Scalelot Cloud Solutions (“we”, “us”, “our”) builds and operates the DriveWork mobile application. This policy explains exactly what personal data the app collects, why we collect it, who we share it with, how long we keep it, and the choices and rights you have.
This policy covers the DriveWork mobile app and the DriveWork backend service it talks to. It does not cover any third-party service you choose to open from the app (for example Google Maps, which opens in Google’s own app under Google’s own policy).
1. Plain-language summary
- DriveWork is a work tool for drivers, vehicle owners and travel agencies in India — it keeps your trips, vehicles, documents, expenses, invoices and rate cards in one place.
- We collect the information you type in or upload yourself: your profile, your vehicles, your documents, your trips, your expenses and your bills.
- We do not collect your location, contacts, SMS, call logs or microphone audio. The app asks for no such permission.
- We run no advertising, analytics or tracking SDKs. We do not sell or rent your data, and we do not use it for advertising.
- Your identity documents are stored privately and encrypted, and are readable only through short-lived links issued to you or to someone you have explicitly chosen to share them with.
- You can delete your account and your documents from inside the app at any time (Settings → Privacy → Delete account).
2. Who is responsible for your data
Data Fiduciary / Controller: Scalelot Cloud Solutions
Address: 304 Oberon Business Hub, Near Lemon Grass Hotel, Adajan, Pal Gam, Surat, Gujarat 394510, India
Email: drivework.ai@gmail.com
If you are a driver who was onboarded by an agency, that agency decides what work records it keeps about you and is responsible for its own use of them. We process that data on the agency’s behalf, and we also act for ourselves in running, securing and billing the service.
3. What we collect, and why
We collect only what a feature actually needs. Everything below is either typed in by you, uploaded by you, or generated by your use of the app.
3.1 Account and sign-in
| Data | Why | Required? |
|---|---|---|
| Mobile number | Creating your account and signing you in with a one-time password (OTP) | Required |
| One-time password (OTP) and verification attempts | Verifying it is really you; blocking brute-force and SMS-flooding attempts | Required |
| IP address at the moment an OTP is requested | Rate-limiting OTP requests (abuse prevention only) | Automatic |
| Google account basic profile — your name, email address and profile picture — when you choose “Continue with Google” | Signing you in without a password | Optional (OTP works instead) |
| Password (stored only as a one-way hash, never in readable form) | Offline / fallback sign-in where you set one | Optional |
| Session tokens | Keeping you signed in; stored in the device’s own secure store (Android Keystore / iOS Keychain), never in plain app storage | Automatic |
When you use “Continue with Google”, we receive only the basic profile information above from Google. We ask for no access to your Gmail, Drive, Contacts, Calendar or any other Google data, and we post nothing to your Google account.
3.2 Your profile
- Driver profile: full name, mobile number, date of birth, state, city, and — if you signed up independently — email address, postal address and PIN code; the languages you speak, the vehicle categories you drive, and your work mode.
- Agency / business profile: business name, owner name, contact person, mobile number, email address, GST number, company registration date, business address, city, state, PIN code, service areas, languages served, vehicle categories operated, declared fleet size, tagline, business logo, and a separate public contact number you choose to show to customers.
Why: to create your account, show the right screens for your role, let an agency verify a driver it is onboarding, and put correct legal details on the invoices you raise.
3.3 Documents you upload
You may upload any of the following, together with the document’s own number and its issue and expiry dates:
- Driving Licence
- Aadhaar
- PAN
- Police Verification
- Profile Photo
- Agency Logo
- GST Certificate
- Visiting Card
- Registration Certificate (RC)
- Insurance
- PUC
- Permit
- Fitness Certificate
- Rental Agreement
- Border-Tax Receipt
Why: identity and eligibility verification by the agency you work with, GST invoicing, and expiry reminders so a licence, insurance, PUC or permit does not lapse.
How they are handled: files are uploaded over HTTPS to a private cloud storage bucket (Amazon S3, Mumbai region) and are never publicly readable. Every read goes through a signed link that expires in 15 minutes. The maximum size per file is 10 MB.
Who can see them: only you, plus whoever you have explicitly allowed under Settings → Privacy → Document sharing, which has three settings you control — no documents shared, selected documents only, or all documents shared with managers. You can change or revoke this at any time.
