Zory operated by iDisha Info Labs PRIVATE LIMITED
This Privacy Policy (“Privacy Policy” or “Policy”) is effective as on 22-Oct-2026 (“Effective Date”). The Privacy Policy has been last updated on: 22-Oct-2026
1. INTRODUCTION
1.1 iDisha Info Labs Private Limited, a company incorporated under the Companies Act, 2013, having its registered office at No.19 & 36/14K, KMJ AVEN, CHINNAPPANA HALLI VILLAGE, Marathahalli Colony, Bangalore, Bangalore North, Karnataka, India (“Company”, “We”, “Us” or “Our”), provides Taxi services under the name “Zory Taxi” through the Zory mobile application and which are owned and operated by iDisha Info Labs Private Limited (“iDisha”), Quick Ride mobile applications or web applications which are hosting Taxi services, pursuant to applicable arrangements between CoRide and iDisha. These Taxi services together with Our offline interactions such as emails, phone calls, or in-person communication (together, the “Platform”). The Platform helps Passengers to avail the Taxi services at a cost by connecting to nearest Driver Users.
1.2 This Privacy Policy explains what Personal Data (“Personal Data” or “Data”) We collect, why We collect it, how We use, share and protect it, and the rights and choices You have. It forms part of Our Terms of Use.
1.3 This Privacy Policy is published in compliance with the Digital Personal Data Protection Act, 2023, as amended from time to time (“DPDP Act”), the Digital Personal DataProtection Rules, 2025 , as amended from time to time(“DPDP Rules”), the Information Technology Act, 2000, as amended from time to time (“IT Act”), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, as amended from time to time (“SPDI Rules”) and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, as amended from time to time (“Intermediary Rules”) and other applicable regulations. All of the above shall collectively be referred to as “Data Protection laws”.
1.4 For the Personal Datadescribed in this policy, We are the “Data Fiduciary” under the DPDP Act. “You” means any person who uses the Platform, whether as a vehicle owner (Car or Bike) offering a ride (“Driver User”) by sharing empty seats on a fixed pre-published route or as a co-Passenger (“Passenger”). Terms such as “Personal Data”, “Data Principal”, “Data Processor”, “Data Fiduciary”,“Data Protection Board of India”,“Consent Manager”,“Processing”“Significant Data Fiduciary”, “Data Protection Officer”, “Grievance Appellate Committee”, “Grievance Officer” shall have the meaning assigned to it under the relevant Data Protection Laws.
1.5 Please read this Policy carefully. If You do not agree with it, please do not use the Platform. Where the law requires your consent, We will ask for it separately and clearly before We process your Data; You do not give consent merely by reading this policy or by installing the app.You may read this Privacy Policy in English or in any language listed in the Eighth Schedule to the Constitution of India. The Platform currently offers it in English; to request another, write to the contact in section 18.
2. PERSONAL DATAWECOLLECT
2.1 We collect only the Personal Datathat We need to use to run the Platform and provide services. This includes:
(i). Account information:Your name, Date of birth, mobile number, email for communication, email address, profile photograph, gender, and login credentials such as an OTP ;
(ii). Identity verification information:Company Name, Profession, Official email address, Government issued ID, the type and last four digits of a government identity document, a selfie used to match You to that document, and the result of the verification. We do not store your full Aadhaar number. The selfie is processed to create a facial template that is used only to match You to your document and is deleted within 180days of verification. We ask for your express consent before collecting it. If You choose to verify with Aadhaar, We use only a masked number or virtual ID, in line with the Aadhaar Act, 2016 as amended from time to time; Verification may be conducted usingany of the government id including Aadhar, PAN ID, Voter ID, Driving License details.
