Privacy Policy

GARIFILE
How information is used in the GariFile service.

Effective Date: 01/04/2025
Last Updated: 31/03/2026

At GariFile, we understand that your personal information, vehicle records and documents are private and important. This Privacy Policy explains what information we collect, why we collect it, how it is used, when it may be accessed or shared, how we protect it, and the choices available to you.

GariFile is a vehicle record and document-management platform for individuals, dealers, businesses and companies.

GariFile is a private technology platform and is not a government department, RTO, Parivahan, VAHAN, police authority or other government authority.

Your Privacy Promise

Your vehicle records and private documents are private by default and are not published as public website pages.

GariFile personnel do not routinely view your private documents. For ordinary support that requires us to view a private document, we will seek your authorization before accessing it.

We do not sell your personal data or private vehicle documents for third-party advertising, and we do not use your private vehicle documents for advertising.

Limited access without prior authorization may occur only where reasonably necessary to protect your account or the service, investigate suspected fraud or misuse, respond to a security incident, comply with applicable law, or respond to a valid lawful request from a competent authority.

Information You Provide

When you create or use a GariFile account, we may collect information such as:

• name;
• mobile number;
• email address;
• state and city;
• account type;
• account verification information;
• account preferences.

Dealer, Business or Company accounts may also provide dealership or business name, business contact details, branch information, team members, roles and permissions, inventory information and other information necessary to operate their workspace.

You may provide vehicle information such as:

• vehicle registration number;
• make and model;
• variant;
• manufacture year;
• fuel type;
• chassis/VIN number;
• engine or motor number;
• ownership information;
• purchase or sale information;
• vehicle location;
• document expiry dates;
• other vehicle information you choose to enter.

Vehicle Documents

You may choose to upload or create vehicle-related documents such as:

• Registration Certificate (RC);
• insurance documents;
• PUC documents;
• permits;
• fitness-related documents;
• purchase or sale records;
• invoices and receipts;
• delivery or handover documents;
• RC-transfer-related records;
• other vehicle-related documents.

Please do not upload passwords, OTPs, Aadhaar, PAN or other unnecessary identity or sensitive documents unless a particular GariFile feature specifically requires such information and explains why it is required.

How We Use Your Information

We may use your information to:

• create and maintain your account;
• authenticate and verify users;
• manage vehicle records;
• store and organize documents;
• display document expiry dates;
• provide reminders;
• operate dealer inventory;
• maintain purchase and sale workflows;
• generate documents or drafts requested by you;
• enable team access and sharing;
• provide customer support;
• maintain account and platform security;
• prevent fraud and misuse;
• troubleshoot technical issues;
• maintain audit and security logs;
• improve service reliability;
• comply with applicable legal obligations;
• respond to valid lawful requests.

We do not use your private vehicle documents for unrelated advertising purposes.

Access to Records

Your private vehicle records and documents are not intended to be publicly accessible.

They may be accessible to you and to users whom you or an authorized workspace administrator have permitted to access them.

GariFile personnel do not routinely inspect private customer documents.

Access by GariFile personnel is restricted to specifically authorized personnel where access is reasonably necessary for support, security, fraud prevention, investigation of misuse, technical operations or compliance with applicable legal requirements.

Where technically supported, sensitive administrative access should be recorded in audit or security logs.

Support Access and Your Consent

For ordinary customer-support requests that require GariFile personnel to inspect a private document, we will seek your authorization before accessing that document.

Where available, GariFile may provide an Allow Support Access feature through which you can expressly authorize temporary support access.

Such access may be:

• limited to the necessary records;
• limited to authorized personnel;
• limited to a specific support purpose;
• limited in duration;
• revocable where appropriate;
• recorded in an audit log where technically supported.

This helps ensure that ordinary support access to your private documents remains under your control.

Exceptional Access Without Prior Consent

There may be limited circumstances where obtaining your prior authorization is not appropriate, possible, or legally permitted or required.

Specifically authorized GariFile personnel may access relevant information without prior permission where reasonably necessary to:

• protect your account;
• investigate unauthorized access;
• investigate suspected fraud or misuse;
• detect or respond to a security incident;
• protect GariFile or its users;
• recover or protect systems;
• comply with applicable law;
• respond to a valid legal order or lawful request from a competent authority.

