sw_auth_token, sw_user, language preference). We do not use third-party cookies for tracking or advertising.

10. Changes to this policy

We may update this policy as the service grows. When we make a material change we will notify you via the app (and by email for active customers) at least 7 days before the change takes effect. The Last updated date at the top of this page always reflects the most recent revision.

11. Contact

Questions, requests, or complaints — write to our Grievance Officer, Boddu Ravi Teja, at support@pitbay.in. We reply within 48 hours. For unresolved complaints under the DPDP Act you may also approach the Data Protection Board of India.