Privacy policy
What CoBuy Car collects, why, who sees it, how long we keep it, and how to have it corrected or deleted.
The short version
We collect only what we need to run your pool and your order. We don't sell your data, we don't show ads, and the dealer gets your name and number only when you book.
Who is responsible
CoBuy Car, operated by CoBuy Car, Bengaluru, Karnataka, India, decides how your personal data is used (the "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023). Contact: hello@cobuycar.com or WhatsApp +91 84316 35120.
What we collect
- From buyers: your mobile number; the car you want (brand, model, variant, fuel/gearbox, colour) and any exchange car; your request ID and pool; your choices on the final price (insurance option, loan option and amount, extras); your own insurance policy number if you add one; payments made through us (amount, Razorpay payment ID, status) and any payment you report to a dealer (amount, method, bank reference); your delivery slot; and the history of your order.
- From dealers: name, dealership, brand, area, GSTIN (optional), work email, mobile number, a securely hashed password, the agreement you sign and your bids.
- Automatically: your IP address, used briefly to block abuse (limits on codes and requests), and anonymous counts of how many people reach each step of the sign-up, with no personal identifiers.
- What we don't collect: card numbers or UPI PINs (Razorpay handles payments), or ID documents. Give your PAN, Aadhaar and income papers to the dealer or bank directly; never upload them to CoBuy.
Why we use it
- To verify your number and keep your account secure.
- To place you in a pool, show live demand to dealers (model, variant, colour and count only, never your identity) and get bids.
- To send your final price, booking, payment and delivery updates on WhatsApp and in My orders.
- To take and refund payments, keep accounts and meet legal obligations.
- To prevent fraud and misuse.
We use your data with your consent, given when you verify your number and join, and for the purposes you'd reasonably expect from that.
Who we share it with
- The dealer you book with: your name, mobile number and order details, only after you book.
- A partner bank: your number and loan choice, only if you tick the box asking the bank to contact you.
- The insurance partner: what's needed to issue your policy, only if you choose CoBuy's insurance option.
- Service providers who process data for us: Vercel (website hosting), Upstash (database, Mumbai region), Google (records in Google Sheets), Meta (WhatsApp messages), Razorpay (payments). They may store data outside India under their own safeguards.
- Authorities, when the law requires it.
We never sell your personal data.
Cookies and local storage
We don't use advertising or tracking cookies. Signed-in dealers and the site owner get one essential, secure login cookie. Buyers' sign-in is kept in the browser's local storage for up to 7 days so My orders stays open; signing out removes it.
How long we keep it
Login codes expire in 10 minutes and are stored only in scrambled form. Requests and orders in our database expire about 13 months after their last update, so we can handle refunds, warranty questions and disputes. Copies in our business records (payments, bookings) are kept only as long as accounting and tax law require, then deleted.
Your rights
You can ask us to access, correct or erase your personal data, withdraw consent, or nominate someone to act for you. Write to hello@cobuycar.com or message us on WhatsApp. We reply within 7 days and act within 30 days. Withdrawing consent stops future use; it doesn't undo a booking you've made with a dealer.
Grievances
If you're unhappy with how we've handled your data, write to our grievance contact at hello@cobuycar.com. If we don't resolve it, you can complain to the Data Protection Board of India.
Security
Connections are encrypted (HTTPS), passwords are hashed, codes are single-use and time-limited, and access to order data is limited to the site owner and, for bookings, the assigned dealer.
Children
CoBuy is for adults. Don't use it if you are under 18.
Changes
We'll update this page if our practices change and show the new date at the top.