Privacy Policy

This policy applies from 31 August 2026. Version 2.0.

This explains what personal data we collect when you use Sukuto, why we collect it, who we share it with, and what you can ask us to do about it. It is written to meet the Digital Personal Data Protection Act, 2023.

1. Who is responsible for your data

Travelware Technologies Private Limited is the Data Fiduciary for the personal data described here. In this policy, "we" and "us" mean that company, and "you" means the person using Sukuto.

CIN U63031MH2020PTC339052
GSTIN 29AAHCT8228R1ZB
Registered office: House No. 385, Near Mico Wall, MHB Colony, Nashik, Maharashtra 422007
Corporate office: 2nd Floor, 36/5, Somasundarapalya, 27th Main Road, Sector 2, HSR Layout, Bengaluru, Karnataka 560102

Grievance Officer: Chandan Singh
[email protected] · +91-8884414400
Write to him about anything in this policy, or to exercise any of the rights in clause 8. We reply within 48 hours and aim to resolve within 30 days.

2. What we collect

Who you are: your name, mobile number, email address, and date of birth where a rental needs it.
Documents: your driving licence and government photo ID, and those of any additional rider you add. These are needed to rent a vehicle and to meet the partner's requirements.
Your bookings: the vehicles, dates, pickup points, prices, and the addresses you give us for doorstep delivery.
Payments: the amount, the date, and a reference from our payment gateway. We do not store your card number, UPI PIN, CVV or bank credentials — those go directly to our payment gateway and never reach us.
Conversations: your messages to us on WhatsApp and chat, and recordings of calls between you and us. See clause 4.
Location: if you allow it in your browser or app, so we can show you the nearest pickup points. You can refuse, and the site still works.
How you use the site: pages viewed, searches, device and browser type, and an IP address. See clause 9.

3. Why we collect it, and on what basis

We use your data to: create and run your account; take bookings and payments; verify who you are and that you may ride; pass the details a rental partner needs to hand you the vehicle; send booking confirmations, reminders and receipts; answer your questions; process cancellations and refunds; recover traffic fines or damage owed under our Terms; prevent fraud; and meet our legal and tax obligations.

Most of this we do because you asked us to make a booking, or because the law requires it. Where we rely on your consent — marketing messages, advertising, and optional location access — you can withdraw it at any time under clause 8, and it is as easy to withdraw as it was to give.

4. Calls, WhatsApp and our automated assistant

This is the part people most often do not expect, so we say it plainly.

Calls are recorded. When you call us, or we call you, the call is recorded and stored. We use recordings to confirm what was agreed, to resolve disputes, and to improve how we handle calls.
Some conversations are handled by an automated assistant. Our assistant, Sia, answers many WhatsApp messages and some calls. You are talking to software, not a person, unless we tell you otherwise or you ask to be passed to the team.
Your words are processed by AI services. To understand you and reply, what you say or write is sent to our technology providers — Amazon Web Services and ElevenLabs — who process it on our instructions and do not use it for their own purposes.
Sia remembers earlier conversations with you, so you are not asked the same things every time. If you would rather it did not, tell the Grievance Officer and we will clear that history.
You can always ask to speak to a person instead. Just say so, and we will pass you to the team.

5. Who we share it with

We do not sell, rent or trade your personal data. We share only what is needed, with:

The rental partner for your booking — your name, contact number, booking details and the documents they must verify to hand over the vehicle.
Razorpay — to take payments and issue refunds.
Meta (WhatsApp) — to send and receive WhatsApp messages.
Exotel — to make and receive calls and SMS, and to store call recordings.
Amazon Web Services and ElevenLabs — to host our systems and to run the automated assistant described in clause 4.
Brevo — to send email.
Google and Ahrefs — for website analytics and advertising, as described in clause 9.
Cloudflare — to deliver and protect the website.
Government authorities, insurers, police or our advisers — where the law requires it, or where it is needed to deal with an accident, theft, traffic fine or a legal claim.

Each of these acts on our instructions. Some store data outside India; where they do, we require the same protection this policy promises.

6. How long we keep it

Booking, invoice and payment records: 8 years, because company and tax law requires it.
Identity documents: for the rental and for 12 months afterwards, so a later dispute, fine or damage claim can be dealt with.
Call recordings: 12 months.
WhatsApp and chat conversations: 24 months.
Your account: until you ask us to close it. When you do, we delete what we are not required to keep, and keep the rest only for as long as clause 6 requires.

7. Keeping it safe

We use physical, electronic and managerial measures to protect your data: encrypted connections, access limited to people who need it, and databases that are not reachable directly from the internet. No system is perfectly secure, and we cannot guarantee data in transit over the internet — but if a breach affects your personal data, we will tell you and the Data Protection Board of India as the law requires.

8. Your rights

You can ask us to:

Show you what personal data we hold about you and who we have shared it with.
Correct anything wrong, incomplete or out of date. You can also update most details yourself in your account.
Erase your data, where we are not required by law to keep it.
Withdraw your consent to marketing, advertising or location use, at any time.
Nominate someone to exercise these rights for you if you die or become unable to.
Complain — to our Grievance Officer first. If you are not satisfied with the outcome, you may take it to the Data Protection Board of India.

Write to [email protected] with your name and registered mobile number. To stop marketing emails you can also use the unsubscribe link in any of them.

9. Cookies, analytics and advertising

We use cookies to keep you signed in, remember your cart, and understand how the site is used. You can block cookies in your browser; the site will still work, but your cart and sign-in may not persist.

We use Google Analytics and Ahrefs Analytics to see how the site is used, and Google Ads to show our ads. These are loaded through Google Tag Manager.

For advertising, we share a hashed version of your email address or mobile number with Google — scrambled in a way Google cannot reverse — so we can show our ads to you, and avoid showing new-customer offers to people who have already booked with us. If you would rather we did not, tell the Grievance Officer and we will remove you.

10. Children

Sukuto is not for children. You must be at least 18 to hold an account, and the minimum rider age is in our Terms and Conditions. We do not knowingly collect data about children, and we do not show them targeted advertising. If you believe a child has given us data, tell the Grievance Officer and we will delete it.

11. Your account

Keep your password to yourself and do not share your account. You are responsible for what happens through it. Do not pretend to be someone else or open multiple accounts in false names. If you break these terms or our Terms and Conditions, we may close your account, and any others you have opened.

12. Changes to this policy

We may update this policy. The version that applies is the one published at the time, and the date it took effect is shown at the top of this page. If we make a change that materially affects how we use your data, we will tell you.

13. Which law applies

Indian law applies to this policy, including the Digital Personal Data Protection Act, 2023. Disputes go to the courts in Bengaluru — but this does not affect your right to complain to the Data Protection Board of India, or to a consumer forum where you live.