Yaan Highway Truck Parking & Rest Stays
Home / Privacy Policy

Privacy Policy

Last updated: November 10, 2026 · Applies to Yaan, Yaan Partner, and yaanapp.com

1. Who We Are

This Privacy Policy explains how Yaan ("Yaan", "we", "us", or "our"), a Private Limited organisation operating in India, collects, uses, stores, protects, and shares personal data when you use our mobile applications or visit our website.

  • Legal Organisation Name: Yaan
  • Organisation Type: Private Limited
  • Mobile Applications: Yaan (Guest & Driver App) and Yaan Partner (Hotel & Dhaba Owner App)
  • Registered Address: Ganesh Kunj, Dahej Bypass Rd, Nandelav, Bharuch, Gujarat, 392015, India
  • Website: https://yaanapp.com
  • Email: Yaaan.paid@gmail.com
  • 24×7 Support Phone: +91 94085 25988

2. Scope

This Privacy Policy applies to:

  • The Yaan mobile application (Android package ID: com.yaan.truckparkingbooking) used by truck drivers, fleet operators, and travelers ("Guests" or "Users").
  • The Yaan Partner mobile application (Android package ID: com.yaanvendor.truckparkingbooking) used by highway hotel and dhaba owners ("Hotel Owners" or "Partners").
  • Our public website at https://yaanapp.com.

Yaan serves users located in India and is intended strictly for adults aged 18 years and older.

3. Information We Collect

We collect only the information needed to register accounts, verify phone numbers and partners, process bookings and payouts, and operate the platform.

3.1 Information Collected from Guests (Yaan App)

  • Account & Profile Details: Full name, email address, 10-digit Indian mobile number, password (stored as a one-way cryptographic bcrypt hash), and optional profile photo (avatar).
  • OTP Verification Data: Firebase User ID (UID) and OTP verification token generated via Google Firebase Authentication to verify your mobile number during registration.
  • Truck & Booking Details: Booking date, selected hotel, truck wheel category (such as 4 Wheel to 22+ Wheel), vehicle registration number (truck number), logistics company name, logistics contact phone number, and any applied promo/offer code.
  • Payment Transaction Metadata: Booking subtotal, 18% GST amount, discount applied, total payable amount, payment method category (such as UPI, card, net banking, or wallet), Razorpay order ID, Razorpay payment ID, payment status, and gateway verification/webhook records.
  • Ratings & Reviews: Star rating (1 to 5) and review text submitted after completed bookings.
  • Route Search Inputs & QR Scans: Origin and destination city names and coordinates entered when searching highway routes, plus hotel QR codes (YAAN IDs) scanned or typed manually for spot booking.

3.2 Information Collected from Hotel Owners (Yaan Partner App)

  • Partner Account Details: Owner full name, email address, 10-digit Indian mobile number, bcrypt password hash, and Firebase UID from OTP verification.
  • Property & Listing Details: Hotel or dhaba name, description, street address, city, state, PIN code, property GPS coordinates (latitude and longitude), listed amenities, room/slot capacity, pricing (including optional wheel-category pricing), property photos, and your assigned YAAN code/QR.
  • Identity & Business Verification (KYC) Details: 12-digit Aadhaar number and front/back images of your Aadhaar card, 10-character PAN number and PAN card image, business/property proof document, and (where provided) 14-digit FSSAI license number and license copy and 15-character GSTIN and GST certificate copy.
  • Bank & Payout Settlement Details: Bank name, bank account number, IFSC code, and settlement ledger details (payout amount, payment method, UTR/UPI reference, and payout date).
  • Arrival Check-In Data: Booking IDs, driver phone numbers, or truck registration numbers scanned by QR code or searched manually to confirm check-in.

3.3 Automatically Collected & Technical Data

  • Network & Server Metadata: When our mobile apps call our API servers, standard HTTP request metadata—such as IP address, request timestamp, requested route path, and user-agent—is processed for rate limiting (preventing login/OTP abuse) and server container diagnostics.
  • Error & Admin Audit Records: Unexpected server exceptions automatically generate internal error alerts (exception message, endpoint URL, and stack trace) sent to our administrators to fix bugs. When administrators review or override a transaction record, the administrator's IP address is logged for audit integrity.
  • Local App Preferences on Device: Both mobile apps store your login token, selected language (English or Hindi), read notification IDs, and dismissed offer banner IDs locally on your phone. The Customer app also caches basic profile details locally for faster screen loading.
  • No Ad Trackers or Crashlytics: Neither mobile app embeds advertising SDKs, ad tracking identifiers, Firebase Crashlytics, or third-party behavioral analytics SDKs.

