Legal
Privacy Policy
Version 1.0 · Effective from 26 September 2026
1. The short version
- We use your answers to recommend cars. You don't need an account.
- To get a recommendation you give us your name, pincode and mobile number. We use your pincode to tailor the recommendation and prices to your city, and your name and mobile number to get in touch with you about your recommendations and to ask for your feedback so we can improve CarDhoondo. We use them for nothing else.
- We do not sell or rent your personal data to advertisers or data brokers. Today we do not share your personal details with car dealers, car makers, lenders or insurers. If that ever changes we will ask you first, separately, and you can say no without losing your recommendation (Section 6).
- The AI (Google Gemini) that writes your summary sees your answers and the cars' facts. It never sees your name, mobile number or pincode.
- You can see, correct or delete your data and withdraw consent at any time: mycardhoondo@gmail.com.
- CarDhoondo is for people 18 and over.
2. Who we are
CarDhoondo ("we", "us") is run by Aakash Tayal, an individual operating under the name CarDhoondo (not yet a registered company), Gurugram, Haryana, India. We decide why and how your personal data is used, which makes us the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and the rules made under it. Under the Information Technology Act, 2000 and its rules we are the "body corporate" collecting your information.
Contact for anything about your data: Aakash Tayal, Grievance Officer, mycardhoondo@gmail.com. See Section 14.
3. What we collect and why
| What | When | What we use it for |
|---|---|---|
| Your answers to the 11 questions (budget, fuel, seating, transmission, how you drive, who rides with you, priorities, brands to avoid, and so on) | When you answer | To work out your shortlist and the explanation on your results page. Once no longer linked to your name or phone, to improve our recommendation quality (Section 9). |
| Pincode | At the start, and on the on-road price tool | To tailor your recommendation and prices to your city, and to understand demand by area. |
| Name | At the start, and on the on-road price tool | To get in touch with you about your recommendations, and to ask for your feedback so we can improve CarDhoondo. |
| Mobile number | At the start, and on the on-road price tool | To get in touch with you (call, WhatsApp or SMS) about your recommendations, and to ask for your feedback so we can improve CarDhoondo. Not used for marketing. |
| Your results (the shortlist and write-up shown to you) and your feedback (a thumbs up or down and an optional comment of up to 500 characters) | When you view results or give feedback | To show your results again and to improve the product. Please don't put personal details in the comment box. |
| On-road price requests (car, variant, city or pincode, and the price shown) | When you use the price tool | To work out your price and understand demand. |
| Campaign source (the ad or link you came from, for example UTM tags) | Automatically, if present in the link | To learn which channels bring useful visitors. |
| Technical and usage data: pages viewed, clicks, approximate location from IP address, device and browser type, cookie identifiers | Automatically, through Google Analytics (Section 8) | To measure and improve the site. |
| Security logs (request time, IP address, error logs) | Automatically | To keep the service safe, block abuse and investigate problems. |
Name, pincode and mobile number are required to use the recommendation, because they are what we use to tailor it to your city and to follow up with you. If you would rather not give them, you can't use the recommendation, but you can still read our guides.
We do not collect your Aadhaar or PAN, bank or card details, precise GPS location, contacts, photos or credit history. (Section 7 describes a possible future feature; it does not exist today.)
Our recommendation is an automated calculation. It gives information; it does not decide anything about your legal rights, and no one is refused a service because of it.
4. Consent and our legal basis
We process your personal data on the basis of your consent. You give it by pressing the "Agree" button (on the first screen of the questionnaire, or on the on-road price tool), after reading a short notice that lists the data and the purposes. We keep a record of the notice version you agreed to and when.
- You can withdraw consent at any time, as easily as you gave it: email mycardhoondo@gmail.com. If you withdraw, we delete your details, and you will need to give them again to use the recommendation. Withdrawing does not affect what we lawfully did before you withdrew.
- We may also process data where the law allows it without consent, for example to comply with a legal obligation or a court order.
- Agreeing to our Terms of Use and consenting to our processing of your data are two different things.
If we contact you, it is only about your recommendations or to ask for feedback. You can tell us to stop at any time by replying "STOP" or emailing us, and we will stop.