(iii). Driver User and vehicle information (Driver Users only): driving licence number and validity, vehicle type, vehicle registration number, make, model and colour, and insurance and details;
(iv). Trip information: pickup and drop locations, home, office addresses, route, date and time of the trip, seats offered or booked, trip status, and ratings and reviews You give or receive;
(v). Location information: the precise location of your device while a trip is active or while You use a location-based feature, and your approximate location when the app is open;
(vi). Payment information:Your UPI ID or a token representing your payment instrument, transaction references and transaction amounts, and (for Driver Users) the designated bank or UPI account to facilitatepayouts of shared-cost savings accumulated by offering empty seats to co-riders. We do not store your card number or CVV; as all card payments are securelymanaged and processed exclusively by our authorized third-party payment partner. payments are handled by Our payment partner;
(vii). Safety and support information: emergency contacts You choose to add, SOS alerts, incident reports, and your communications with Our support team, including call recordings;
(viii). Device and usage information: device model, operating system, app version, IP address, advertising identifier, crash reports and how You use the app;
(ix). Contacts: phone contacts that You choose to share, only if You use the invite feature or referral features;
(x). Referral to other known :Contact information and network details of your personal or professional acquaintances, as voluntarily provided by you, for the purpose of facilitating user endorsements, peer referrals, and community network building.
(xi). Mobile Device ID / Tokens :Device specific credential utilized to deliver critical real-time transaction updates, security alerts, and platform engagement notifications directly to your mobile device.
2.2 We collect this information (a) directly from You, (b) automatically from your device when You use the Platform and have given the relevant permission, and (c) from Our identity-verification and payment partners when You are directed to them.
2.3 If You give Us the Personal Dataof another person, such as an emergency contact, You confirm that You have their permission to do so and We will not be liable to obtain separate consent from such person.
2.4 We do not knowingly collect Data about your health, religion, caste, sexual orientation or political views.
2.5 We may also hold limited Personal Dataof people who are not users, such as emergency contacts and nominees named by a user, people who contact Our support team or apply for jobs with us, and visitors to OurWebsite. We use that Data only for the purpose for which it was given to Us.
3. WHY We USE YOUR PERSONAL DATA
3.1 We use your Personal Dataonly for the following specified purposes:
(i). to create and secure your account and verify your identity and, for Driver Users, your driving licence and vehicle;
(ii). to match Passengers and Driver Users, show limited details to your match, enable live tracking and let users rate each other;
(iii). to collect your share of the trip cost and pay out Driver Users through Our payment partner;
(iv). to use your precise location for navigation, pickup coordination and route-deviation alerts during a trip;
(v). to provide safety features such as the SOS button and trip sharing with your emergency contacts, and to investigate incidents and complaints;
(vi). to send You service messages about your trips, account and payments;
(vii). to detect and prevent fraud, misuse and security incidents, and to enforce Our Terms of Use;
(viii). to improve and analyse the Platform, but only where You have agreed;
(ix). to send You offers, promotions and referral rewards, but only where You have agreed; and
(x). to comply with laws, court orders and lawful requests of government authorities.
3.2 We will not use your Personal Data for any other purpose without first giving You a fresh notice and, where the law requires, obtaining your consent again.
3.3 We do not sell or rent your Personal Data to anyone.
3.4 Your information is utilized strictly for commercial purposes and services You have opted for by registering with the Platform. In the event that the organization elects to transfer its business operations as a going concern to any other corporate entity, successor, or subsidiary, Your personal information will be transferred alongside the business assets, and the acquiring entity shall remain fully bound by the terms and obligations of this Privacy Policy.
3.5 Ratings and reviews are shown to other users as described in section 5.We may suspend, restrict or remove an account where verified reports, repeated low ratings, document mismatches or fraud indicators show that users' safety is at risk or Our Terms of Use have been breached. Some fraud and safety signals are generated by automated systems, but a member of Our team reviews every suspension or removal. You may ask for that review, and for the reasons for the decision, through the Grievance Officer in section 13.
3.6 We send promotional SMS, calls and emails only with your consent and in line with the telecom regulator's rules on commercial communications.
4. CONSENT AND YOUR CHOICES
4.1 We process your Personal Dataon the basis of your consent, except where the DPDP Act allows Processing without consent. Your consent will be free, specific, informed, unconditional and unambiguous, and given by a clear affirmative action, such as ticking a box or switching on a setting in the app. Each request for consent will tell You what Data is needed and for which purpose, and will link to this Privacy Policy and to the ways of withdrawing consent and contacting us.
