Privacy Policy

This is the full, formal Privacy Policy for Talusi and Talusi HQ (together, the "Service"), operated by NNA Innovations Pvt Ltd ("Talusi", "we", "us"). It explains, in detail, what personal data we process, why, for how long, who it is shared with, and how you exercise your rights over it — including the rights given to you under India's Digital Personal Data Protection Act, 2023 ("DPDP Act"). It is incremental: it describes only what is built and shipped today, and a new feature adds its own section, in the release that ships it — never in advance of it.

01Who we are

Talusi is a companion app for road trips and group drives, made by NNA Innovations Pvt Ltd, based in India and building for drivers everywhere. This policy covers the Talusi app, the Talusi HQ organiser console, and this website — every surface NNA Innovations Pvt Ltd operates under the Talusi name.

Under the DPDP Act, NNA Innovations Pvt Ltd acts as the Data Fiduciary for the personal data described in this policy: the party who decides why and how that data is processed, and who is accountable for it. Where an event organiser processes data collected through their own event (section 06), they do so as an independent data fiduciary for their own guest list, and this policy explains what we do with that data on their behalf.

02Definitions

Terms used through this policy, defined once here:

Personal Data: Any data about a person who is identifiable by or in relation to that data — your name, phone number, email, date of birth, vehicle details, a photograph, or a payment record tied to you.
Processing: Anything done to personal data — collecting it, storing it, using it, sharing it, or deleting it.
Data Principal: The individual the personal data is about — you, when you use Talusi, register for an event, or respond to an RSVP link.
Data Fiduciary: The party who determines the purpose and means of processing personal data, and answers for it — NNA Innovations Pvt Ltd for this Service, and each club or trip operator for the events they run (section 06).
Consent: Your freely given, specific, informed and unambiguous agreement to a particular processing of your personal data, given by a clear affirmative action — a checkbox, a form submission, or an in-app toggle. We never bundle an "accept all" across unrelated purposes.
Event, Organiser, Roster: An Event is a group drive run on Talusi by a club or trip operator (the Organiser). The Roster is that event's participant list, visible in the scoped, limited form described in section 06.
Grievance Officer: The person designated under the DPDP Act to receive and resolve your complaints about how your personal data is processed — reachable at the address in section 15.

03What we collect

We collect only what a feature you use actually needs. In detail:

Your account — a phone number verified by one-time code, or the name and email address shared by Google or Apple sign-in; a display name; and your date of birth, used once to confirm you are 18 or older.
Your device — a push-notification token (so the app can notify you) and the app version.
Technical logs — errors and security events that help us keep the service running and safe.
Contact form — your name, email address and message, so we can respond to your enquiry.
This website — no cookies, no trackers; only your light/dark choice, stored on your own device.

Sections 06, RSVP and 07 describe the further categories of personal data collected specifically when you join an event — registration details, payment proof, event-day activity and identity documents — because that collection is conditional on the events you choose to join, not on using Talusi at all.

04What we never do

No selling or renting of your personal data, to anyone, ever.
No advertising, ad tracking, or profiling of your behaviour.
No third-party advertising or analytics SDKs in the app.
No location use outside the drive and trail features you choose: recording, route guidance, event sharing and attaching a position to a help request. You control location permission and can turn event sharing off.

05Why we collect it, and our legal basis

We process your personal data for the following purposes, and only to the extent each purpose requires:

Signing you in and keeping your account secure.
Running events — registering you, keeping the payment record straight, and getting your group along the route together.
Notifying you about things you've asked to hear about.
Responding to enquiries submitted through the contact form.
Keeping the service safe — debugging, abuse prevention, and duties the law places on us.

Our legal basis. Under the DPDP Act, we process your personal data on the basis of the consent you give when you create an account, register for an event, or respond to an RSVP link — each purpose asked for on its own, never bundled with another. Where processing is necessary to comply with a legal obligation placed on us (for example, retaining a money record after a payment settles), or for a purpose the DPDP Act itself recognises as not requiring consent (such as responding to a request you make of us), we rely on that basis instead, and this policy says so explicitly wherever it applies.