3.4 On-device document scanning (no data leaves your phone)
When you add a photo or PDF of a document, the app reads the text on that image entirely on your device, using the operating system’s own on-device text recognition, so that it can pre-fill the document number and the dates for you instead of making you type them.
- The image is not sent anywhere for this scan. There is no network call, no server, no third-party service and no API key involved in it.
- The scan only suggests a value into an empty field. It never overwrites something you typed, and you can correct anything before saving.
- Nothing from the scan is kept except the number and dates you choose to save with the document.
3.5 Vehicles
Registration number, category, make, model, fuel type, ownership/sourcing, vehicle preferences, and the vehicle photographs you add (front, back, sides, interior, odometer).
Why: to run your fleet records, attach the right vehicle to a trip, and price a job correctly.
3.6 Trips, bookings and routes
Trip and booking records, reference codes, trip type, pickup and drop addresses (and their coordinates where you enter or pick them), passenger count, distances, durations, your saved routes, dispatch and driver-assignment records, and the customer details you enter for a booking — customer name and contact number.
Why: to run the job, assign a driver and vehicle, calculate the fare, and raise a bill.
About navigation: when you tap to navigate, we hand your phone a plain Google Maps link and your Maps app opens it. We make no Maps API call, we do not send your position anywhere, and we do not ask for or receive a location permission for it — Google’s app starts from wherever your phone already is.
3.7 Money: expenses, pricing and invoices
- Expenses: trip expenses and business expenses — amount, category, date, notes, and the receipt or bill photograph you attach.
- Pricing: rate cards, vehicle rates, and the quotes generated from them.
- Invoices: GST invoices and driver salary invoices, including the customer or driver details, line items, tax amounts and totals that appear on the bill.
- Reports: expense and earning summaries derived from the above, cut by day, month and year in the India timezone (Asia/Kolkata).
Why: to give you your own books — what a trip cost, what to charge, what to pay, and what you earned — and to produce the tax-compliant documents you are legally required to issue.
3.8 Community, chat and shared rides
DriveWork has an in-app community for drivers and operators. If you use it, we process:
- your community profile (display name, bio, avatar and cover images);
- posts, comments, likes, shares, follows and the notifications they generate;
- direct and group chat messages, and their delivery and read receipts, sent over a secure connection to our server;
- rides you choose to share, hand over to another operator, and the settlement records for them.
Please note: anything you post to a community feed, or send in a group chat, is visible to the other people in that community or group. Treat it as you would any message you send to a group of colleagues, and do not post identity documents, customer phone numbers or bank details there. You can edit or delete your own posts, and you control who can see your community profile under Settings → Privacy → Profile visibility.
Chat messages are stored on our servers so they can be delivered and so you can read your history on a new device. They are not end-to-end encrypted.
3.9 Subscriptions and payments
DriveWork is a paid product with plans and a registration fee.
- Payments are taken through Razorpay, and — where the app offers it — through Google Play Billing on Android or the App Store on iOS.
- Your card number, UPI PIN, CVV, net-banking credentials and bank details are entered inside the payment provider’s own secure sheet. DriveWork never sees, receives or stores them.
- What we do store is the outcome: the provider’s payment ID, order ID and signature, the amount, the currency, the plan, the status, the timestamps, and your invoice and billing history.
Why: to activate your plan, honour refunds and disputes, keep your billing history, and meet our own accounting and tax obligations.
3.10 Settings and preferences
Your language, appearance (theme), notification preferences (which kinds of updates you want, and your quiet hours), privacy choices, and the optional-access choices you make during setup.
Why: to make the app behave the way you asked it to.
3.11 Technical and security records
Server-side request logs, error records, authentication and refresh-token records, and the rate-limiting counters described in §3.1.
Why: to keep the service running, diagnose faults, and detect and prevent abuse, fraud and unauthorised access. These are operational security records, not a behavioural profile, and they are not used to build one.
4. What DriveWork does not collect or do
To be unambiguous, in this version of the app:
- No location tracking. The app requests no location permission (neither precise nor approximate) and collects no GPS data, no background location and no location history.
- No contacts, SMS, call logs or call recording. No such permission is requested.