4.2 You may use the core features of the Platform without consenting to analytics or marketing. Where a feature cannot work without particular Data, such as precise location during a trip, We will state the same when We ask for such Data.
4.3 You may withdraw your consent at any time, as easily as You gave it, through Settings > Privacy > Manage consents in the app or by writing to Us at support@zory.in. After You withdraw your consent, We will stop Processing your Personal Datafor that purpose within a reasonable time and will ask OurData Processors to do the same, unless the law requires Usto keep it. Withdrawal does not affect Processing that happened before You withdrew. You will bear the consequences of withdrawal, which may include Our being unable to provide a feature or the whole service.
4.4 The DPDP Act allows Us to process Personal Data without consent in limited cases. We rely on these only where they apply, for example where You have voluntarily given Us your Data for a purpose You have told Us about and have not objected to, where We must comply with a law or a court or tribunal order, or where We must respond to a medical emergency or an immediate threat to the life or health of any person.
4.5 When Consent Managers registered with the Data Protection Board of India become available, You will also be able to give, review and withdraw your consent through a Consent Manager of your choice.
5. WHO WE SHARE YOUR PERSONAL DATAWITH
5.1 We share your Personal Dataonly as needed for the purposes in section 3, and only with:
(i). Other users on your trip:aPassenger sees the Driver User's first name, photograph, rating, vehicle details, profession and office details, statistics of platform usage, route, fare, and live location during the trip. A Driver User sees the Passenger's first name, photograph, rating, profession and office details, statistics of platform usage, route, and pickup and drop points. Phone numbers are masked, and calls and chats take place within the app.Users may use this information only for the trip. Using it to contact, follow, harass or identify the other person after the trip, or sharing it with anyone else, breaches Our Terms of Use and may lead to removal from the Platform and, where the law requires, a report to the authorities.
(ii). Data Processors:service providers who process Data on Our behalf, such as cloud hosting, mapping, SMS, Email, and Payment gateways, identity and licence verification, payment, customer support and analytics providers. They receive only the Data they need and are bound by written contracts to follow Our instructions, to keep the Data secure and to delete it when We ask.
(iii). iDisha Info Labs Private Limited: For convenience of usage, the taxi services offered by iDisha Info Labs Private Limited. (“iDisha”) are hosted on the Quick Ride app. If You choose to use the taxi services, Your Personal Data will be shared with iDisha so that You can avail those services. iDisha acts as a separate fiduciary for the taxi services, and its handling of Your Data is governed by its own privacy policy.
(iv). Insurers.where applicable, insurers and claim handlers, to process a claim made by or against You.
(v). Your emergency contacts.The live location of You and Your ride information, when you share a trip or press the SOS button.only when You share a trip or press the SOS button, the live locat
(vi). Authorities: Government bodies, courts and law-enforcement agencies, where the law requires or a lawful order is made.As an intermediary, we provide information or assistance to a lawfully authorised Government agency within 72 hours of receiving its written order stating the purpose.
(vii). Successors:a buyer or successor to Our business, if We merge, are acquired or sell Our business, who will be bound by this Policy. We will tell Youwhenthis happens.
5.2 A list of the categories of Data Processors We use is available on request.
6. TRANSFER OF PERSONAL DATA OUTSIDE INDIA
6.1 We store your Personal Dataon servers located in India. Some of OurData Processors, such as [SMS or analytics provider], may process Data outside India.
6.2 The DPDP Act permits transfers of Personal Dataoutside India except to countries or territories that the Central Government restricts by notification.We do not transfer Personal Datato any restricted country.We require overseas Data Processors to protect your Data at a standard no lower than this policy, andWe retain within India the system logs that Indian law requiresUs to keep here.
7. LOCATION DATA AND SAFETY FEATURES
7.1 We collect your precise location only while a trip is active or You are using a feature that needs it, such as setting a pickup point. You can turn off location access in your device settings at any time, butWe will then be unable to match or track trips.
