Privacy Policy

1. Scope & our role

This Privacy Policy explains how Gaadi Deals ("we", "us", "our") collects, uses, discloses and protects personal data when you visit gaadi.deals, browse our scored car listings, use the price calculator or market trend pages, or create an account to save deals (together, the "Service"). It should be read alongside our Terms of Service.

This policy is published in compliance with Rule 4 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the "SPDI Rules") made under the Information Technology Act, 2000, and is framed to give effect to the Digital Personal Data Protection Act, 2023 (the "DPDP Act") as and when its provisions are brought into force.

For the purposes of the DPDP Act, we act as a Data Fiduciary in respect of personal data processed through the Service, and you are a Data Principal. Where we engage vendors to process personal data on our instructions, those vendors act as Data Processors. We are a small independent operation, not a Significant Data Fiduciary, and we do not process personal data on behalf of any other business.

This policy does not apply to the third-party marketplaces whose listings we index. When you click through to a listing, that site's own privacy policy governs what it collects from you — see section 13.

2. Personal data we collect

We have deliberately built the Service so that almost all of it works without an account and without knowing who you are. Browsing listings, running the price calculator and reading the trend pages require no sign-in and no personal data beyond the technical information any web server necessarily receives.

2.1 Data you provide to us

• Account identifiers. If you choose to create an account to save deals, we collect the identifier you sign up with: an email address, or an Indian mobile number, or the basic profile information released by a social login provider (Google, Apple or Facebook) when you choose that route — typically your name, email address and account identifier. Authentication is handled for us by Supabase; these identifiers are held in Supabase's managed authentication store, and are not copied into our own application tables.
• One-time passcodes. Sign-in is passwordless. We send a six-digit code or a sign-in link by email, SMS or WhatsApp and verify what you enter. We never ask you to create or supply a password.
• Saved deals. When you save a car, we store a record containing your account's internal user identifier, an identifier for the car, the city the car was listed in, and the timestamp of the save. That record is protected by row-level security so that it is readable only by your own authenticated session.
• Price calculator inputs. The calculator asks for city, make, model, variant, year of manufacture, kilometres driven and number of previous owners. These describe a vehicle, not you. They are sent to our prediction endpoint, used to compute an estimate in memory, returned to your browser with a no-store cache directive, and are not written to any database or associated with your account.
• Correspondence. If you email us, we receive your email address and whatever you choose to put in the message, and retain it as needed to handle your query.

2.2 Data collected automatically

• Server and network data. Like any website, our hosting provider receives your IP address, user-agent string, requested URL, referrer and timestamp. Our prediction endpoint additionally holds your IP address transiently in memory for the sole purpose of rate-limiting abusive request volumes; that record lives at most sixty seconds, is never written to disk or to a database, and is discarded when the function instance restarts.
• Product analytics. We use PostHog to understand how the Service is used — pages viewed, and specific product events such as opening filters, changing sort order, clicking through to a listing, submitting the calculator, opening the sign-in dialog and saving a deal. These events carry a randomly generated visitor identifier, approximate device and browser characteristics, and coarse location inferred from IP address at the city or country level.
• Signed-in analytics identity. When you are signed in, we associate your analytics events with your account's internal user identifier (an opaque UUID). We do not send your email address, mobile number or name to our analytics provider. When you sign out, we reset the analytics identity on your device.
• Error diagnostics. We capture unhandled JavaScript errors — the error message, a stack trace and the page it occurred on — so we can fix faults.
• Performance measurement. We use Vercel Web Analytics and Speed Insights to measure aggregate traffic and page-loading performance. These are served from our own domain and are designed by the provider to operate without cookies and without cross-site identifiers.
• Advertising measurement. We operate a Google Ads conversion tag. Where we run advertising, this allows Google to report to us, in aggregate, how many visits and actions resulted from an advertisement, and may allow Google to associate your visit with its own advertising identifiers. See section 6.

3. What we do not collect

For the avoidance of doubt, and because it materially limits the risk to you, we record here what the Service does not do:

• We do not collect sensitive personal data or information as defined in Rule 3 of the SPDI Rules — no passwords, no bank account, credit card, debit card or other payment instrument details, no physical, physiological or mental health condition, no medical records, no biometric information and no information as to sexual orientation.
• We do not process payments and hold no financial data. The Service is free to use.
• We do not collect precise geolocation. Where a city is shown, it is the city you selected or one inferred coarsely from IP address by our analytics provider.
• We do not ask you to upload identity documents, vehicle registration papers, photographs or any files.
• We do not sell, rent or trade personal data, and we do not share it with data brokers.
• We do not send marketing email or promotional SMS. Messages we send are transactional — the sign-in code or link you asked for.

