Last updated: 16 June 2026
This Privacy Policy explains how Cars Mantra ("we", "us") collects, uses, shares and protects personal data of Users of the Cars Mantra website, WhatsApp channel, Telegram channel and related services (the "Platform"). It is published in accordance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 ("DPDP Act"). For the purposes of the DPDP Act, Cars Mantra is the Data Fiduciary.
1. What we collect
- Account & contact data: name, email address, mobile number, city, password hash, communication preferences.
- Vehicle data: registration number, brand, model, variant, year, fuel, transmission, kilometres, ownership, accident and service history, photos, asking price.
- Messaging data: the content of messages you send us via the website chatbot, WhatsApp or Telegram, including any images, voice notes or documents you choose to share with us.
- Transaction metadata: records of payments processed by our payment partner (we do not store card numbers or CVV).
- Device & usage data: IP address, browser type, device identifiers, pages visited, referrer URL, and approximate location derived from IP.
- Cookies and similar technologies: see our Cookie Policy.
2. Purposes and legal basis
We process personal data only for specified, lawful purposes and on the basis of your consent or a recognised legitimate use under the DPDP Act:
- to operate the Platform, create and secure your account, and authenticate sessions;
- to receive, moderate and publish your listing, and to follow up about it on phone, email, WhatsApp or Telegram;
- to share Seller contact details with verified Buyers who have engaged the relevant service, and Buyer enquiries with Sellers;
- to process payments, prevent fraud and meet tax / accounting obligations;
- to improve search, valuation, and the Platform itself using aggregated and de-identified data;
- to respond to grievances and to comply with court orders, regulator requests and other legal obligations.
3. WhatsApp and Telegram submissions
If you send us a listing or query via WhatsApp or Telegram, we receive your phone number / Telegram handle, profile name, message content, and any photos or documents you share. We use this data only to process your enquiry, to publish your listing once you approve, and to contact you about it. WhatsApp and Telegram are operated by third parties; the messages you send pass through their infrastructure and are subject to their own privacy policies.
4. With whom we share data
- Other Users: public listing fields (model, year, kilometres, price, photos, location) are shown to all visitors. Seller contact details are released only to a Buyer who has completed the applicable unlock or enquiry flow.
- Service providers (processors): Cloud hosting, database and storage providers, WhatsApp Business API provider, payment gateway, email and SMS providers, and analytics. They process data only on our instructions.
- Authorities: where required by law, court order, or to protect rights, property and safety.
We do not sell your personal data and we do not engage in cross-context behavioural advertising.
5. Cross-border transfers
Personal data is primarily processed on servers located in or close to India. Some processors may store backups or logs in other jurisdictions. We transfer data outside India only to countries permitted under the DPDP Act and only with contractual safeguards.
6. Retention
We retain personal data only for as long as needed for the purposes above, or as required by law. Approved listings are kept while they are active and for a reasonable archival period thereafter. Account data is retained until you ask us to delete it; payment and tax records are kept for the period required under Indian tax laws.
7. Your rights (Data Principal rights)
- access a summary of the personal data we hold about you;
- correct or update inaccurate or incomplete data;
- erase data that is no longer necessary, subject to legal retention requirements;
- withdraw consent at any time, where consent is the basis of processing (this does not affect prior lawful processing);
- nominate another person to exercise these rights on your behalf in the event of death or incapacity;
- file a grievance via our Grievance Redressal Policy; you also have the right to approach the Data Protection Board of India.
To exercise any of these rights, write to carzmantra@gmail.com. We respond within 30 days.
8. Children
The Platform is not intended for users under the age of 18. We do not knowingly process personal data of children without verifiable parental consent. If you believe a minor has provided data to us, contact the grievance officer.
9. Security
We follow reasonable security practices: encrypted transport (HTTPS), private storage buckets with signed URLs, hashed passwords, role-based admin access, audit logging, and rate-limiting. No system is perfectly secure; in the unlikely event of a personal data breach we will notify the Data Protection Board and affected Users as required by law.
10. Changes
We may update this policy. Material changes will be communicated on the website and, where appropriate, by email.
11. Grievance Officer
Cars Mantra, Gurugram, Haryana, India.
Grievance Officer · carzmantra@gmail.com · +91 99993 82288
See full Grievance Redressal Policy.