Privacy notice
Last updated 28 October 2026
This notice describes how ATAP works during its pilot. It will change as features are added, and we will update the date above when it does.
What we collect when you report a vehicle
The photo you take, the plate you confirm, the category you choose, your optional one line note, the time the photo was taken, and your location if your browser shares it. We also set a random device token in a cookie and keep only a one way hash of it, so we can limit abuse without knowing who you are. We do not ask for your name, phone number or email to report. If you choose to create an optional profile, we link the reports you send while signed in to it, to give you recognition. Owners never see this link, and deleting your account removes it. If you choose "Tell me when the owner replies", we also keep your browser's notification address against that same anonymous device token, only to send you that one kind of notice. You can switch it off at any time.
What we collect from owners
Your email address, to sign you in with a one time code. For each vehicle you add, a photo of the registration certificate, a photo of the vehicle and an optional note. Our hosting software also records the IP address and browser details of your sign in sessions. If you choose to type in the expiry dates of your insurance, PUC or fitness certificate for reminders, we keep those dates with the vehicle until you clear them, and use them only to send those reminders. We do not check them.
What we collect for organisations
If you create an organisation for a school or a fleet, we keep its name and kind, the plates and labels you list on its roster, and the email addresses of the people you invite to it. Everyone in an organisation sees the same roster and the counts of reports and praise for its verified vehicles, never who sent a report, a photo or a place. Inviting someone sends no message. You can remove a plate or a person, and you can delete the organisation, which removes its roster, its people and its invitations. Listing a plate does not verify it.
What we collect from drivers
If a vehicle's owner gives you a shift link and you tap Start, we keep the name you type and your shift start and end times for 180 days. Only that vehicle's owner can see them, and the owner may see public feedback about the vehicle during your shift next to your name. We do not track your location or ask for anything else. If the owner belongs to an organisation, the other people in it see only whether someone is on shift and how many shifts started in the last week, never your name.
Who can see a report
Only the verified owner of that vehicle and ATAP staff who review reports and claims. Reports about a plate nobody has claimed stay private. Reporters are never identified to owners.
How long we keep things
Report photos are kept for 90 days at most. Registration certificates and vehicle photos submitted to verify ownership are removed 30 days after the review. The written record of a report, meaning what happened, when, the place if you shared one and any note, stays after the photo is deleted. It holds no name or contact detail. Records that a move alert was sent, and of reminders sent, are deleted after 90 days. Account and profile records stay until you ask us to delete them. Records of server errors, which hold no name, email or plate, are deleted after 30 days. We keep a nightly backup of our database for 14 days, so a record we have deleted can remain in a backup for up to 14 days.
Cookies
We use only what is needed to run the service: a device token for abuse limits, a sign in session cookie, and a language preference. We do not use advertising or tracking cookies.
Who handles the data for us
ATAP is hosted by Hostinger, which also provides our email. We do not sell personal data.
Your rights
You can ask to see, correct or delete personal data we hold about you, and you can complain if you think we have mishandled it. Write to privacy@atap.in or grievance@atap.in. The name of our grievance officer will be published here before public launch.