4. How We Use Information

  • Account Setup, OTP Verification & Authentication: Name, email, mobile number, bcrypt password hash, Firebase UID, and user role are used to create Guest or Partner accounts, prevent cross-role misuse, keep you signed in, and process forgotten-password resets.
  • Route Discovery & Maps: Route city names/coordinates and hotel coordinates are used to find partner hotels near a highway corridor and display map locations and driving routes.
  • Booking Fulfilment & Check-In: Guest name, phone number, booking date, truck wheel type, vehicle number, logistics details, and payment status are used to reserve slots, compute GST totals, issue booking confirmations, and help Hotel Owners verify arriving drivers.
  • Payments & Partner Payouts: Razorpay order/payment IDs and amounts are used to verify online payments and resolve duplicate or slot-conflict transactions. Owner bank details and GSTIN are used to calculate GST/commission shares and manually transfer Partner payouts.
  • Partner KYC Verification & Platform Trust: Aadhaar, PAN, business proof, FSSAI, and GST records are reviewed manually by our administrators to verify Partner identity and property legitimacy before publishing listings.
  • Route Planning & In-App Offer Eligibility: Route search logs (searched city pairs and result counts) help us identify corridors needing more Partner hotels. Prior booking count and timing are used to show relevant in-app promotional offer banners.
  • Security, Abuse Prevention & 24×7 Support: IP-based rate limits protect login and OTP endpoints from automated abuse, and your account/booking details allow our 24×7 support team to resolve booking, check-in, or payment concerns.

6. Who We Share Information With

We never sell or rent your personal data to third parties for advertising or marketing. We share information only with parties necessary to deliver our platform:

  • Partner Hotel / Dhaba Owners: When a Guest places a booking, we share the Guest's name, mobile number, truck wheel category, truck registration number, logistics company name and contact number, booking date, and payment status with that specific Hotel Owner so they can verify and check in the driver. Guests do not receive Owner KYC/bank details, and Owners do not receive Guest card or UPI credentials.
  • Payment Gateway — Razorpay: Order amount (INR), booking reference, hotel name, truck number, and Guest email/phone are shared with Razorpay to initiate and confirm online checkout payments and any authorized refunds.
  • Authentication — Google Firebase Authentication: Your mobile number and OTP verification codes/tokens are processed by Google Firebase to send SMS OTPs and confirm mobile ownership.
  • Mapping & Routing — Google Maps Platform: City search queries, place IDs, property coordinates, and route origin/destination coordinates are sent to Google Maps, Places, and Directions APIs (plus device geocoding when Partners pin addresses) to render maps and highway routes.
  • Cloud Infrastructure — Render & Neon PostgreSQL: Our backend API is hosted on Render (Singapore region) and application records are stored in Neon PostgreSQL (managed cloud PostgreSQL).
  • Email Delivery — Gmail SMTP: Password reset links (name, email address, reset URL) and internal operational/error alerts to administrators are transmitted through Gmail SMTP.
  • Supporting Technical Services:
    • QRServer (api.qrserver.com): Printable hotel standee QR images pass only the hotel's public YAAN code (e.g., YAAN-XXXXXXXX) to render a QR graphic.
    • Unsplash (images.unsplash.com): When a Partner hotel has not uploaded its own cover image, the app loads a fallback hotel photo from Unsplash.
    • User-Initiated External Apps: Tapping "Directions" opens Google Maps on your phone; tapping "Chat with us", "Share on WhatsApp", or "Call" opens WhatsApp or your phone dialer directly.
  • Legal & Regulatory Authorities: We may disclose records where required by Indian law, tax/GST authorities, court orders, or lawful government requests.

7. Payments

All online booking payments in the Yaan app are processed through Razorpay (supporting UPI, debit/credit cards, net banking, and wallets). Yaan does not collect, process directly, or store your credit/debit card numbers, CVV, internet banking passwords, or UPI PINs.

Our servers store only transaction metadata returned by Razorpay, including Razorpay order ID, Razorpay payment ID, payment method category (such as UPI or Card), INR amount, payment status, and gateway verification/webhook records.

8. Location, Camera & Photo Permissions

  • Foreground Location (ACCESS_FINE_LOCATION / ACCESS_COARSE_LOCATION):
    • In Yaan (Guest App): Requested only when you view the hotel route map screen to show your live location and route to the hotel.
    • In Yaan Partner (Owner App): Requested only if you tap "Use Current Location" when setting your hotel pin on the map.
    • No Background Tracking: Neither app collects your location in the background or when closed.
  • Camera (CAMERA): Used only when you open the in-app QR scanner (Guests scanning a hotel standee QR; Owners scanning a driver's booking QR). Live camera feeds are used purely to recognize the QR text on-device and are not recorded or uploaded as video.
  • Photo Library / Gallery: Used only when you select an image to upload as your Guest profile avatar, hotel listing photo, or Owner KYC verification document.