5. Anonymous use
You don't need an account. Your answers and the contact details you give are stored against a random ID, not an account.
6. Who we share it with, and what we do not do
6.1 Service providers we use today (they act on our instructions)
| Recipient | What they do | Data involved |
|---|---|---|
| Supabase | Stores our database | Everything in Section 3 |
| Vercel | Hosts our website and servers | Requests to our site, including IP address, and the data you submit while it passes through |
| Google Analytics (GA4) | Usage statistics | Cookie identifiers, pages viewed, device data, approximate location |
| Google Gemini API | Writes the plain-language headline, summary and closing note on your results page | Your questionnaire answers (for example budget band, fuel, seating, who rides, priorities) and the shortlisted cars' facts (model, variant, on-road price, computed scores, factor names, verdict words, review counts). Not sent: your name, mobile number, pincode, IP address, or any record ID. We use Google's paid Gemini service, under which Google states it does not use prompts and responses to improve its products. |
| India Post pincode lookup (api.postalpincode.in) | Turns a pincode into a district or city for pricing | Only the pincode, sent from our server (not your device) |
| Authorities | Where a law, court order or lawful request requires, or to protect rights and safety | Only what is legally required |
| A successor | If we merge or are acquired | Your data stays subject to this policy, and we will tell you before any change |
These providers are bound by contract or their standard data-processing terms to protect the data. Some are located outside India. The DPDP Act allows transfers abroad except to countries the Government restricts; we will follow any restriction the Government notifies.
6.2 What is not happening today
- We do not share your personal details with car dealers, car manufacturers, banks, NBFCs or other lenders, insurers or advertisers.
- We do not sell or rent your personal data to advertisers or data brokers.
- We do not run behavioural advertising and we do not knowingly track children.
6.3 What might happen in future, and how we will handle it
We are a young service and may add features that need us to pass some of your details to other companies at your request. The kinds of companies we may want to work with, and why, are:
| Possible future recipient | Why (example) |
|---|---|
| Lenders and financiers (banks, NBFCs and their authorised agents) | So a lender can contact you about a car loan you ask about |
| Insurers and insurance intermediaries | So an insurer can quote you motor insurance you ask about |
| Car manufacturers | So a car maker can contact you about the car you shortlisted, book a test drive, or send a quote |
| Other service providers | Message delivery (SMS, WhatsApp, email), customer support tools, analytics, hosting and similar help, acting only on our instructions |
This list is a disclosure, not your consent, and it does not give us permission to share anything. Before we share your personal data with any company for its own purposes, we will:
- Update this policy and tell you in advance.
- Ask you for a fresh, separate consent for each such purpose, shown when it matters, naming the company or companies, the exact details we would send (for example name, mobile number, city and the car you shortlisted) and why.
- Leave that consent unticked by default, with a clear "No thanks" that does not affect your recommendation or any other part of CarDhoondo.
- Tell you plainly if we may be paid by that company for the introduction, and keep that clearly separate from, and after, your recommendation. A payment never changes which cars we recommend or how we rank them.
- Let you withdraw that consent at any time. The company that receives your details acts as a separate data fiduciary for them, and we will tell you how to reach it. If a car maker receives your details with your consent, its own privacy notice governs what it does next, which may include passing them to its dealers; we will say so on the consent screen. We will not send your details to a dealer ourselves.
Old consents will never be stretched to cover a new purpose or a new kind of recipient.
7. Possible future features (not available today)
We may one day offer features that use your credit information (for example from a credit bureau) to help you judge affordability or loan options. We do not do this today and we do not collect your credit history, PAN or date of birth. If we ever add it:
- it would be entirely optional and never a condition of getting your recommendation;
- we would ask for your explicit, separate consent each time, telling you which bureau or partner is involved, exactly what is fetched, why, whether it is a "hard" or "soft" enquiry, how long we keep it, and how to withdraw;
- it would be obtained only through a partner legally authorised to access bureau data, because credit-bureau rules restrict who may obtain it;
- it would never be shared with dealers, never used for advertising, never sent to our AI provider, and deleted on a short schedule (we intend no longer than about six months unless you renew your consent).
This is a possible idea, not a promise that it will launch.
