Privacy Policy

TODO_LEGAL_ENTITY_NAME is the Data Fiduciary for the personal data described here. Our registered office is TODO_ADDRESS_LINE_1, TODO_CITY, TODO_STATE TODO_PINCODE, India. For any question about this policy or your data, write to TODO_PRIVACY_EMAIL.

We collect only what we need to run the marketplace.

We do not collect financial instrument details. Card and UPI details are entered directly with our payment gateway and never reach our servers.

We process your data on the basis of the consent you give when you create an account and when you submit a listing, bid or booking, and for the legitimate uses permitted under the DPDP Act — such as responding to a request you have made, and complying with a legal obligation.

You may withdraw consent at any time by writing to TODO_PRIVACY_EMAIL. Withdrawing consent does not affect processing already carried out, and may mean we can no longer provide parts of the service.

A published listing is public. Anyone visiting XMotor can see the vehicle details, photographs, asking price, city and how long it has been listed.

• ·Your phone number is shown only to signed-in users, and only on listings where you have chosen to be contacted.
• ·Your email address is never displayed to other users.
• ·When you place a bid or make an offer, the seller sees your name, city and phone number so they can respond.
• ·Dealers see your name and city on listings they bid on.

We share data only with processors who help us run the service:

• ·Cloudflare R2 — stores the photographs you upload.
• ·Razorpay — processes payments. They receive your name, email and phone to complete a transaction, under their own privacy policy.
• ·Resend — sends transactional email such as verification codes and bid notifications.
• ·Sentry — receives error diagnostics. Credentials, passwords, one-time codes and payment identifiers are stripped before transmission.
• ·Google (Gemini) — where AI features are enabled, listing text and photographs may be sent for price estimation, search interpretation and document reading.

We do not sell your personal data, and we do not share it with advertisers. We may disclose data where required by law, court order or a lawful request from a government authority.

Our servers are located in India. Some processors listed above may process data outside India in accordance with their own safeguards and as permitted under the DPDP Act.

• ·Account data: for as long as your account is open, and for up to three years afterwards where we need it to resolve disputes or meet a legal obligation.
• ·Listings and transaction records: up to eight years, in line with tax and accounting requirements.
• ·Technical logs: up to 90 days.
• ·Backups: rotated on a 14-day daily and 8-week weekly cycle.

Under the DPDP Act 2023 you may:

• ·ask for a summary of the personal data we hold about you and how it is processed;
• ·ask us to correct anything inaccurate, or complete anything incomplete;
• ·ask us to erase your data where it is no longer needed for the purpose it was collected;
• ·nominate another person to exercise these rights on your behalf if you die or become incapacitated;
• ·raise a grievance, and escalate to the Data Protection Board of India if you are not satisfied with our response.

Most of this can be done from your profile page. For anything else, write to TODO_PRIVACY_EMAIL. We respond within 30 days.

• ·Passwords are stored as PBKDF2-SHA256 hashes and are never recoverable in plain text.
• ·All traffic is encrypted in transit over HTTPS.
• ·Access to production data is limited to people who need it to operate the service.
• ·Authentication endpoints are rate limited to resist brute-force attempts.
• ·Uploaded content is validated and sanitised before storage.

No system is perfectly secure. If a breach occurs that is likely to affect you, we will notify you and the Data Protection Board as required.

XMotor is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has given us personal data, write to us and we will delete it.

We use cookies and browser storage only to keep you signed in and to remember your selected city. We do not use advertising or cross-site tracking cookies. Clearing them signs you out.

We acknowledge within 48 hours and resolve within 30 days. If you remain dissatisfied you may approach the Data Protection Board of India.