Such access should be limited to what is reasonably necessary for the relevant purpose.

GariFile will not access your private documents merely out of curiosity or for unrelated purposes.

We Do Not Sell Your Personal Data

GariFile does not sell your personal data or private vehicle documents to third parties for their independent advertising or marketing purposes.

GariFile does not use your private vehicle documents to create advertising profiles.

This does not prevent trusted service providers from processing limited information where necessary to operate GariFile, subject to appropriate safeguards and applicable law.

Dealer, Seller and Buyer Information

Dealer, Business and Company accounts may enter information relating to customers, vehicle sellers and purchasers.

This may include:

• name;
• mobile number;
• email address;
• address;
• vehicle information;
• purchase or sale information;
• transaction information.

A dealer or business entering another person's information into GariFile is responsible for ensuring that it has appropriate authority or another lawful basis to collect, provide and use that information.

GariFile providing a technical platform does not give businesses unrestricted permission to collect or use another person's personal information.

Sharing and Team Access

GariFile may allow account owners or authorized administrators to share records with team members, employees, customers or other authorized users.

You are responsible for selecting the correct recipients and assigning appropriate permissions.

Dealer, Business and Company workspace administrators may control team membership, roles and access within their organization.

GariFile does not make your private records public merely because they are stored on the platform.

Service Providers and External Services

Operating GariFile may require trusted service providers for services such as:

• hosting;
• storage;
• backups;
• email delivery;
• communications;
• security and malware scanning;
• monitoring;
• payment processing;
• customer support;
• authorized vehicle-related integrations.

These service providers may process information reasonably necessary to provide their services to GariFile.

Where appropriate, such processing should be subject to applicable contractual, confidentiality, security and legal safeguards.

GariFile does not treat necessary processing by a service provider as permission for that provider to independently sell your information or use your private documents for advertising.

Future services such as WhatsApp notifications, challan services or online payments will not be represented as active until the relevant integration has actually been enabled.

Sessions and Cookies

GariFile may use cookies or similar technologies necessary to:

• keep users signed in;
• authenticate accounts;
• maintain security;
• prevent abuse;
• remember essential settings.

If GariFile introduces non-essential analytics, advertising or tracking technologies, this Privacy Policy or an appropriate cookie notice will be updated and choices will be provided where required by applicable law.

Third-party resources used on public pages may cause your browser to communicate directly with those providers.

Security

GariFile uses reasonable technical and organizational safeguards designed to protect information against unauthorized access, alteration, disclosure, loss or misuse.

Depending on the relevant system, these safeguards may include:

• secure authentication;
• password hashing;
• HTTPS/TLS connections;
• session protection;
• role-based permissions;
• administrative access restrictions;
• audit and security logging;
• rate limiting;
• malware scanning;
• backups;
• monitoring;
• vulnerability management;
• incident-response procedures.

However, no internet service, computer system, transmission method or storage technology can guarantee absolute security.

You are responsible for protecting your password, OTP and account access.

Encryption

Information transmitted between supported browsers or applications and GariFile over HTTPS is protected using encryption in transit.

Where particular stored information is encrypted at rest, GariFile may describe that protection separately.

GariFile will not claim that all information is encrypted in every location unless that statement accurately reflects the technical architecture at that time.

Passwords and OTPs

GariFile does not intend to store account passwords as readable plaintext. Passwords should be protected using appropriate one-way password hashing and authentication controls.

Verification OTPs should be temporary and protected with appropriate expiry, attempt limits and rate limiting.

GariFile personnel should never ask you to provide your account password or OTP.

Never send your password or OTP through a contact form, support request or email.

Data Breach and Security Incidents

If GariFile becomes aware of a personal-data or cybersecurity incident, we will assess the incident and take reasonable steps for containment, investigation, remediation and recovery.

Where notification to affected users or an appropriate authority is required under applicable law, GariFile will seek to comply with the applicable notification requirements.

Data Retention

GariFile retains personal information for as long as reasonably necessary to:

• provide the service;
• maintain your account;
• maintain vehicle and document records;
• protect platform security;
• prevent fraud and misuse;
• operate backups and disaster recovery;
• resolve disputes;
• maintain legally required records;
• comply with applicable legal or regulatory requirements.

Different categories of information may have different retention periods.

