Legal

Data Retention & Deletion Policy

1Retention schedule

RYDO will maintain a schedule for account data, trip records, payment and tax records, captain verification documents, support tickets, security logs and incident records. For each category, the schedule identifies the purpose, the retention period or criteria and any legal hold that may apply.

2Data minimisation

RYDO does not keep personal data indefinitely merely because storage is available. Data is retained only as needed for the stated service, safety, fraud prevention, dispute handling or legal obligations, subject to applicable law. Where possible, aggregated or de-identified information is used for trend analysis.

3Deletion requests

Eligible account or data deletion requests can be sent to support@rydoind.in. Some records may need to be retained for statutory, payment, safety, fraud-prevention or legal-claim purposes; retained data is restricted to those purposes, and RYDO explains the outcome of each request.

4Secure disposal and vendors

When data is no longer needed, it is securely deleted or anonymised where appropriate. Service-provider copies and backups are covered by the deletion process, subject to practical limits on immediate deletion from backups, and vendors are expected to support agreed deletion and return obligations.

5Legal holds

Routine deletion is paused when records must lawfully be preserved for an investigation, claim or legal requirement. RYDO documents why a hold is necessary, who approved it and when it will be reviewed, restricts access to the retained records, and resumes normal deletion when the need ends. RYDO keeps evidence of deletion actions and exceptions.

6Access permissions and audits

RYDO reviews who can access personal records and why, removes access when a staff member or vendor no longer needs it, investigates unusual access, and periodically audits permissions for sensitive identity, location, payment and incident records.

7Anonymisation and analytics

Where longer-term trend analysis is useful, RYDO considers aggregated or de-identified information rather than keeping directly identifiable records, and assesses whether information could still reasonably identify a person before treating it as anonymous.

8Requests involving another person

RYDO verifies the identity and authority of a requester before disclosing or deleting information, especially where a request concerns another account or a trip involving multiple people. RYDO does not disclose one user’s personal information to another without an appropriate basis.

9Review of the schedule

RYDO reviews retention periods at least when services, vendors, legal requirements or risk levels change, records the decision and the responsible owner, and trains relevant teams to follow the schedule rather than keeping records indefinitely by default.