Privacy policy

Last updated 2026-08-19 · AIABS Research and Services Pvt Ltd

1. Who this notice covers

This notice is published by AIABS Research and Services Pvt Ltd (“AIABS”, “we”, “us”), a private limited company with its registered office in New Delhi, India. It explains how we handle personal data in two distinct situations, which we deliberately keep separate:

• This website (aiabs.co) — what happens when you read these pages or send us an enquiry.
• The Sakshya platform — the driver app, fleet console, manager app and KYD scoring engine.

Under India’s Digital Personal Data Protection Act, 2023 (DPDP Act), AIABS is the Data Fiduciary for personal data collected through this website. For personal data processed inside a fleet customer’s deployment of Sakshya, the fleet operator determines the purpose of processing and AIABS acts as a Data Processor on their documented instructions; where a driver uses Sakshya directly, AIABS is the Data Fiduciary. Where the General Data Protection Regulation (GDPR) applies to a visitor in the EU or UK, the equivalent roles are controller and processor.

2. What this website collects

Very little, by design.

Category	What we do
Cookies	None. This site sets no cookies of any kind — not analytics, not advertising, not preference cookies.
Analytics & trackers	None. There is no Google Analytics, no tag manager, no pixel, no session recording and no A/B testing tool.
Third-party scripts	None. Fonts are self-hosted on our own domain specifically so that reading this site does not disclose your IP address to a font provider.
Server logs	Our hosting provider records standard request data (IP address, timestamp, user agent, requested URL) to serve pages, mitigate abuse and keep the service available. These logs are retained for a short operational period and are not used to profile you.
Enquiry form	Only what you type: name, work email, organisation, enquiry type, approximate fleet size and your message, plus the consent you tick.
Local storage	A service worker caches page assets in your browser so the site loads quickly and works offline. It stores no personal data and no identifiers, and clearing your browser data removes it.

We do not use your enquiry to build a marketing list, we do not enrich it against third-party databases, and we do not sell, rent or share it for anyone else’s marketing.

3. Why we process enquiry data, and on what basis

We process the details you submit through the contact form for one purpose: to respond to your enquiry and, where relevant, to progress the commercial conversation you started — a fleet pilot, an insurer partnership, an investor discussion, a security report, a data-protection request, a press question or a job application.

Our lawful basis is your consent, given by ticking the consent box, together with the legitimate interest of responding to a business enquiry you initiated. You may withdraw consent at any time (see your rights); withdrawal does not affect processing already carried out.

4. Who we share it with

We keep the list of third parties short and name them:

Processor	Purpose	Notes
Netlify	Website hosting and content delivery	Serves these pages and keeps standard request logs.
Formspree	Contact-form delivery	Receives the form contents and forwards them to us by email. Submitting the form transmits your details to Formspree.
Our email provider	Receiving and replying to your enquiry	Standard business email, access limited to the founders.

These providers may process data outside India, including in the United States. Where the GDPR applies, such transfers rely on the providers’ standard contractual clauses. We do not transfer enquiry data to any jurisdiction restricted by the Central Government under section 16 of the DPDP Act.

We will also disclose personal data where we are legally required to — a valid order from a court or a competent authority — and we will tell you when we are permitted to do so.

5. The Sakshya platform — how driver data is treated

The platform is governed by the in-product consent flow, the fleet customer’s own notice to its drivers and our data-processing agreement with that customer. The principles below are implemented in the product itself, not merely stated here:

• Consent is the front door. Consent for data, live location and chat is granular, expiring and revocable, expressed as one unified predicate across the entire codebase and enforced in continuous integration, so no surface can quietly apply a different rule.
• No silent tracking. A driver joins a fleet through a UIN invite carrying an explicit consent link. Capture does not begin without it.
• An off-duty boundary. An off-duty driver is not visible to their employer. Family and peer sharing is a separate feature with separate consent, outside the employer relationship entirely.
• Access history. Every read of a driver’s data is logged per read and shown to that driver.
• Export and erasure. DPDP-grade data export and right-to-erasure cascade across 37 tables, with a continuous-integration gate that fails the build if a newly added table escapes the sweep.
• Data minimisation to insurers. The insurer partner API is served through a scoped token and returns score, history, feature breakdown, trips, portfolio distribution and quote-handoff verification. Raw location is never served.
• Security controls. Device integrity attestation, biometric sign-in, encrypted local storage and a signed, fail-closed remote-configuration channel.

If you are a driver and want to exercise a right over data held by a fleet that uses Sakshya, you may contact us and we will route the request to the correct party, but the fleet operator is normally the Data Fiduciary for that data.

6. How long we keep things

• Enquiries: kept while the conversation is live and for up to 24 months afterwards, so we can pick up a thread you started. Deleted sooner on request.
• Server logs: retained for a short operational period by our hosting provider, then discarded.
• Platform data: retained per the fleet customer’s agreement or, for direct users, until the account is deleted or erasure is requested — subject to any record we must retain by law.

7. Your rights, and how to use them

Under the DPDP Act, as a Data Principal you have the right to access a summary of your personal data and how it is processed, the right to correction and completion, the right to erasure, the right to nominate another person to exercise your rights in the event of death or incapacity, and the right to a grievance redressal process. Where the GDPR applies, you additionally have rights to restriction, portability and objection, and the right to lodge a complaint with your supervisory authority.

To exercise any of these, use the contact form and select “Privacy / data-protection request” as the subject. That form is our designated channel for data-protection requests and it reaches the founders directly. We will acknowledge within 7 days and respond substantively within 30 days. We may need to verify your identity first — we will ask for the minimum needed to do that and nothing more.

8. Children

Neither this website nor the Sakshya driver app is directed at children. The driver app requires a person to be of legal driving age in their jurisdiction, and we do not knowingly process the personal data of a child as defined by the DPDP Act. Where a school-transport deployment involves information about students, that information is held by the school or operator as Data Fiduciary and we process it only on their documented instructions, with tracking limited to the vehicle rather than the individual child.

9. Changes to this notice

We will update this page when our practices change, and we will change the “last updated” date at the top. Material changes affecting how we use enquiry data will be highlighted here. This notice is available in English; if we publish translations, the English version governs.

Questions about anything on this page: use the contact form.