Ritwik Finance Enterprises Private Limited

Privacy Policy

Version 1.0 · Effective 1 November 2026 · Last updated 1 November 2026

1. Preamble

Ritwik Finance Enterprises Private Limited (“the Company”, “we” or “us”) is a non-banking financial company registered with the Reserve Bank of India. This Privacy Policy (“Policy”) explains how the Company collects, uses, shares, stores and deletes personal data in Ritwik One, its staff app on the web (one.ritwikfinance.com) and on Android (the “Platform”).

In this Policy, “you” means an employee or contract staff member of the Company who uses the Platform. The Platform is an internal tool: only staff added by the Company’s administrators can sign in, and members of the public cannot create an account. The Company decides why and how personal data on the Platform is used, so it is the “Data Fiduciary” under the Digital Personal Data Protection Act, 2023.

2. Information the Company Collects

The Company does not:

1. collect your location when no trip is running;
2. read your contacts, messages, files or other apps on your phone; or
3. receive any photos or files other than those you take or upload on the Platform.

Bank details are sensitive personal data under the IT (SPDI) Rules, 2011.

3. Purpose and Legal Basis

Today the Information Technology Act, 2000 and its SPDI Rules, 2011 govern how the Company handles your data. The main duties of the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 start in May 2027, and the Company is preparing to meet them by then.

1. Employment. The Company uses your data to run trips, claims, approvals and payments, and to keep accounts secure. The DPDP Act treats employment purposes as a legitimate use (section 7(i)).
2. Location. The Company still asks your permission on the phone, and tracking runs only after you tap Start trip. You can withdraw the permission at any time.
3. Bank details. The Company collects your bank details for payouts with your written consent, which HR takes at onboarding.
4. Customer details. Customer details you record are used only to verify field visits. Record only what the visit needs. Customers can contact the same Grievance Officer about their data.
5. Records the law requires. The Company keeps payment records and security logs because the Companies Act, 2013 and the CERT-In Directions, 2022 require it.

The Company does not sell personal data or use it for advertising, and never uses location data for advertising or analytics.

4. The AI Odometer Check

When you photograph an odometer, the photo goes to Google’s Gemini model on Vertex AI, in Google Cloud’s Mumbai region. It suggests the kilometre reading and checks that the photo shows an odometer. Google processes the photo in India and does not use it to train its models. Google may hold the photo in memory for up to 24 hours, and may keep a request its systems flag as possible abuse for up to 90 days, in the same region.

The result is advice only: you confirm or correct the reading, a person approves every claim, and approvers can see when the two readings differ. No decision about you is made by the AI alone.

5. Who Can See Your Data

Inside the Company, access depends on your role on the Platform:

1. you see your own trips, claims, wallet and profile;
2. your approvers see the trips and claims of the people who chose them;
3. the Accounts team sees wallets, travel claims and payouts, to pay you; and
4. administrators and the tech team see all records, to run and support the Platform; only the tech team sees the audit log and problem reports.

Outside the Company, these service providers process data on the Company’s behalf, under contract and only on its instructions:

Google Maps features on the Platform are also subject to the Google Maps/Google Earth Additional Terms of Service and the Google Privacy Policy. The Android app is updated only through Google Play.

The Company shares data with others only where the law requires or allows it:

1. authorities such as the Reserve Bank of India, CERT-In, and tax and labour authorities;
2. courts and police, on a lawful order;
3. the Company’s bank, to make payouts; and
4. the Company’s auditors and legal advisers, who must keep it confidential.

6. Data Outside India

Your database records, photos, files and bank details, and the AI check, stay in India, in Google Cloud’s Mumbai region. Emails and sign-in codes (Mailgun) and error reports (Sentry) are handled in the United States, and Google Maps may process map requests outside India.

Indian law allows these transfers unless the Government restricts a country. The Company will follow any such restriction, and will update this Policy before a new provider or country receives your data.

7. How Long the Company Keeps It

The Company keeps data only as long as its purpose needs, or longer where the law requires.

From May 2027 the DPDP Rules require the Company to keep personal data and logs of its processing for at least one year, even if you ask for it to be deleted sooner. Data needed for an open dispute, audit or investigation is kept until that ends. When a period ends, the Company deletes the data or removes what identifies you. Until automatic deletion is live, the Company’s tech team deletes data that is due each quarter.

How to delete your account, and what the Company must keep after you do, is set out in the Account and Data Deletion Policy.

8. Is Your Data Stored Securely?

The Company protects your data with the following safeguards:

1. HTTPS for every connection, and encryption of stored data;
2. photos and files stored privately and opened only through short-lived links;
3. sign-in by one-time email code, with no passwords; sessions end after 12 hours without use, or after 7 days at most, and can be ended at once;
4. role-based access, so people see only what their role needs;
5. money records and an audit log that can only be added to, never edited;
6. application logs that hide sign-in codes, tokens, email addresses, phone numbers and bank account numbers; and
7. daily database backups, kept in Mumbai.

If a personal data breach affects you, the Company will tell you and report it as the law requires: to CERT-In within 6 hours of noticing a reportable incident, and from May 2027 to the Data Protection Board of India.

9. Your Rights

1. Access: ask the Company for a summary of your data, how it is used and who it has been shared with. Most of it is already on the Platform (Trips, Wallet, Profile).
2. Correction: ask the Company to correct or complete inaccurate data.
3. Erasure: ask the Company to erase data it no longer needs, unless the law requires it to be kept.
4. Withdrawal of consent: where the Company relies on consent, such as location permission, you can withdraw it at any time in your phone’s settings. Trips cannot be recorded without location.
5. Nomination: name someone to use these rights for you if you die or become unable to act.
6. Grievance: complain to the Company’s Grievance Officer and then, if you are not satisfied, to the Data Protection Board of India.

To use a right, email the Grievance Officer at support@ritwikfinance.com from the email address you sign in with. Making a request is free, and the Company replies within 30 days. The Company also answers access and correction requests about employment data, though the DPDP Act does not require it.

You can complain to the Data Protection Board after using the Company’s grievance process. The Board’s power to hear complaints starts with the main DPDP duties in May 2027.

10. Cookies

The Platform uses one essential cookie to keep you signed in, and stores GPS points on your phone during a trip until they upload. It uses no analytics or advertising cookies. Details are on the Platform’s Cookies & Local Storage page. This policies website sets no cookies.

11. Changes to this Policy

The Company will update this Policy when the Platform or the law changes, and will show a notice on the Platform before an important change takes effect. The version and dates are shown at the top of this page.