4. Listing data & sellers

The Service indexes used-car advertisements that have been published openly on third-party marketplaces. Those advertisements are principally about vehicles — make, model, variant, year, kilometres, asking price, city and photographs — but a listing may also carry the name under which the vehicle is advertised, which for a dealer is a business name and for a private advertiser may be a personal name.

We treat such information as follows. We record whether the advertiser is a dealer or a private individual, because that materially affects pricing, and we display only that classification — "Dealer" or "Individual" — on the face of the Service. We do not publish advertiser contact details: we do not collect or display sellers' telephone numbers, email addresses or postal addresses, and anyone wishing to contact a seller must follow the link to the original advertisement and use that platform's own contact mechanism.

Personal data appearing in such advertisements has been made publicly available by the person concerned, or by the platform on which they chose to advertise, and the DPDP Act does not apply to personal data that a Data Principal has themselves made publicly available. We nonetheless handle it conservatively, minimise it, and will act on removal requests.

If you are an advertiser and want your listing removed from the Service, write to hello@gaadi.deals with a link to the listing. We will remove it, ordinarily within seven working days. Removal from our index does not remove the advertisement from the marketplace that published it — you must ask that platform separately.

5. How we use data & on what basis

We use personal data only for the purposes below. Under the DPDP Act, processing rests either on your consent, given by a clear affirmative action for the specified purpose, or on the certain legitimate uses permitted by section 7 of that Act — in particular, personal data you voluntarily provide to us for a purpose for which you have not indicated an objection.

We do not use personal data to make any decision that produces a legal or similarly significant effect on you. Our pricing model is trained on market listing data, not on the personal data of our users, and it does not profile you.

6. Cookies & local storage

We use a small number of technologies that store data on your device:

• Preferences held in local storage. We remember your light or dark theme choice, your preferred list density, your last-used calculator city, your last-used sign-in method, whether you have already seen certain one-time hints, a short-lived cache of listing results, and — across a social sign-in redirect — the fact that a save was pending. These stay on your device, are readable only by gaadi.deals, and are not transmitted to us as such.
• Authentication session. If you sign in, Supabase stores a session token on your device so that you stay signed in. Signing out clears it.
• Analytics. PostHog sets a first-party cookie and local-storage entries holding a randomly generated visitor and session identifier.
• Advertising. The Google Ads tag may set cookies in Google's domain used for conversion measurement and remarketing.

You can clear or block these through your browser settings, and you can use most of the Service with them blocked; the sign-in and saved-deals features require the authentication session to function. Most browsers also offer a "Do Not Track" or global privacy control signal; because there is no settled standard for honouring these, we do not currently respond to them, and we say so here rather than imply otherwise.

A note for visitors in the EEA and the UK. The Service is aimed at users in India and we do not currently present a consent banner. Analytics and advertising technologies are therefore loaded when you arrive. If you are subject to the ePrivacy rules and would prefer these not to run, please block them in your browser before browsing, or write to us and we will suppress and delete data associated with your visit.

7. Disclosure to third parties

We do not sell personal data. We disclose it only as set out below.

Service providers. We rely on the following processors, each engaged under its own terms and permitted to process personal data only to provide its service to us:

Legal disclosure. We may disclose personal data where we are required to do so by law, by a court of competent jurisdiction, or by a lawful request from a government agency, and where we consider disclosure reasonably necessary to enforce our Terms, to investigate suspected abuse of the Service, or to protect the rights, safety or property of any person.

Change of control. If the Service is transferred to another operator, whether by sale, merger or otherwise, personal data may be transferred as part of that transaction. The recipient will remain bound by this policy unless and until you are notified of, and where required consent to, a change.

8. Cross-border transfers

Our hosting, database and analytics providers operate infrastructure outside India, and personal data processed through the Service is therefore stored and processed outside India, including in the United States. Section 16 of the DPDP Act permits transfer of personal data outside India save to territories that the Central Government may restrict by notification; we will comply with any such restriction if and when it is notified. Where a transfer involves personal data protected by the GDPR or UK GDPR, our providers offer standard contractual clauses or an equivalent transfer mechanism, on which we rely.

9. Retention

We keep personal data only for as long as the purpose it was collected for is served, and erase it thereafter, unless retention is required by law.

