Privacy Policy
Last updated: 29 September 2026
This policy explains what personal data PathYatra collects, why we collect it, how long we keep it, who else sees it, and what you can ask us to do about it. We have tried to write it in plain language rather than legal boilerplate, because a notice nobody can read is not really a notice.
1. Who is responsible for your data
The service is provided by PathYatra, currently operated by its founders Abhinav Mandal and Abhishek Mandal. A registered company has not yet been incorporated. Once it is, this policy will be updated to name that entity, and it will take over responsibility for the data described here.
For anything relating to your personal data, contact privacy@pathyatra.com. Our grievance contact details are in section 11 and on our Grievance Redressal page.
2. What this policy covers right now
PathYatra is in its early-access phase. Today, this website collects the early-access enquiry form and basic website analytics — nothing more. The owner, conductor, driver and passenger apps have not launched yet.
We have still described the data those apps will handle, so you can see the full picture before you commit to the platform rather than discovering it later. Each group below is labelled so you know whether it applies today or only once the apps go live.
3. What we collect, and why
Bus owners and operatorsWhen the apps launch
Collected when a bus owner registers a business on PathYatra and manages their fleet.
| Data | Why we need it |
|---|---|
| Name and contact number | Account identity, login and support |
| Email address | Account notifications and invoices |
| Business or fleet name, city and routes | Setting up the operator account |
| PAN | Tax compliance and invoicing |
| Identity verification result (via DigiLocker / Aadhaar offline verification) | Confirming the operator is genuine before enabling paymentsWe do not store your Aadhaar number or any Aadhaar image |
| Bank account or UPI details | Paying your booking settlements to you |
| Vehicle documents — permit, fitness, insurance, PUC | Confirming the bus is legally allowed to operate |
| Profile photo (optional) | Displaying your account |
Conductors, drivers and staffWhen the apps launch
Collected when an operator adds a staff member, or when a staff member uses the PathYatra app on duty.
| Data | Why we need it |
|---|---|
| Name, contact number and assigned role | Account access and shift handover |
| Driving licence details (drivers) | Confirming the driver is licensed |
| Identity verification result | Passenger safety and accountability |
| Location while assigned to an active trip | Live bus tracking, ETA, route monitoring and safetyCollected only during an active trip — it stops when the trip ends |
| Ticketing and cash-collection activity | Reconciliation and reporting to the operator |
PassengersWhen the apps launch
Collected when a seat is booked through PathYatra.
| Data | Why we need it |
|---|---|
| Name, age and gender of each passenger | Issuing the ticket and seat allocation |
| Contact number and email | Ticket delivery, trip updates and support |
| Boarding and dropping points, trip and seat details | Fulfilling the booking |
| Payment information | Processing payment and refundsCard and bank credentials are handled by our payment partner, not stored by us |
| Booking and cancellation history | Support, refunds and dispute resolution |
Everyone using this websiteApplies today
Applies right now, to this website.
| Data | Why we need it |
|---|---|
| Pre-apply form details — name, mobile, city, fleet size, bus types, routes, ticketing method, launch timeline, language | Assessing early-access applications and contacting you about onboarding |
| Consent record and timestamp | Proving that consent was validly obtained |
| Analytics data — pages viewed, approximate location, device and browser | Understanding how the site is used so we can improve itOnly if you accept analytics cookies. Nothing analytics-related loads before that |
| Server logs — IP address, timestamps, error details | Security, abuse prevention and debugging |
We collect only what we need for the purpose stated next to it. We do not collect data speculatively in case it turns out to be useful later, and we do not use your data for a new, unrelated purpose without telling you.
4. Aadhaar — what we deliberately do not do
Verifying that an operator or staff member is genuine matters for passenger safety and for preventing fraud. We do that in the way that exposes you to the least risk:
- We use DigiLocker or Aadhaar offline verification, which gives us a digitally signed confirmation of your details from the issuing source.
- We do not store your Aadhaar number, and we do not store photographs or scans of your Aadhaar card.
- We keep only the outcome of the check — whether verification succeeded, when it happened, and whether the name and date of birth matched.
- We never use Aadhaar as your login, and never as an account identifier.
Where we need a tax or business identity rather than a personal one, we use PAN instead.
5. Location and live tracking
Live tracking is one of the main things the platform does, so we want to be precise about its limits.
- Location is collected from a staff member's device only while they are assigned to an active trip.
- Collection stops when the trip ends. We do not track staff between shifts, on rest days, or in their personal time.
- The app shows a clear indication while location is being collected, so it is never happening invisibly.
- Passengers and owners see the bus's position on its route — not a staff member's personal movement history.
- Trip location history is kept for a limited operational period and then aggregated or deleted.
If you are a conductor or driver and you believe location is being collected outside an active trip, please tell us at privacy@pathyatra.com — we treat that as a defect, not as a feature request.
6. On what basis we process your data
Mostly, we process your data because you have given us consent for a stated purpose — for example, submitting the early-access form so we can contact you about onboarding. Where we need data to deliver something you have asked for, such as issuing a ticket you have booked or paying an operator their settlement, we process it to perform that service.