06Events you join

Clubs and trip operators run their group drives on Talusi. When you register for an event, your details go to that event's organiser — it is their event and their guest list. We store and handle everything for them, and all of this page's promises still apply.

Your registration — your name, phone number and vehicle number; the people coming with you, by name (and age, for children); and whatever else the event's form asks — email, gender, t-shirt sizes, meal counts, the organiser's own questions — along with your answers and the consent you gave.
Payment proof — on a paid event, the payment screenshot you attach and the record of what was received and refunded. Photos are stripped of hidden metadata — such as the location your camera embeds — before they are stored.
Event day — your rollcall check-ins along the route, your answers in the event's polls and quizzes, and the gear checks you confirm.

Who sees what. The event's organisers see your full registration. Fellow participants see the roster — names, who is riding together, vehicle model and the last four characters of the number plate — and a quiz leaderboard shows names and scores. Your phone number, email, payment details and documents are never shown to other participants.

Event location sharing. While an event is live, sharing shows your group's recent position to fellow participants and organisers. When automatic rollcall is enabled, fresh, accurate readings near an open itinerary stop can also mark your group present. The attendance record identifies an automatic arrival; you or an organiser can correct it manually. You can turn sharing off in the event, which removes your group's retained live positions. Keeping sharing active with the screen off is a separate choice in the app, limited to the event's live window. Turning off event sharing does not stop a personal drive recording you have started.

Signing in. Shared links show an invitation and let you open or download the Talusi app. You sign in before taking action. A link does not grant access to another person's registration, chat or documents.

Trail assistance. When you request help, organisers receive the category, your note and the position you explicitly choose to attach. An assigned responder can be an organiser or a volunteer. Lead and sweep groups can see active requests to help coordinate the convoy; private notes are not included in that shared list. The app distinguishes sending a request from a person acknowledging it.

Important instructions. Organisers can ask your group to acknowledge a briefing. We record the instruction's revision, group, account and acknowledgement time so organisers can see which groups still need to respond. Editing an instruction requires a new acknowledgement.

Feedback. When an organiser offers feedback that is anonymous to organisers, their results and exports omit your identity. You still sign in, and Talusi stores the account-linked response to let you manage it and prevent duplicate submissions.

On your device. Downloaded trail packs contain the itinerary, available recorded routes, permitted contacts, stays, gear and handbook, with a saved time and expiry. ID images and payment proof are excluded. These packs and HQ's queued field updates use encrypted device storage with an account-specific key. Signing out clears them; HQ warns before discarding queued updates. A lock-screen trail status is a separate choice and may be visible to someone looking at your device. Its update and expiry labels tell you when it is no longer current.

Event alerts. If you allow notifications on an event page, that event can send alerts to your device — announcements, route changes, results — through your phone or browser's own notification service. Turn them off any time in your device's notification settings.

Organiser actions are logged. Edits to your registration, payment confirmations, refunds and every viewing of an ID document leave a record of who did what, and when.

Organisers get notified. As an event runs, its organisers may have moments — a new registration, a payment marked, the convoy fully counted — announced in a team channel they run on a messaging service such as Discord. Those messages carry your roster name and, where money moved, the amounts — never your phone number, email, screenshots or documents.

Leaving, and afterwards. If you cancel or are removed, your registration moves off the roster into the organiser's archive, so a mistake can be undone. Once any payment is fully settled, it can be cut down to the money record alone — name, phone, vehicle and amounts — because records of money that changed hands have to stay. Deleting an event removes everything under it. The roster is the organiser's guest list, so the organiser is the fastest way to correct a detail or come off a list; your rights in section 12 and our contact in section 15 always stand behind that.

RSVPEvent RSVP links

An organiser may share an Engage RSVP link. You open the app and sign in to respond, including before registering when the invitation permits it. We store your verified account contact and your answer; organisers see the response and the name attached to it. Responding does not add you to the trail's roster. Registration collects any required traveller, vehicle and payment details separately.

Automated retention removes RSVP responses once the event is archived and its end date is more than 56 days ago. An active event is never swept by that retention process.

07ID documents at events

Some events need to see an identity document — a driving licence for a checkpoint, say. When an event asks for one, you photograph it in the event's form and we encrypt it the moment it arrives; only the encrypted copy is ever stored. It can be opened only by the event's organisers, and every viewing is logged.