• Account identifiers and saved deals — kept while your account is open. If you ask us to delete your account, we delete the account and all saved deals associated with it; the deletion cascades automatically.
• Sign-in codes — valid only briefly and expire automatically.
• Rate-limiting records — held in memory for at most sixty seconds.
• Price calculator inputs — not retained; discarded once the estimate is returned.
• Analytics and error events — retained on our analytics provider's platform in line with the retention period configured for our project, and reviewed periodically so that we do not keep them longer than we need.
• Correspondence — kept for as long as needed to deal with the matter and a reasonable period afterwards for our records.

10. Security

We implement reasonable security practices and procedures appropriate to the nature of the data we hold, as contemplated by section 43A of the Information Technology Act, 2000 read with Rule 8 of the SPDI Rules, and by section 8(5) of the DPDP Act. In particular: the Service is served exclusively over HTTPS; authentication is passwordless, so there is no password database to breach; every table holding user data is protected by row-level security policies enforced by the database itself, so that one user's saved deals cannot be read by another; write access for public roles is restricted to the minimum the feature requires; and administrative credentials are held separately from the keys used by the website.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a personal data breach occurs, we will notify the Data Protection Board of India and each affected Data Principal as required by section 8(6) of the DPDP Act, without undue delay and with a description of the breach and the steps we are taking.

11. Your rights

Subject to the DPDP Act coming into force and to the conditions it lays down, you have the right to:

• Access a summary of the personal data we process about you and the processing activities undertaken (section 11);
• Correction, completion, updating and erasure of your personal data (section 12);
• Grievance redressal through the route in section 14, which you must exhaust before approaching the Data Protection Board (section 13);
• Nominate another individual to exercise your rights in the event of your death or incapacity (section 14);
• Withdraw consent at any time, with the same ease as it was given. You can delete any saved deal from within the Service, and you can ask us to close your account entirely. Withdrawal does not affect the lawfulness of processing carried out before it.

You can exercise most of these yourself: sign in, and your saved deals can be added or removed at will. For anything else, including account deletion and a copy of your data, write to hello@gaadi.deals from the email address on your account, or tell us the mobile number you signed up with. We will not charge you for this. We may need to verify that the request is genuinely yours before acting on it, and we may decline a request that is manifestly unfounded or that would compromise another person's privacy — giving reasons.

Please note the duties that section 15 of the DPDP Act places on you: not to impersonate another person when providing personal data, not to suppress material information, and not to register a false or frivolous grievance.

If you are in the EEA or the UK, and to the extent the GDPR or UK GDPR applies to our processing, you also have rights of access, rectification, erasure, restriction, portability and objection, including objection to processing carried out on the basis of legitimate interests, and the right to lodge a complaint with your local supervisory authority. We will honour such requests as a matter of policy, whether or not we are determined to be within the territorial scope of those regulations.

12. Children

The Service is intended for adults. Consistently with section 9 of the DPDP Act, which treats anyone below eighteen years of age as a child, you must be at least 18 to create an account. We do not knowingly collect personal data of a child without the verifiable consent of a parent or lawful guardian, we do not undertake tracking or behavioural advertising directed at children, and we do not process children's personal data in any manner likely to cause a detrimental effect on their well-being. If you believe a child has given us personal data, write to hello@gaadi.deals and we will delete it promptly.

13. Third-party sites

Every listing on the Service links out to the marketplace that published it. Following such a link takes you to a site we neither operate nor control, and this policy stops at that boundary. What that site collects about you, what it stores on your device and what it does with the data are governed by its own privacy policy, which we encourage you to read. The same applies to any social login provider you choose to authenticate with.

14. Grievance redressal

If you have a question, concern or complaint about how we handle your personal data — or if you wish to exercise any right described in section 11 — please contact our Grievance Officer:

Grievance Officer, Gaadi Deals
Email: hello@gaadi.deals
Please write "Privacy grievance" in the subject line and describe the issue and the outcome you are seeking.

We will acknowledge your communication promptly and resolve it within one month of receipt, in accordance with Rule 5(9) of the SPDI Rules. If you are not satisfied with the outcome, you may escalate the matter to the Data Protection Board of India once it is constituted and functioning under the DPDP Act.

15. Changes to this policy

We may update this policy to reflect changes to the Service, to our providers, or to the law — including as the DPDP Act and the rules made under it are brought into force. The "Last updated" date at the top of this page will change accordingly, and material changes will be made noticeable on the site. Where a change requires your consent, we will ask for it before the change applies to you. Continuing to use the Service after an update means you accept the revised policy.

16. Contact

Gaadi Deals · hello@gaadi.deals
For questions about the terms on which the Service is offered, see our Terms of Service.