7.2 Safety features, such as trip sharing and SOS, use your location and trip details only when You switch them on or press SOS.
7.3 CHILDREN AND PERSONS WITH DISABILITY
7.4 The Platform is meant for persons aged 18 years and above. No person under 18 may register as a Driver User or Passenger on their own account. A child may travel only on a booking made by a parent or guardian, who gives verifiable consent on the child's behalf beforeWe process the child's Data.We verify that the parent is an adult by checking identity and age detailsWe already hold or details issued by an authorised entity,.
7.5 IfWe learn that an account belongs to a person under 18,We will suspend it and delete the Data, unless the law permitsUs to keep it.We do not process a child's Personal Data in any way that is likely to harm the child's Well-being.We do not track or monitor the behaviour of children, or direct advertising at them.
7.6 If You are a person with disability and have a lawful guardian, your guardian may give consent on your behalf.We will verify that the guardian is lawfully appointed before relying on their consent, as the DPDP Rules require.
8. HOW LONGWEKEEP YOUR PERSONAL DATA
8.1 We keep your Personal Dataonly for as long as it is needed for the purpose for which it was collected, andWe erase it when You withdraw your consent or that purpose is served, unless the law requiresUs to retain it. In general:
(i). account and profile Data is kept while your account is active and for 84 months after it is closed, to handle disputes;
(ii). identity and licence verification records are kept for 84months after account closure;
(iii). trip, rating and incident records are kept for 5years from the trip, to deal with claims, disputes and legal proceedings;
(iv). payment and invoice records are kept for, as long as accounting and tax laws require;
(v). your registration details are kept for 3yrs after you cancel or withdraw your registration, and information and records of content we remove or disable access to are preserved for 3yrs, or longer if a court or an authorised Government agency requires it, as Rule 3(1)(g) and (h) of the Intermediary Rules require, even if you ask us to erase them earlier
(vi). precise location trails are kept for 180days after a trip ends, unless an incident is open; and
(vii). traffic Data and system logs are kept for at least one year, as the DPDP Rules require.
8.2 If your account stays inactive for 2 years,We maygive You at least 48 hours' notice before erasing it, so that You can log in or ask for your Data. After erasureWe may keep anonymised Data that can no longer identify You.
9. HOWWEPROTECT YOUR PERSONAL DATA
9.1 We take reasonable security safeguards in accordance with to prevent Personal Databreaches. These include encryption of Data in transit and at rest; masking or tokenisation of identifiers such as licence and payment details; role-based access controls and multi-factor authentication for Our staff; logging and continuous monitoring of access to Personal Data; tested backups; written contracts requiring Data Processors to apply equivalent safeguards; and staff training. Our information security programme follows well defined Information security policy and is audited annually.
9.2 No system is completely secure. Please keep your login details private and inform Us at once if You suspect misuse of your account.
10. PERSONAL DATA BREACH
10.1 If a Personal Databreach affects You,We will inform You without delay through the app and by SMS or email. Our message will describe what happened, when and where it happened, the likely consequences for You, the stepsWe have taken to limit harm, the steps You can take to protect yourself, and whom to contact.
10.2 We will also report the breach to the Data Protection Board of India without delay, followed by a detailed report within 72 hours, and report cyber security incidents to CERT-In within six hours, as the law requires.
11. YOUR RIGHTS
11.1 Under the DPDP Act, You have the right to:
(i). access a summary of the Personal DataWe process about You and OurProcessing activities, and the identities of all other Data Fiduciaries and Data Processors with whomWe have shared it, together with a description of the Data shared;
(ii). correction, completion and updating of your Personal Data that is inaccurate, incomplete or out of date;
(iii). erasure of your Personal Data when it is no longer needed for the purpose for which it was collected or You withdraw your consent, unless the law requiresUs to keep it;
(iv). withdraw consent at any time, as described in section 4;
(v). grievance redressal, as described in section 13; and
(vi). nominate another person to exercise your rights on your behalf if You die or become incapable of doing so.
