Effective date: 2 October 2026

1. Who we are

Zeracar is run by Kampussaga India Enterprise Private Limited, Bengaluru ("Zeracar", "we"). This policy explains how we handle personal data when you:

• rent a car from Zeracar through www.zeracar.com, or

• use Zeracar Verify at verify.zeracar.com, either as a rental business that verifies its guests (a "host") or as a person who completes a verification link (a "guest").

We follow the Digital Personal Data Protection Act, 2023 and other applicable Indian law.

2. Information we collect about guests and customers

When a host verifies you through Zeracar Verify, with your consent we collect:

• Your name, date of birth, gender and photo, from your Aadhaar in DigiLocker

• The last 4 digits of your Aadhaar number (never the full number)

• Your address as shown on your Aadhaar, including the care-of name

• Your driving licence number, validity date and vehicle classes

• The mobile number the host entered, and the result of the checks (for example, whether the names on your Aadhaar and licence match)

• A Zeracar ID that we create for you, linked to your licence number

• Ratings, tags and comments that hosts leave after a rental with you

When you rent a car from Zeracar directly, we collect what we need for the booking: your name, phone number, email, identity documents, booking details and payment records.

3. Information we collect about hosts

When a rental business creates a Zeracar Verify account, we collect the business name, owner name, mobile number, email, city, state, address, PAN, GSTIN (optional) and number of vehicles. We also record the date the host accepted our Terms, their plans and payments, and their display settings (such as theme).

4. Where the information comes from

• DigiLocker, with your consent. You sign in to DigiLocker, the Government of India's document platform, and choose to share your Aadhaar and driving licence. We receive them through an authorised verification provider. You enter your Aadhaar number and OTP only on DigiLocker, never on our pages.

• Hosts, who enter your mobile number (and optionally your name) to send you a link, and who leave feedback after a rental.

• You, when you book a car, create a host account or contact us.

• Security records, such as sign-in times and the actions taken in an account, which we keep to prevent misuse.

5. How we use it

• To check a guest's identity and driving licence for a car rental, and show the result to the host who asked

• To build each guest's rental history across hosts, so hosts can rent safely

• To help a host recover a vehicle or unpaid dues through lawful means, using the address from Aadhaar

• To manage Zeracar's own rentals and bookings

• To run, secure and improve our services, prevent fraud and misuse, and handle support requests

• To keep records the law requires, such as billing and tax records

We don't sell personal data, use it for advertising, or make credit or criminal-record decisions about anyone.

6. Who can see your information

• The host who verified you sees your name, photo, date of birth, address, the last 4 digits of your Aadhaar, your licence details and the check results, for 90 days. After that, they see only your name, mobile number and when you were verified.

• Other hosts see nothing about you until they verify you themselves. Then they see your Zeracar ID, how many times you've been verified, and ratings, tags and approved comments from earlier rentals, shown with the reviewing host's city. They never see your address, photo or documents from other hosts' verifications.

• Zeracar staff can see records to provide support, approve hosts, review comments and prevent misuse. Admin access requires a second sign-in step, and staff actions are recorded.

• Service providers that work for us: our authorised verification provider, cloud hosting and database services, and messaging services. They may use the data only to provide their service to us.

• Authorities, when the law requires it, or to protect people or property from fraud or harm.

7. Where it's stored and how it's protected

Verification data is stored on servers in India. It is encrypted in transit and at rest, and photos are kept in private storage that only the verifying host and Zeracar staff can open, through short-lived links.

We also use database access rules so each host sees only their own guests, bot protection and rate limits on sign-in and verification pages, automatic sign-out after inactivity, two-step verification for admin access, and encrypted backups.

8. How long we keep it

We delete data automatically on this schedule:

Information

Kept for

Photo, address, licence details and check results for a verification

90 days after that verification

Date of birth and last 4 digits of Aadhaar

90 days after your most recent verification

Name, mobile number, licence number and Zeracar ID

3 years after your most recent verification

Ratings, tags and comments from hosts

3 years after they were left

Unfinished verification links

90 days

Security and activity records

2 years

Host account, billing and tax records

As long as the account is open, then as long as the law requires

We may keep specific records longer if the law requires it or a legal dispute is ongoing.

9. Your rights and choices

You can ask us to:

• tell you what personal data we hold about you and who we've shared it with

• correct data that is wrong or out of date

• delete your data, unless the law requires us to keep it

• review feedback about you that you believe is inaccurate or unfair

• withdraw your consent for future processing (this doesn't affect checks already completed)

• nominate someone to exercise these rights for you if you're unable to

Write to support@kampussaga.com and include your mobile number, email or Zeracar ID so we can find your records. We may ask you to confirm your identity before acting on a request.

10. Cookies and browser storage

Zeracar Verify doesn't use advertising or tracking cookies. It stores a few things in your browser so it works properly: your sign-in session, your display settings (such as dark mode), and the time of your last activity for automatic sign-out. Our bot check (Cloudflare Turnstile) may also process basic device information to tell people from bots.

11. Children, changes and contact

Children: our services are for people aged 18 and over. We don't knowingly collect data about children.

Changes: if we update this policy, we'll change the effective date at the top, and tell hosts in the app before important changes take effect.

Grievance Officer: Kampussaga India Enterprise Private Limited, support@kampussaga.com (subject: Zeracar privacy). We acknowledge complaints within 48 hours and aim to resolve them within 30 days. If you're not satisfied with our response, you can contact the Data Protection Board of India.

Address: Kampussaga India Enterprise Private Limited, Whitefield, Bengaluru 560066, Karnataka, India.