Privacy Policy

Last updated

This policy explains what personal data CarQ (“we”, “us”) collects, why we collect it, how long we keep it and what you can ask us to do with it. It is written to meet India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the Digital Personal Data Protection Rules, 2025. In the language of the Act, we are the Data Fiduciary and you are the Data Principal.

The short version

  • If you join the waitlist, we keep your email address, and your city if you give it, only to tell you when CarQ opens near you.
  • We do not sell your data or share it for anyone else’s marketing.
  • You can withdraw your consent, see, correct or delete your data at any time by writing to support@carq.io.

Joining the waitlist

What we collect. Your email address; your city, if you choose to give it; which sign-up form you used; the date and time you signed up; and the wording of the consent you gave, so we can show what you agreed to.

Why. To send you an email when CarQ opens in your city, and to use the cities people give us to decide where to open next. We do not use your waitlist details for anything else, and we will not send you other marketing without asking you separately.

Legal basis. Your consent, which you give by pressing “Notify me” after reading the notice next to the form. You can withdraw it at any time, as easily as you gave it (see Your rights).

How long we keep it. Until we have sent the launch email for your city, or until you withdraw your consent, whichever comes first. If CarQ has not opened in your city within two years of your sign-up, we delete your details anyway. After deletion we keep only a record that a request or deletion happened, without your email address.

Using the website

What we collect. Like most websites, our servers log technical details of each visit (IP address, browser and the page requested) to keep the site running and secure. These logs are deleted within 90 days.

Bot check. When you press “Notify me”, Cloudflare Turnstile checks that the sign-up comes from a person and not an automated script. To do that, Cloudflare processes technical details of your browser and connection, such as your IP address; it does not use cookies for this, and we receive only a pass or fail.

Analytics. With your consent, we use Google Analytics to understand how the site is used: which pages and sample conversations people view and which buttons they press. It uses cookies and collects your IP address in a shortened form, the device and browser you use, and how you move around the site. We use it only in aggregate and do not use it to identify you. If you decline, or later change your mind, Google Analytics does not set its cookies. You can also block cookies in your browser settings.

If you used CarQ vehicle reports

If you bought or requested a CarQ vehicle history report or inspection, we hold the details you gave us then: your name, phone number and email address, the vehicles you asked about, and your order and payment history (payments are processed by our payment provider; we do not store card details). We use them to deliver and support the reports you asked for and to keep the records that tax and accounting law requires. We keep account details while your account is open, and order and payment records for as long as the law requires (currently up to eight years).

Who we share it with

We share personal data only with service providers that process it on our behalf and under our instructions: the companies that host this website and the waitlist, send our emails, provide analytics (Google), and process payments. Each may only use your data to provide its service to us. Some of them store data outside India; we use only providers whose transfers are permitted under the DPDP Act.

We may also disclose data where the law requires it, for example to a court or a government authority with the power to ask for it.

We do not sell your personal data.

How we protect it

We use reasonable security safeguards, including encryption in transit, access limited to the people who need it, and logs of who accessed what. If a breach affects your personal data, we will tell you and the Data Protection Board of India as the DPDP Act requires.

Your rights

Under the DPDP Act you can:

  • Withdraw consent at any time. Withdrawal does not affect what we did before it, but we stop using your data for that purpose and delete it unless the law requires us to keep it.
  • Access a summary of the personal data we hold about you and how we use it.
  • Correct, complete or update your data.
  • Erase your data when it is no longer needed for the purpose you gave it for.
  • Nominate a person to exercise these rights for you if you die or become unable to.
  • Have a grievance resolved by us, and then complain to the Data Protection Board of India if you are not satisfied.

To use any of these rights, write to support@carq.io from the email address you signed up with. We will reply as soon as we can and in any case within 90 days.

Children

CarQ is for car owners and the website is not meant for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us their details, write to us and we will delete them.

Contact and grievances

For any question about this policy or your personal data, or to raise a grievance, write to support@carq.io. This address reaches the person at CarQ responsible for answering questions about personal data.

If you are not satisfied with our response, you can complain to the Data Protection Board of India.

Changes to this policy

We will update this policy when what we collect or how we use it changes, and change the date at the top. If a change affects what you agreed to, we will ask for your consent again before it applies to you.