8. Cookies and similar technologies
| Name | Type | Purpose | Duration |
|---|---|---|---|
_ga, _ga_G-YQ93EFYPEZ (Google Analytics) |
Cookie | Counts visits and pages, and measures which channels work | Up to 2 years (Google default) |
cardhoondo_questionnaire_v1 |
Browser session storage | Remembers your answers, and the details you typed at the start, while you move between questionnaire pages so you don't lose progress. It stays on your device. | Until you close the tab or press "Start over" |
You can block or delete cookies in your browser settings, or use Google's opt-out browser add-on for Analytics. We do not use advertising cookies or session-recording tools. If we add any, we will list them here and ask for your consent first.
9. How long we keep it
| Data | Kept for | Then |
|---|---|---|
| Name, pincode and mobile number | 12 months after your last activity | Erased, or, for pincode, cut to its first 3 digits and separated from your answers |
| Your answers and results (once no longer linked to your name or phone) | Up to 24 months | Kept only in a form that can't be linked to you, for aggregate research, or deleted |
| Feedback comments | 24 months | Deleted |
| On-road price requests | 12 months with contact details, then anonymised (pincode cut to 3 digits) | |
| Records of which notice version you agreed to, and when | For as long as we hold your other data | Deleted with it |
| Analytics data | 14 months (Google Analytics setting) | Deleted automatically |
| Security logs | 12 months (the DPDP Rules require certain processing logs to be kept for at least one year) | Deleted |
| Backups | Up to 35 days after deletion from live systems | Overwritten |
If you ask us to erase your data or withdraw consent, we delete it within 30 days, except records and logs we are legally required to keep. Those are restricted to that purpose and erased when the period ends. These periods are limits, not targets: if the purpose ends sooner, we delete sooner.
10. Your rights
Under the DPDP Act you can:
- Access a summary of the personal data we hold about you and the identities of the parties we have shared it with.
- Correct or update inaccurate or incomplete data.
- Erase your data.
- Withdraw consent.
- Get your grievance addressed by us first (Section 14) and, if you are not satisfied, complain to the Data Protection Board of India.
- Nominate someone to exercise these rights for you if you die or cannot act for yourself.
How: email mycardhoondo@gmail.com from any address and tell us the mobile number you used. Because we can't otherwise see who is behind a number, we may ask you to confirm by replying from that number or with a code sent to it. We respond within 30 days and never later than 90 days. Every reply will include the contact details in Section 14.
11. Security and breaches
We use HTTPS in transit; encryption at rest, backups and access controls from our infrastructure providers; restricted access (only our servers and authorised people can read the database); rate limits; and logging so we can detect misuse. No system is perfectly secure.
If a breach affects your personal data we will tell you without delay, in plain language: what happened, the likely consequences, what we are doing, what you can do, and who to contact. We will also report it to the Data Protection Board of India (and to CERT-In where required). To report a security vulnerability: mycardhoondo@gmail.com.
12. Children
CarDhoondo is for people 18 and over and is not directed at children. You confirm your age before starting. We don't knowingly collect data from anyone under 18 and will delete it if we learn we have. If you are under 18, please ask a parent or guardian to use the service.
13. Reviews, sources and third-party links
Our recommendations draw on publicly available owner and expert reviews and on car specification and price data. They are third parties' opinions and data, not ours; we show short excerpts with their source. We do not knowingly include reviewers' personal contact details. If you are a reviewer and want an excerpt removed or corrected, email mycardhoondo@gmail.com. Links to other sites are governed by those sites' own policies.
14. Grievance Officer, contact and complaints
Name: Aakash Tayal · Email: mycardhoondo@gmail.com · Location: Gurugram, Haryana, India
We acknowledge complaints within 48 hours and resolve them within 30 days (never later than 90 days). If we don't resolve your complaint, you may complain to the Data Protection Board of India (once it accepts complaints, through its online portal) after using our grievance process.
15. Changes to this policy
We post changes here with a new date and version. For material changes, especially any new purpose, new kind of recipient or new data we collect, we will tell you in advance where we hold your contact details, and where the law requires it we will ask for consent again. We do not reuse old consent for new purposes.
Questions or requests about your data? Email mycardhoondo@gmail.com. See also our Terms of Use.