Where information is no longer reasonably required and there is no applicable legal or legitimate reason to retain it, it may be deleted or anonymized according to applicable retention procedures.

Deletion from the active system may not result in immediate deletion from every backup. Backup copies may remain until they expire or are overwritten according to the applicable backup-retention cycle.

Correction of Your Information

You may be able to correct certain personal information directly through your GariFile account.

You may also contact GariFile to request correction, completion or updating of eligible personal information.

We may verify your identity or authority before making changes where reasonably necessary to protect against unauthorized modification.

Account and Data Deletion

You may request closure of your GariFile account or deletion of eligible personal information.

GariFile may verify your identity before processing a deletion request.

Some information may need to be retained where necessary or permitted for:

• applicable legal requirements;
• security;
• fraud prevention;
• disputes;
• financial records;
• audit requirements;
• legal claims.

Information may also remain temporarily in protected backups until the relevant backup expires or is securely overwritten.

Consent and Withdrawal

Where GariFile relies on your consent for a particular use of personal information, we will provide appropriate information about the relevant purpose.

Where applicable, you may withdraw your consent using the mechanism provided by GariFile or by contacting us.

Withdrawal of consent does not automatically invalidate processing that lawfully occurred before withdrawal and does not require deletion where continued retention or processing is otherwise permitted or required by applicable law.

Your Privacy Rights

Subject to applicable law, its commencement and the circumstances of the request, you may have rights concerning your personal information, including rights relating to:

• information about processing;
• correction;
• completion;
• updating;
• erasure;
• withdrawal of consent where applicable;
• grievance redressal;
• nomination where provided by applicable law.

GariFile may reasonably verify your identity or authority before fulfilling a privacy request.

Privacy-related requests may be sent to:

privacy@garifile.com

Children's Privacy

GariFile is primarily intended for persons capable of managing vehicle, account or business records and is not designed primarily as a children's service.

Where GariFile knowingly processes personal data relating to a child and applicable law requires verifiable consent from a parent or lawful guardian, GariFile will seek to follow the applicable requirements.

Government and RTO Services

GariFile is a private technology platform and is not a government portal.

GariFile is not operated by or part of:

• the Ministry of Road Transport and Highways;
• Parivahan;
• VAHAN;
• an RTO;
• police;
• another government authority,

unless a particular authorized integration expressly states otherwise.

Vehicle information displayed in GariFile does not automatically constitute an official government record.

An expiry reminder does not renew a government document.

A document generated by GariFile does not automatically complete an RC transfer, government application or other official procedure.

Users should verify important information and current requirements through the relevant official authority.

Document Templates and RC Transfer

GariFile may provide document templates, drafts, checklists and RC-transfer workflow assistance.

These features are designed to help users organize and prepare information.

Unless expressly stated and verified otherwise:

• a generated template is not government approval;
• generating a document does not itself submit it to an RTO;
• GariFile does not guarantee acceptance by an RTO or other authority;
• government forms and requirements may change.

Users should verify the current applicable requirements before submitting documents to an RTO or another government authority.

External Links

GariFile may contain links to government websites and other independent third-party services.

GariFile does not control the privacy, security, availability or content of an independent third-party website merely because GariFile provides a link to it.

When you use another service, its own privacy terms and policies may apply.

Cross-Border Processing

Some technology or service providers may operate infrastructure outside your state or, where permitted under applicable law, outside India.

Where personal data is processed or transferred across borders, GariFile will seek to comply with applicable Indian legal requirements and restrictions.

Marketing Communications

Where GariFile provides optional marketing or promotional communications, users will be provided appropriate choices as required by applicable law.

Users may opt out of eligible promotional communications.

Operational communications such as OTPs, account verification, password-reset messages, security alerts and important service notices may still be sent where necessary to operate or protect the service.

Changes to this Privacy Policy

GariFile may update this Privacy Policy when its services, processing practices, security measures, integrations or applicable legal requirements change.

The latest version and effective date will be displayed on this page.

Where required by applicable law, material changes may be communicated through additional notice or consent mechanisms.

GariFile may retain previous policy versions for accountability and reference.

Privacy and Grievance Contact

If you have a privacy question, correction request, deletion request, consent-related request or privacy grievance, please contact:

Email info@garifile.in

You may also use the GariFile Contact page for general enquiries.

Please never include your password or OTP in an email, support request or contact message.