11.2 You can exercise these rights through Settings > Privacy in the app or by writing to Our Grievance Officer in section 13.We may need to verify your identity before acting on a request.We will respond within 30days and in any case within the time the DPDP Rules allow.
11.3 You also have duties under the DPDP Act. You must comply with applicable laws, must not impersonate another person, must not suppress material information when givingUs your Data, must not make a false or frivolous complaint, and must giveUs only verifiably authentic information when exercising your rights.
12. GRIEVANCE REDRESSAL
12.1 If You have a question or complaint about howWe handle your Personal Data, or wish to exercise your rights, please contact Our Grievance Officer:
Name: Vishal Lavti
Designation:COO
Address: No.19 & 36/14K, KMJ AVEN, CHINNAPPANA HALLI VILLAGE, Marathahalli Colony, Bangalore, Bangalore North, Karnataka, India
Email: nodalofficer@zory.in
12.2 We will acknowledge your complaint within 24 hours and resolve it within 7 days, and in any case within the maximum period the DPDP Rules allow.
12.3 If You are not satisfied with Our response, or do not receive one in time, You may make a complaint to the Data Protection Board of India. The Board will ordinarily consider a complaint only after You have used Our grievance process.
13. ADDITIONAL COMPLIANCE INFORMATION
13.1 If the Central Government notifies us as a Significant Data Fiduciary We will appoint a Data Protection Officer based in India who reports to our board or equivalent body, publish their business contact details here, appoint an independent data auditor to carry out a data audit, and carry out periodic data protection impact assessments and audits, under Clause 10 of the DPDP Act (as clarified by the Removal of Difficulties Order dated 5 October 2026) and Rule 13 of the DPDP Rules.
13.2 We are an intermediary under the Information Technology Act, 2000. Our grievance officer will acknowledge your complaint within 24 hours and resolve it within 7 days. A complaint asking us to remove content that breaches Rule 3(1)(b) of the Intermediary Rules will be acted on within 36 hours, and a complaint about intimate or impersonating images of you within 2 hours. We will remove or disable access to unlawful content within 3 hours of a court order or a reasoned written notice from an authorised officer. If you are not satisfied with our decision, or we do not resolve your complaint in time, you may appeal to the Grievance Appellate Committee within 30 days of the Grievance Officer's communication. Where these periods are shorter than those in clause 13.2, the shorter periods apply to complaints covered by those Rules.
13.3 Our Terms of Use and this policy are available in English and in any language listed in the Eighth Schedule to the Constitution. You must not host, upload, display or share information that belongs to another person, impersonates another person, or is unlawful or prohibited under Rule 3(1)(b) of the Intermediary Rules. If you break our rules we may terminate or suspend your access, or remove or disable access to the information, and unlawful content may expose you to penalty or punishment under the IT Act or other law; offences that must be reported by law will be reported to the authorities.
14. COOKIES AND SIMILAR TECHNOLOGIES
14.1 OurWebsite uses cookies, and Our app uses software development kits (SDKs), to keep You logged in, remember your settings, measure performance and prevent fraud. Strictly necessary cookies work without consent. Analytics and marketing cookies and SDKs run only if You accept them in the cookie banner or in Settings > Privacy, and You can change your choice at any time.We do not use them to show You targeted advertising.
15. CHANGES TO THIS PRIVACY POLICY
15.1 We may update this policy from time to time, for example when Our services or the law change.We will notify You of material changes in the app and by email or SMS before they take effect. If a change requires your consent,We will ask for it again; continuing to use the Platform will not be treated as consent. The “last updated” date at the top shows the current version, and earlier versions are available on request.
16. GOVERNING LAW
16.1 This Privacy Policy is governed by the laws of India. Subject to your rights under the DPDP Act, the courts at Bangalore shall have jurisdiction over any dispute arising from it.
17. CONTACT US
17.1 For any question about this Privacy Policy or your Personal Data, please write to support@zory.in or to the Grievance Officer named in section 13.