We also process a limited amount of data to meet legal obligations, such as keeping tax and accounting records, and to keep the platform secure and prevent fraud. Where consent is the basis, you can withdraw it — see section 8.
7. Who else sees your data
We do not sell your personal data, and we do not share it for someone else's advertising. We do share it with service providers who help us run the platform, and they may only use it for that purpose:
| Who | What they do for us |
|---|---|
| Supabase | Database and secure storage of application and account data |
| Vercel | Website and application hosting, and delivery |
| Cashfree Payments | Processing online booking payments and settlements |
| DigiLocker / UIDAI offline verification | Verifying identity documents without storing Aadhaar numbers |
| Google Analytics | Website usage analytics — only after you accept analytics cookies |
| WhatsApp (Meta) | Optional onboarding and support communication, if you opt in |
There are three other situations where data moves:
- Operator to staff, and back. If an operator adds you as a conductor or driver, that operator can see your account details and your on-duty ticketing and collection activity. That is how fleet management works.
- Booking details to the operator. When you book a seat, the operator running that bus receives the passenger details needed to carry you and to verify your ticket.
- Where the law requires it. We may disclose data if we are legally obliged to, for example in response to a valid order from a court or authority.
Some of these providers may process or store data outside India. Where that happens, it is subject to the restrictions applicable under Indian law. [To be confirmed with our legal adviser once the final list of providers and their hosting regions is fixed.]
8. Your rights
| Right | What it means |
|---|---|
| Access | Ask what personal data we hold about you and how we use it |
| Correction | Ask us to correct data that is wrong, or complete data that is missing |
| Erasure | Ask us to delete your personal data, unless we must keep it by law |
| Withdraw consent | Withdraw a consent you gave us — as easily as you gave it |
| Grievance redressal | Raise a complaint with us and get a response |
| Nominate | Nominate another person to exercise your rights if you are unable to |
To exercise any of these, email privacy@pathyatra.com from the email address or with the mobile number on your account, and tell us what you want. We may need to confirm who you are before we act, so that nobody else can make a request about your data.
Withdrawing consent is as easy as giving it. If you ticked a box to hear from us, one email or one message removes it — you do not have to explain why. Withdrawing consent for something essential to the service may mean we can no longer provide that part of the service, and we will tell you if that is the case.
To delete your data or close your account, see Data & Account Deletion, which sets out exactly what gets deleted, what we must keep, and how long it takes.
9. How long we keep things
| What | How long |
|---|---|
| Pre-apply / early-access enquiries | Up to 24 months from submission, or until you ask us to delete it |
| Operator and staff account data | For as long as the account is active, then up to 12 months |
| Booking and ticket records | As required for tax, accounting and dispute resolution |
| Payment and settlement records | As required under tax and accounting law |
| Trip location history | A limited operational window, then aggregated or deleted |
| Server and security logs | A short rolling window, longer where law requires retention |
| Marketing consent records | Until withdrawn, plus a record of the withdrawal |
When a retention period ends we delete the data or remove what identifies you from it. Some records — particularly payment, tax and accounting records — have to be kept for periods fixed by law, so we cannot delete those on request until that period is over.
10. How we protect your data
We use access controls so each account only sees its own data, encrypted connections, role-based permissions for owners, conductors, drivers and administrators, restricted private storage for identity documents, and logging of administrative access. Payment credentials such as card and bank details are handled by our payment partner and are not stored on our systems.
No system is perfectly secure, and we will not pretend otherwise. If a breach occurs that affects your personal data, we will notify you and the relevant authority as required, and tell you what happened and what to do. For more detail on our technical measures, see our Security page.
11. Complaints and grievances
If you are unhappy with how we have handled your data, please raise it with us first — most things are quicker to fix directly.
- Email: grievance@pathyatra.com
- Phone: +91 91200 53901
- Address: Jharkhand, India (no public office yet — a registered office address will be published at incorporation)
A separate Grievance Officer has not been appointed yet — PathYatra is not yet incorporated, and the founders handle these complaints themselves. The address above is monitored by them. A named officer will be published here at incorporation.
We will acknowledge your complaint and work to resolve it within the timelines set out on our Grievance Redressal page. If you remain dissatisfied, you may escalate to the Data Protection Board of India or another competent authority.
12. Children
PathYatra is a service for bus businesses and their staff, and is not intended for anyone under 18. We do not knowingly create accounts for children. Where an adult books a ticket that names a child as a passenger, we use those details only to issue and verify that ticket. If you believe a child has given us personal data directly, contact us and we will delete it.
13. Cookies
This website uses only strictly necessary cookies unless you accept analytics cookies. See our Cookie Policy, where you can also change or withdraw your choice at any time.
14. Changes to this policy
If we change what we collect or why, we will update this page and the date at the top. For significant changes we will tell you directly, through the app or by email, rather than relying on you to notice. Where a change needs your consent, we will ask for it.