Last updated: October 2026
1. What this policy covers
This Privacy Policy explains how XploreCabs ("we", "us") collects, uses, shares and protects your personal data when you use the XploreCabs website (www.xplorecabs.com) and the XploreCabs mobile app to book cabs (local, outstation, airport transfers and group travel) or stays and homestays. It is written to meet India's Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and its rules.
2. Information we collect
Account details: your name, mobile number and (optionally) email address. Trip and stay details: pickup and drop addresses and their map coordinates, travel dates, trip type, passenger or guest count, chosen vehicle or property, add-ons and coupon codes. Searches: when you request a fare or availability, we record that enquiry (including your contact details if you are signed in) so our team can confirm the price and follow up. Saved items: addresses you save, properties you add to your wishlist, ratings and reviews you leave, and messages you send to support. Payment records: the amount, status and payment reference of each transaction — never your full card, UPI or bank details. Technical data: basic device, browser and app information and the page or campaign that brought you to us, used to keep the service secure and understand which channels work.
3. How we verify your account
We verify your mobile number with a one-time password (OTP) sent by SMS, including through Google Firebase Phone Authentication. We don't keep the OTP itself — only a record that your number was successfully verified.
4. How we use your information
To quote fares, create and manage your bookings, assign drivers and hosts, send booking confirmations and trip updates, process payments and refunds, call or message you about an enquiry or booking (including over WhatsApp if you contact us there), respond to support requests, prevent fraud and misuse, meet legal obligations, and improve our services. If you subscribe to our newsletter we may email you offers and travel articles — you can unsubscribe at any time from the link in any email.
5. Location data
With your permission, the app uses your device's precise location to pre-fill your pickup point and suggest nearby options. You can decline or withdraw this permission in your device settings and type an address instead. Addresses and map coordinates you enter or save are stored with your booking or profile. During an active cab trip, the assigned driver's live location is shared with you so you can track your ride; location pings are recorded only while a trip is in progress. We do not track your location in the background.
6. Who we share information with
Drivers, cab operators and property hosts: only what they need to fulfil your booking — your name, phone number and trip or stay details. Service providers who process data on our behalf: Razorpay (payments), Google Firebase (phone verification), Ola Maps (maps, address search and routing), Resend (transactional and newsletter email), and our cloud hosting, database and file-storage providers. Authorities: where required by law, court order or to protect the safety of our users. We do not sell your personal data and do not share it with advertisers.
7. Payments
Online payments are processed by Razorpay. Your card, UPI and bank details are entered on and handled by Razorpay under its own PCI-DSS compliant security standards — XploreCabs never sees or stores them. We keep only the transaction reference, amount and status.
8. Cookies and local storage
Our website stores a small amount of data in your browser — your sign-in session and your selected city — so you stay logged in and don't have to re-enter your preferences. The app stores your sign-in session on your device. We do not use third-party advertising cookies.
9. How we protect your data
Data is sent over encrypted (HTTPS) connections, access to customer records is limited to authorised staff, and sign-in sessions expire and can be revoked. No system is perfectly secure, but we take reasonable safeguards and will notify you and the authorities of a personal data breach as the law requires.
10. Data retention
We keep your account and booking information while your account is active. Booking, invoice and payment records are retained for as long as tax, accounting and other laws require (generally up to 8 years), and for resolving disputes. Fare enquiries that never became a booking are deleted or anonymised once they are no longer needed for follow-up.
11. Your rights and choices
You can view and update your profile, and delete saved addresses and wishlist items, at any time in the app or website. You also have the right to request a copy of your personal data, to have it corrected, to withdraw consent (for example, to location access or marketing email), and to nominate someone to exercise these rights on your behalf.
12. Deleting your account
To delete your XploreCabs account and personal data, email support@xplorecabs.com from your registered email, or call or WhatsApp us from your registered mobile number, with the subject "Delete my account". We will verify the request and delete your account, profile, saved addresses, wishlist and reviews within 30 days. Records of completed bookings and payments are kept only for as long as the law requires (see Data retention) and are then deleted.
13. Children
XploreCabs accounts are intended for adults aged 18 or over. We do not knowingly collect personal data from children; a booking that includes child passengers should be made by a parent or guardian. If you believe a child has given us personal data, contact us and we will delete it.
14. Changes to this policy
We may update this Privacy Policy from time to time and will change the "Last updated" date above. Material changes will be highlighted on the website and in the app.
15. Contact and grievances
Questions, requests or complaints about your personal data can be sent to our Grievance Officer at support@xplorecabs.com or +91 84314 84090. We will acknowledge your complaint within 48 hours and aim to resolve it within 30 days. If you are not satisfied with our response, you may approach the Data Protection Board of India.