Last updated: 31/07/2026
1. Who we are
Qafilaa (“Qafilaa”, “we”, “us”, “our”) is a group-ride coordination service operated by Qafilaa.in, with its registered office at Yashree, Plot no. 41 & 42, Shanti Udyan, Apate Nagar, Radhanagari Road, Kolhapur, Maharashtra 416011, India. We are the Data Fiduciary responsible for the personal data described in this policy.
This policy explains what personal data we collect, why we collect it, how we use and protect it, and the rights you have under applicable law, including the Digital Personal Data Protection Act, 2023.
2. The data we collect
When you join the waitlist or contact us
- Your email address (and your name, if you provide it).
- Any message content you send us.
When you use our website
- Basic technical and usage data such as device type, browser, approximate location derived from IP, pages viewed, and referring links, collected through analytics and cookies (see Section 9).
When you use the Qafilaa app
- Account details: your phone number, email address, display name, photo, and — if you use them — your Google or Apple sign-in identifier. Optionally your date of birth and address.
- Location: your live position, altitude, speed and heading, collected continuously while a ride is active — including in the background, when the app is closed or not in use, and with the screen off. This is what lets your crew see you and what lets help reach you if you go down. Collection stops when the ride ends.
- Health information (sensitive): the medical card you choose to fill in — blood group, allergies, medications and any notes you add. This is optional, and you can delete it at any time.
- Emergency contacts: the name, phone number, email and relationship of the people you nominate. These are other people’s details — see Section 4a.
- Contacts access: if you allow it, we read your phonebook only so you can pick an emergency contact from it. We do not upload your address book.
- Motion and accelerometer data: read from your phone’s sensors to detect a hard impact and start the SOS countdown. These samples are processed on your device only and are never uploaded — only the resulting alert is.
- Camera and photos: images you choose to add — trip photos, bike photos, and scans of documents such as your driving licence and permits.
- Ride history: your route, distance, duration, altitude and speed statistics for each riding day, kept as your own record.
- Content you create: trips, itineraries, rally points, notes, checklists, expenses and settlements.
- Notifications: a push token identifying your device, so crash and SOS alerts can reach it.
- Diagnostics: app version, platform and crash reports, through Google Firebase Crashlytics. Crash reports carry no identifier for you and no request contents.
We do not knowingly collect more than we need to run the service. There is no advertising or cross-app-tracking software in the Qafilaa app.
Where your medical card is stored. Your medical card is held securely on Qafilaa’s servers, not only on your phone. That is deliberate: a medical card that exists only on your device is unreachable in exactly the situation it is for — your phone destroyed, out of battery, or under the bike. It is shown to fellow riders only during an active alert.
3. Why we use your data and our legal basis
We process your personal data on the basis of your consent and to provide the service you have requested. Specifically, we use it to:
- Send you your beta invite and service-related updates (waitlist).
- Operate the live convoy map, gap tracking, rally points, and SOS features.
- Share your location with the other riders in your active ride (see Section 4).
- Maintain, secure, troubleshoot, and improve the service.
- Respond to your enquiries and provide support.
- Comply with legal obligations.
We do not sell your personal data, and we do not use it for advertising you across other services.
4. How location data is shared
Location sharing is the core of Qafilaa, and we have designed it to be tightly scoped:
- Your live location is shared only with the other riders in your active ride, and only while that ride is active.
- When a ride ends, live location sharing stops.
- If you lose signal, your last-known position is cached and shown to your ride with a timestamp until your device reconnects.
- There is no public map. Strangers cannot see your location.
- You can stop sharing by leaving a ride or closing the app, subject to how the feature works at launch.
4a. Emergency contacts — other people’s data
When you nominate an emergency contact, you give us that person’s name, phone number and email address. They have not signed up to Qafilaa, so we treat their details with particular care:
- We contact them only during a genuine safety escalation — never for marketing, product updates or anything else.