- No microphone or audio recording. No such permission is requested.
- No broad file or photo-library access. You pick individual files with the system picker; the app never scans your gallery or storage.
- No advertising. There are no ads, no advertising identifiers, no ad SDKs and no ad profiling.
- No analytics or tracking SDKs, and no cross-app or cross-site tracking. We integrate no third-party analytics, attribution, crash-reporting, advertising or social-media SDK whatsoever.
- No social-media account connections. The app does not link to, read from, or post to Facebook, Instagram, X, WhatsApp or any other social platform.
- No selling or renting of personal data, and no sharing of it with data brokers.
- No automated decision-making that produces a legal or similarly significant effect on you. Approvals, rejections and verification decisions in the app are made by people — your agency, or our staff — not by an algorithm.
- No credit scoring, no device fingerprinting, no reading of other apps’ data.
If any of this changes in a future version, we will update this policy, change the Data Safety declaration on Google Play, and ask for your consent where consent is what the law requires.
5. Permissions the app asks for
| Permission | When it is asked | What happens if you say no |
|---|---|---|
| Internet / network access | Always — the app is a connected service | The app cannot sync; it is required |
| Camera | Only when you choose to photograph a document, a vehicle or a receipt | Everything still works — pick an existing file from the file picker instead. Camera is declared optional, so the app installs on devices that have none |
| Photo / file picker | Only when you tap to attach a file | You simply do not attach that file |
| Notifications (where your OS asks) | Only for the update types you switch on | You get no reminders; nothing else changes |
Each setup choice is off by default, nothing is pre-ticked, and you can change any of them later in Settings. Declining every optional item still gives you a fully usable account.
6. Data you enter about other people
When you enter a customer’s name and number for a booking, a customer’s details for a GST invoice, or a driver’s details and salary terms, you are responsible for having a lawful basis to do so, and we process that information on your instructions in order to provide the service to you.
Please enter only what the job genuinely needs, and tell the people concerned that you keep their details in a business app. If someone asks you to delete their details from your records, you can do so in the app, and you may contact us at drivework.ai@gmail.com if you need help.
7. Who we share data with
We share personal data only with the service providers listed below, only to the extent each needs to do its job, and only under contract. We do not sell, rent or trade personal data, and we do not share it for advertising.
| Recipient | What it receives | Why | Where |
|---|---|---|---|
| Amazon Web Services (S3) | The document, vehicle and receipt files you upload | Private, encrypted file storage | India (Mumbai region) |
| Google (Google Sign-In; Google Play Billing) | Sign-in verification; purchase and subscription data | Password-free sign-in; in-app purchases on Android | Global |
| Fast2SMS | Your mobile number and the OTP text | Delivering your sign-in OTP by SMS on India’s DLT route | India |
| Razorpay | Your payment details (entered directly into Razorpay), amount and order reference | Taking payments, refunds and disputes | India |
| Apple (iOS only, where the app offers in-app purchase) | Purchase and subscription data | In-app purchases on iOS | Global |
| Our hosting and database provider | The data described in §3, as stored | Running the service | India |
We may also disclose data where we are legally required to — a valid order from a court, tax authority, regulator or law-enforcement agency — or where it is necessary to establish, exercise or defend a legal claim, or to protect someone’s safety. We disclose the minimum needed, and we do not hand over bulk data on request.
If our business is ever transferred, merged or restructured, your data may transfer with it; this policy, or one at least as protective, will continue to apply, and you will be told.
8. How we keep data safe
- All traffic between the app and our servers travels over HTTPS/TLS.
- Uploaded documents sit in a private bucket that is never publicly readable; each read uses a signed link that expires in 15 minutes.
- Sign-in tokens are held in the device’s hardware-backed secure store (Android Keystore / iOS Keychain) — never in ordinary app storage.
- Access tokens are short-lived (30 minutes) and are refreshed; a refresh token lasts at most 30 days and is revoked immediately when you sign out or delete your account.
- Passwords, where used, are stored only as one-way hashes.
- OTP requests are rate-limited per phone number and per IP, with lockouts, so your number cannot be flooded and a code cannot be guessed.
- Access to production data inside our organisation is role-based and restricted to staff who need it.
- File uploads are size- and type-limited, and documents you replace are superseded rather than left lying around.
No system is perfectly secure. If a breach ever affects your personal data, we will notify you and the Data Protection Board of India as the law requires, and tell you what to do about it.
9. How long we keep data
| Data | Retention |
|---|---|
| Account, profile, vehicle, trip, expense and community data | While your account is active |
| Uploaded documents and their files | While your account is active; deleted when you delete your account, or when you delete the document |
| OTP records | 30 days, then deleted automatically by a scheduled job |
| Sessions / refresh tokens | Up to 30 days; revoked at once on sign-out or deletion |
| Invoices, payments and billing history | Retained after account deletion, in anonymised form, for as long as tax and accounting law requires (ordinarily up to 8 financial years in India) |
| Server and security logs | A short operational period, then rotated out |
10. Your rights
Under India’s Digital Personal Data Protection Act, 2023 — and, where they apply to you, the GDPR and other data-protection laws — you can:
- Know and access what personal data we hold about you and who we have shared it with;
- Correct anything inaccurate, and complete anything incomplete — most of it you can edit yourself in the app;
- Get a copy of your data. Use Settings → Privacy → Export my personal data, or email us. We verify your identity first, then send a copy of your profile, documents and trip records to the address on your account;
- Delete your account and your data (see §11);
- Withdraw consent you gave for something optional, at any time, in Settings — this does not undo what was lawfully done before you withdrew it;
- Nominate another person to exercise your rights if you die or become incapacitated, as the DPDP Act provides;
- Complain — to us first (§13), and then to the Data Protection Board of India if you are not satisfied.
We answer rights requests within 30 days. We do not charge for them, and we never make you pay or trade anything to exercise one.
11. Deleting your account and your data
In the app: Settings → Privacy → Delete account. We confirm with you twice, and we verify your identity before acting.
By email: write to drivework.ai@gmail.com from the address or number on your account with the subject “Delete my account”, and we will do it for you.
What deletion actually does. The following is erased:
- your name, mobile number and email address;
- every sign-in method attached to your account (including the Google link) and every active session;
- your date of birth, city and state;
- every document you uploaded, and the stored file itself.
Your mobile number is released, so you can register again as a new account whenever you like.
What is kept, and why. Business records that other records depend on — vehicles, trips, orders, invoices and billing history — are retained in anonymised form, with your identity removed, so that an agency’s accounts and our own legally required tax and accounting records remain intact. Your name no longer appears on them.
Two things to know before you delete:
- Deleting your account does not cancel a paid subscription. Cancel the subscription first — in Google Play (or the App Store) if you bought it there, or through the app’s billing screen — so you are not billed again.
- Deletion is permanent. We cannot restore a deleted account, and content you posted in a community or sent in a chat may remain visible to others as part of their own conversation history.
Admin and staff accounts are managed by an administrator and cannot be self-deleted.
12. Children
DriveWork is a tool for professional drivers, vehicle owners and travel businesses. It is not intended for anyone under 18, we do not knowingly collect data from children, and we direct no part of the app at them. If you believe a child has created an account, write to drivework.ai@gmail.com and we will delete it.
13. Contact us, and our Grievance Officer
For any question about this policy, any request about your data, or any complaint about how we have handled it:
Grievance Officer — Scalelot Cloud Solutions
Email: drivework.ai@gmail.com
Address: 304 Oberon Business Hub, Near Lemon Grass Hotel, Adajan, Pal Gam, Surat, Gujarat 394510, India
Please write “Privacy” in the subject line. We acknowledge within 7 days and respond within 30 days. If you are not satisfied with our response, you may escalate to the Data Protection Board of India.
14. Where your data is stored and processed
Your data is stored and processed on servers in India. A small number of the providers in §7 (Google, Apple) operate globally and may process the limited data described there outside India, under their own contractual safeguards. We do not transfer your data to any country that the Government of India restricts.
15. Changes to this policy
If we change this policy we will update the “Last updated” date above, publish the new version at the same address, and — for any change that materially affects your rights or introduces a new kind of data collection — tell you in the app before it takes effect and ask for your consent where consent is required. Continuing to use DriveWork after a change means you accept the updated policy.