Privacy & Data Protection
How we handle your documents
At Peakride, we designed our software around the principles of the Digital Personal Data Protection Act, 2023: purpose limitation, storage minimisation, client-side encryption, and strict automated retention.
What we collect
We collect only the minimum required information to verify driver eligibility, protect physical fleet assets on mountain roads, and guarantee fair damage settlements.
| Data item | Why we collect it | How it is stored | Retention |
|---|---|---|---|
| Driving licence photo | Verify eligibility to ride in Uttarakhand hill roads | AES-GCM 256 encrypted in IndexedDB (non-extractable key) | Purged 7 days after rental return or cancellation |
| Driving licence number | Check valid licence category (MCWOG / MCWG) at counter | Salted SHA-256 hash + last 4 digits (raw number is never stored) | Hash kept for duplicate check; digits purged with record |
| Date of birth | Enforce minimum rider age (18 for scooters, 21 for Royal Enfield / Himalayan) | Plain date string | Purged with booking record |
| Phone number | Booking confirmation & roadside WhatsApp support | Plain text | Purged with booking record |
| Handover & return photos | Transparent condition & damage evidence for both rider and operator | Compressed JPEG with SHA-256 content hash in inspection seal chain | Purged 90 days after rental settlement |
Where your data lives
In this demonstration, all data, including encrypted documents and inspection photos, resides strictly inside your own browser's IndexedDB (pw-hq and counter replicas). No external server receives your uploaded images.
In production deployments, data is backed by an encrypted object store in the ap-south-1 (Mumbai) region, fulfilling India's statutory data residency requirements.
How your data is protected
- Client-side AES-GCM 256 Encryption: Sensitive documents (such as driving licence and Aadhaar/passport copies) are encrypted directly in the browser with an unexportable cryptographic key before being written to persistent storage.
- Salted Hash for Driving Licences: We never persist raw driving licence numbers in plaintext. The system calculates a salted SHA-256 hash for identity matching and retains only the last 4 digits for human verification at the counter.
- In-browser Compression: Photos are compressed client-side before storage or transmission, reducing typical 3–5 MB camera captures to ~100 KB to preserve bandwidth on remote Himalayan cellular connections.
Automatic retention & purging
We do not hoard personal documents once a rental concludes:
Customer Documents
7 Days
Licence and ID document blobs are permanently wiped 7 days after the security deposit is settled or booking is cancelled.
Inspection Photos
90 Days
Pickup and return vehicle photos are cleared 90 days after settlement, while the SHA-256 seal verification hashes remain for legal auditability.
Cryptographic tamper evidence
Every vehicle condition inspection taken at handover and return is cryptographically sealed using SHA-256 hash chains. The return seal directly links to the pickup seal, ensuring that vehicle odometer readings, fuel bars, and damage notations cannot be altered retroactively without breaking the cryptographic seal verification.
Your rights & erasure
You have the right to inspect, correct, or request the immediate deletion of your personal data at any time. In this browser demo, clicking the Reset Demo button in the operator console immediately wipes all IndexedDB records and re-seeds a fresh sandbox.