- Before we will message them, you confirm in the app that they have agreed to be listed. Please do ask them first.
- When an alert is escalated, they receive the fact of the alert, your name, and your last-known location, so they can help or direct help.
- Removing a contact in the app deletes their details from our systems.
If you are an emergency contact and want your details removed, email admin@qafilaa.in and we will remove them.
5. Who we share data with
We may share personal data with:
- The riders in your active ride, as described above.
- Service providers who help us run Qafilaa (for example hosting, analytics, email delivery, and crash reporting), under appropriate confidentiality and data-protection obligations, and only as needed.
- Authorities or third parties where required by law, or to protect the rights, safety, or property of users or the public.
In the event of a merger, acquisition, or restructuring, data may be transferred as part of that transaction, subject to this policy.
6. Data retention
We keep personal data only as long as needed for the purposes above:
- Raw location traces — the minute-by-minute record of where you rode — are deleted automatically after 90 days. You can shorten that to as little as 7 days in Settings → Privacy & sharing.
- Your ride history — routes, statistics and your photo journal — is kept as your own record until you delete it, because it is what the Ride history and recap screens show you. If you would rather it expired too, switch off “Keep my ride history” in the same screen and it will follow the window above.
- Your account data, including your medical card and emergency contacts, is kept until you delete the item or your account.
- Server logs and routine backups age out within 30 days.
- Waitlist emails are retained until you ask us to remove them or until the waitlist purpose ends.
- We may retain certain data longer where required for legal, security, or accounting reasons.
Deleting your account erases all of the above immediately and irreversibly, including the stored image and document files, not just the database records. See Delete your account for exactly what goes and what necessarily stays because it belongs to other riders too.
7. Security
We use reasonable technical and organisational safeguards to protect personal data against unauthorised access, loss, or misuse. No system is perfectly secure, but we work to protect your information and to limit who within Qafilaa can access it.
8. Your rights
Subject to applicable law, including the DPDP Act, you have the right to:
- Access the personal data we hold about you and a summary of how it is processed.
- Correct, complete, or update inaccurate or incomplete data.
- Erase your personal data where it is no longer needed.
- Withdraw consent at any time (this will not affect processing already carried out).
- Grievance redressal, raise a complaint with us about how your data is handled.
- Nominate another individual to exercise your rights in the event of death or incapacity.
To exercise any of these, email hello@qafilaa.in. We may need to verify your identity before acting on a request.
9. Cookies and analytics
We use a small number of cookies and similar technologies to keep the website running and to understand what is working so we can improve it. We do not use them to track you across unrelated websites. You can control cookies through your browser settings; disabling some may affect how the site works.
10. Children
The Qafilaa service is intended for adults. We do not knowingly collect personal data from children (individuals under 18) without verifiable parental or lawful-guardian consent, as required under the DPDP Act. If you believe a child has provided us data without such consent, contact us and we will take appropriate steps.
11. Data transfers
We may process or store data on servers located in or outside India through our service providers. Where data is transferred, we take steps to ensure it is handled in line with this policy and applicable law.
12. Grievance Officer
In line with applicable Indian law, you can contact our Grievance Officer for any concern about your personal data:
- Name: Yash Turmbekar
- Email: admin@qafilaa.in
- Address: Yashree, Plot no. 41 & 42, Shanti Udyan, Apate Nagar, Radhanagari Road, Kolhapur, Maharashtra 416011
We will acknowledge and respond to grievances within the timelines required by law.
13. Changes to this policy
We may update this policy from time to time. We will post the updated version here with a revised “Last updated” date, and where appropriate we will notify you. Continued use of the service after changes means you accept the updated policy.
14. Contact us
Questions about this policy or your data? Email hello@qafilaa.in or write to Qafilaa.in, Yashree, Plot no. 41 & 42, Shanti Udyan, Apate Nagar, Radhanagari Road, Kolhapur, Maharashtra 416011, India.