// Privacy Policy //

We are committed to handling personal data responsibly and in accordance with applicable Indian laws, including the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 ("DPDP Act"), as implemented and amended from time to time.

This policy applies to all users of Pistons Garage — including customers booking vehicle services, visitors browsing our marketplace, garage partners, mechanics, fleet operators, and individuals contacting us for support or marketing enquiries.

• "Personal data" means any data about an identifiable individual, including name, phone number, email, address, vehicle registration details, location data, and payment-related metadata.
• "Sensitive personal data" may include financial information, precise geolocation used for service dispatch, government-issued identifiers submitted during partner verification, and any data classified as sensitive under applicable law.
• "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, archiving, or deletion.
• "Garage partner" means an independent workshop, mechanic, or service provider listed on or connected through our platform.
• "Services" means our website, applications, APIs, booking engine, CRM integrations, roadside assistance coordination, and related support.

We use personal data for legitimate business purposes, including:

Depending on context, we process personal data based on one or more of the following grounds:

• Your consent — e.g., marketing communications, optional location access, or cookies beyond what is strictly necessary.
• Performance of a contract — e.g., fulfilling a service booking you request.
• Legitimate interests — e.g., securing our platform, preventing fraud, and improving user experience, balanced against your rights.
• Legal obligation — e.g., maintaining records required by tax or consumer protection laws.

You may withdraw consent for optional processing at any time by contacting us. Withdrawal does not affect processing that was lawful before withdrawal or processing required to complete an active booking.

We do not sell your personal data. We share information only as described below:

• Garage partners: booking details, vehicle information, contact number, and service address necessary to perform the requested work.
• Service providers: cloud hosting, SMS/WhatsApp gateways, payment processors, analytics, customer support tools, and CRM systems bound by confidentiality obligations.
• Business transfers: in connection with a merger, acquisition, or asset sale, subject to continued protection of your data.
• Legal disclosures: when required by court order, government authority, or to protect rights, safety, and integrity of users and the platform.
• With your direction: when you explicitly ask us to share information or connect you with a third party.

Garage partners are independent businesses. Their use of your data during service delivery is also governed by their own policies. We require partners to use customer data only for fulfilling bookings booked through Pistons Garage.

We retain personal data only for as long as necessary to fulfil the purposes described in this policy, unless a longer period is required by law.

• Active booking and transaction records: typically retained for up to 8 years for accounting and dispute resolution.
• Support tickets and communications: typically up to 3 years after case closure.
• Marketing preferences: until you unsubscribe or request deletion.
• Server logs and security data: typically 90 days to 24 months depending on sensitivity and legal needs.
• Partner verification documents: for the duration of the partnership plus statutory retention periods.

When data is no longer needed, we delete or anonymize it using commercially reasonable methods.

Subject to applicable law, you may have the right to:

• Access personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request deletion of data where retention is no longer necessary or lawful.
• Withdraw consent for optional processing.
• Nominate another individual to exercise rights on your behalf in certain circumstances (as permitted under the DPDP Act).
• Lodge a complaint with our Grievance Officer (Section 15) or with the Data Protection Board of India when constituted.

To exercise these rights, email privacy@pistonsgarage.com with sufficient detail to verify your identity. We respond within timelines prescribed by applicable law, typically within 30 days.

You can opt out of promotional messages using the unsubscribe link in emails or by replying STOP to SMS where supported. Transactional messages related to active bookings may still be sent.

We use cookies, pixels, and local storage to operate and improve our services.

Most browsers allow you to block or delete cookies. Blocking necessary cookies may prevent parts of the site from functioning correctly. Where required, we display a cookie consent banner before setting non-essential cookies.

We implement reasonable administrative, technical, and organizational safeguards designed to protect personal data against unauthorized access, alteration, disclosure, or destruction. Measures may include:

• Encryption in transit (TLS/HTTPS) for data transmitted over the internet.
• Access controls and role-based permissions for employees and contractors.
• Secure development practices, logging, and periodic security reviews.
• Vendor due diligence for subprocessors handling personal data.

No method of transmission or storage is 100% secure. If you believe your account or data has been compromised, contact us immediately at support@pistonsgarage.com.

Pistons Garage is not directed at children under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will take steps to delete such information promptly.

Our primary systems are located in India. Where we or our service providers process data outside India, we ensure appropriate safeguards consistent with applicable law, including contractual protections and compliance with DPDP Act requirements for cross-border transfers when enforceable.

Our platform may contain links to third-party websites, maps, payment gateways, or partner tools. This Privacy Policy does not apply to those third parties. We encourage you to review their privacy policies before providing personal data.

Related policies: Terms of Service, Refund Policy, Cancellation Policy.

We may update this Privacy Policy from time to time to reflect changes in law, technology, or our practices. When we make material changes, we will post the updated policy on this page with a revised "Last updated" date and, where appropriate, notify you by email, SMS, or a prominent notice on our website.

Your continued use of the services after the effective date constitutes acceptance of the updated policy.

For privacy questions, data access requests, or complaints, contact: