Privacy Policy

If you are a buyer — someone who enquired about buying a vehicle through an advertisement, a partner, or a business we work with — this policy covers your enquiry, the qualification call, and what happens to your details afterwards. You do not have an account with us and did not sign up on this website; your data reached us because you responded to a specific offer and agreed, at that point, to be contacted about it.

If you are a dealer, financier, or other business with a Growheels account, this policy also covers the account, KYC, and wallet data described in §3. The separate Terms of Service governs the account itself; this policy governs the personal data in it.

We collect, and process, the following about a buyer:

• Name, phone number, and (if given) email address.
• City, pincode, and the general locality your agent recorded on the call. We do not ask for, or hold, a street address — the qualification call does not collect one.
• What you told our agent: the vehicle segment and model you're interested in, your budget band, when you intend to buy, whether you need finance or have a vehicle to exchange, and what you intend to use it for.
• A recording of that qualification call, and the agent's written summary of it, unless you decline to be recorded — in which case we qualify you from the agent's notes alone and record nothing.
• The version and timestamp of the consent notice you agreed to when you responded to the advertisement or offer that brought you to us, which we receive at the same time as your enquiry.

We do not collect a government ID, and we do not run a credit check on a buyer. Nothing above is inferred or purchased from a third-party data broker — it is what you told an advertisement, or told our agent directly.

If you sign up as a dealer or financier, we additionally collect:

• Your mobile number, verified by a one-time code — there is no password, and proof of the number is the whole login.
• Your business name, GST or dealership proof documents, and the pincodes you cover.
• If you add teammates, each member's own name and mobile number, and who added or removed them.
• Your wallet's transaction history — top-ups, purchases, and any manual adjustment, each with who recorded it and why.
• Which leads you purchased, and a record of whether you played back a call recording you were entitled to hear.

We process buyer data to:

• Qualify your enquiry — confirm it's real, and capture enough detail that a business can decide whether to pay for it without calling you first.
• Connect you with the businesses you consented to hear from: at most 3 of them, ever, per enquiry.
• Send the WhatsApp or SMS messages the law requires — telling you a business is about to contact you, confirming a stop request, and, while your enquiry is still live, asking whether you're still in the market.
• Investigate a complaint, such as a business contacting you after you asked them to stop.
• Meet a legal obligation — for example, keeping the record that proves you consented, for as long as that proof might reasonably be needed.

We process business-account data to operate the account itself: verifying who you are, running the wallet, and delivering the leads you paid for.

We do not use your data to build an advertising profile, and we do not sell it. There is no line item in this business for selling personal data — the businesses who use Growheels pay for a qualified introduction, once, and nothing about your data is monetised beyond that single, disclosed transaction.

Qualification calls are recorded by default so the business you're connected with can hear the conversation rather than take our word for it — that recording, or the agent's summary if you declined it, is the product a business is actually paying for. You can withdraw consent to recording at any point; if you do, we delete the audio and qualify you from written notes only.

The recording is stored privately and is never public. Before a business buys your enquiry, no one — not the business, not our own staff outside the agent who took the call — can access it. Playback links are generated per request, expire quickly, and only work for a business that has actually purchased that specific enquiry.

Businesses who purchase your enquiry. When a dealer or financier pays for your enquiry, we disclose your name, phone number, and (if you consented and didn't withdraw it) the call recording. This happens for at most 3 businesses, ever, and never before a business has paid — looking at your enquiry costs a business nothing, but seeing your name and number requires that they've bought it.

No one at Growheels reads your phone number to place a call. When our own agent calls you, the call is bridged through our telephony provider so the agent never sees the digits on a screen. Our administrators — the staff who set prices and manage the platform — cannot see it either. This is enforced in how the system is built, not just in a policy someone could ignore.

Referral partners, in a narrow case. Some enquiries reach us already introduced by a partner under a commercial agreement. Where that applies, the partner already holds whatever contact details their own campaign collected from you — our role from that point is qualifying and pricing the enquiry, not handing the partner anything new about you.

Service providers who process data on our instructions — cloud hosting and storage (for the recording and the application itself), the WhatsApp Business Platform and our SMS gateway (to send the messages described in §4), and, if you have a business account, our payments processor. Each is bound to use your data only to provide that service to us.

Regulators and law enforcement, where we are legally required to disclose.

We do not sell your data to anyone, for any reason.

A buyer's consent to be contacted lasts 180 days from when it was given, or until you tell us to stop — whichever comes first. There is no renewal that happens without your action.

Once consent lapses or you stop us, we have 30 days — a short window to catch a genuine billing dispute or a mistaken stop — before we permanently erase your name, phone number, and email, and delete the call recording. This is not a soft delete: the recording is removed from storage, and the identifying columns are overwritten so they cannot be recovered.

We keep a record that an enquiry existed, when it was contacted, and which businesses purchased it — with your identity removed — because that record is what our own accounts and audit trail rest on, and because it is the only thing that can still answer "who spoke to this person" if a complaint arrives after erasure. If a lead was stopped by you specifically, we keep your number on a do-not-contact list indefinitely, precisely so that a number you asked to be left alone is never re-imported and contacted again.

You can ask us to erase your data before either clock runs out — see §9.

As a Data Principal under the DPDP Act, you have the right to:

• Access a summary of the personal data we hold about you and how it has been processed.
• Correction of inaccurate or incomplete data.
• Erasure of your data once it is no longer needed for the purpose it was collected for, or at any time by request, subject to what the law or a legitimate use (such as an unresolved billing dispute) requires us to keep.
• Withdraw consent at any time, as easily as you gave it. For a buyer, this is one tap on the stop link sent with every pre-call notice, a WhatsApp message, or a text — see §4.4 of our build plan for why that specific mechanism exists. Withdrawing consent stops all future contact immediately; it does not undo a call that already happened.
• Grievance redressal — a way to complain and get a timely response, described in §9.
• Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.

To access, correct, or erase your data, or to raise a complaint, write to hello@growheels.com from the number or email your enquiry or account used, so we can verify it's you asking. We aim to acknowledge within 2 business days and resolve most requests within 30 days.

If you are a buyer and simply want to stop being contacted, the stop link sent with every notice is faster than writing in — it takes effect immediately and needs no reply from us to work.

If you are not satisfied with how we've handled your grievance, you may complain to the Data Protection Board of India.

Your phone number is stored separately from the rest of your enquiry, encrypted, and reachable only by the specific process that needs it to place or bridge a call — never by a general database query, and never rendered to a staff screen. Call recordings are stored privately with access controlled per request, never as a link anyone holding it could open.

Growheels is not directed at, and does not knowingly collect data from, anyone under 18. If you believe a minor's data has reached us, contact us and we will erase it.

Our infrastructure and some of the service providers named in §6 (including WhatsApp's operator, Meta) may process or store data outside India. We rely on those providers' own compliance obligations and, where the DPDP Act requires it, contractual terms limiting what they may do with your data.

We'll update the date at the top of this page whenever this policy changes, and for a material change — a new category of data, a new type of recipient — we'll say so plainly here rather than relying on the date alone.

Growheels Technologies Private Limited (CIN U73200MH2023PTC413973) · hello@growheels.com