Aadhaar is not accepted — driving licence, passport and voter ID are. Your Aadhaar stays with you.
You can replace or remove an uploaded document from the same form while it is open.
After the event, the organiser can erase every stored document in one step — and erased means destroyed, not archived.

09Where it lives, and how it's protected

Your data is stored on our servers in India, encrypted in transit, with access inside the company role-limited and logged. Encrypted backups are taken and tested as a matter of routine. These are the "reasonable security safeguards" the DPDP Act requires of us as a Data Fiduciary, applied to every category of personal data this policy describes.

10How long we keep it

We keep each category of personal data only for as long as the purpose it was collected for requires, summarised here — the detail behind each row is in the section named alongside it.

Data category	Retention	Detail
Account & profile	While your account is active	§11
Event registration & payment	While the event is live; reduced to the money record once settled; removed if the organiser deletes the event	§06
RSVP responses	Removed by retention cleanup once the event is archived and its end date is more than 56 days ago	§RSVP
Identity documents	Until the organiser erases them (any time after the event); no automatic retention beyond that	§07
Technical & security logs	Only as long as needed for debugging and abuse prevention, then routinely rotated out	§03
Contact form submissions	Until manually removed from the Discord channel; no fixed automated retention	§03
Deletion record & required audit records	At least one year after account deletion, before final purge	§11
Encrypted backups	Expire as backups rotate out on their standing schedule	§11

11How to delete your data

While your account is active, your data stays so the app can serve you. Delete your account and it goes with it:

In the app — Profile → Delete account. We ask you to type DELETE, then sign you out on every device immediately.
By email — write to from your registered email, or include your registered phone number; we verify it is you, then delete.

Deleted profile identifiers, account access, organiser memberships and notification registrations are taken out of use immediately. Event organisers may retain event, payment and legally required audit records for legitimate purposes. Talusi keeps the minimal deletion record and required logs for at least one year before final removal; copies in encrypted backups expire as backups rotate out on schedule. The table in section 10 summarises this for every category of data we hold.

12Your rights under the DPDP Act

As a Data Principal under the DPDP Act, you have the following rights over your personal data, each exercised the same way — from the app where the feature exists, or by writing to the Grievance Officer in section 15:

Right to access — a summary of the personal data we hold about you and how it is being processed.
Right to correction and completion — fix anything in your data that is inaccurate, incomplete, or misleading, and complete anything left incomplete.
Right to erasure — delete your account and the personal data tied to it (section 11), except what we or an event organiser must legally retain.
Right to withdraw consent — withdraw, at any time and as easily as you gave it, your consent to any purpose that relies on it; we then stop that processing, without affecting what was lawfully done before you withdrew.
Right to grievance redressal — raise a complaint about how your data has been processed, and have it resolved by our Grievance Officer before you need to approach the Data Protection Board of India.
Right to nominate — nominate another individual to exercise these rights on your behalf in the event of your death or incapacity, by writing to the Grievance Officer with the nominee's details.

Every request gets a reply, and we resolve them as fast as we can — within 90 days at the outside. If you are not satisfied with how we have resolved a grievance, you may complain to the Data Protection Board of India. Where the law of your country gives you further rights, they apply too.

13Under 18

Talusi is for licensed drivers and the people who drive with them — it is an 18+ service. We ask for your date of birth at sign-up and do not open accounts for anyone under 18. If we learn that a minor's data has been collected, we delete it.

Children do come along on family drives. The adult who registers for an event can add a child as a companion — we take just the name and age the adult gives, the event uses them for rooms, child rates and t-shirt sizes, and they are deleted with the registration. Children never get accounts of their own.

14When this policy changes

When we change what we collect or how we use it, we update this page, raise the version number and effective date above, and tell you in the app before the change applies to you. Where a change needs new consent, we ask for it — not assume it.

15Reach us, and our Grievance Officer

Questions, requests, corrections, deletions and complaints all land here, and every one gets a reply. This is also the designated contact for the Grievance Officer the DPDP Act requires us to name (section 12) — the same address, for every kind of request this policy describes:

Privacy & Grievance Officer
NNA Innovations Pvt Ltd