9. Data Storage, International Transfers & Security

Infrastructure & Cross-Border Storage: Although Yaan operates in India, our backend API runs on Render in its Singapore region and uses Neon managed cloud PostgreSQL infrastructure (which may be hosted outside India). By using Yaan, you acknowledge that your information is transmitted to and processed on these cloud servers under the safeguards described in this Policy.

Security Safeguards Implemented in Our Platform:

  • All production traffic between our mobile apps, website, and API servers uses HTTPS/TLS encryption in transit with HSTS security headers enabled, and database connections require SSL (sslmode=require).
  • User and Partner passwords and password-reset tokens are protected with one-way bcrypt hashing; API authentication tokens are stored hashed on the server and expire after 30 days.
  • Razorpay payment completions and webhook callbacks are verified cryptographically with HMAC-SHA256 signatures.
  • Uploaded Owner KYC documents are placed in a private storage directory outside the public web root, blocked from direct URL downloads via server configuration rules, inspected for valid file headers (JPG/PNG/WEBP/PDF), and served only to authenticated administrators.
  • Role-based middleware blocks Guest accounts from accessing Partner KYC/bank details or Administrator routes, and rate limiters throttle repeated login, registration, and OTP verification requests.

No internet transmission or electronic storage system is completely risk-free. Please keep your login credentials confidential and contact us immediately if you suspect unauthorized access.

10. Data Retention

  • Unverified Abandoned Accounts: Unverified accounts that have no bookings, hotel listings, or KYC records are automatically deleted after 24 hours.
  • Login & Password Reset Tokens: API login tokens expire automatically after 30 days (or immediately upon logout or account deletion). Password reset tokens expire after 30 minutes.
  • Active Accounts, Profile Photos & Owner KYC / Bank Records: Retained while your account remains active and deleted immediately upon in-app account deletion (or within 7 days of verifying an off-app deletion request).
  • Booking, Payment, GST & Partner Payout Ledger Records: Retained in anonymized form (with your name, email, phone number, and Guest logistics contact details removed) for up to 8 years to meet Indian tax and GST accounting requirements.
  • Anonymized Route Search Logs & Container Logs: Route search logs have any linked user ID cleared upon account deletion and are retained in anonymized form for route network planning. Server diagnostic logs follow Render's standard container log retention period.

11. Your Rights and Choices

In accordance with the DPDP Act, 2023 and applicable Indian law, you may exercise the following rights:

  • Access & Review: View your account details, bookings, and (for Partners) KYC/hotel records in the app, or request a summary by emailing Yaaan.paid@gmail.com.
  • Correction: Update your name, email, profile photo, or hotel information directly in the app. Because mobile numbers are OTP-verified, contact our 24×7 helpline (+91 94085 25988) if you need to update a registered phone number.
  • Deletion / Erasure: Permanently delete your account in the app or via our public Account Deletion page.
  • Withdraw Consent: Disable Location, Camera, or Photo permissions at any time in your phone's App Settings, or stop using the apps and delete your account.
  • Promotional Communications: Yaan does not send automated marketing SMS or email blasts. In-app promotional offer banners can be dismissed directly inside the app.
  • Grievance Redressal: Raise any privacy complaint with our Grievance & Data Protection Officer (Section 17).

12. Account and Data Deletion

You can permanently delete your Yaan account in two ways:

  • Inside Yaan (Guest App): Open the app → go to Profile & settings → tap Delete account → confirm deletion.
  • Inside Yaan Partner (Owner App): Open the app → go to Account → tap Delete Account → confirm deletion.
  • Without Opening the App: Follow the public instructions at https://yaanapp.com/delete-account.html by emailing Yaaan.paid@gmail.com or calling our 24×7 helpline at +91 94085 25988 from your registered mobile number. Off-app deletion requests are verified and completed within 7 days.

What is deleted vs. kept:

  • Deleted or anonymized immediately: Your name, email address, phone number, password, Firebase UID, API access tokens, and uploaded avatar image. For Hotel Owners, your Aadhaar, PAN, bank account details, FSSAI/GST records, and uploaded KYC files are permanently deleted and your hotel listing is set inactive/offline. Guest logistics contact fields, Razorpay payer contact metadata in logs, and search-log user associations are also removed.
  • Retained for legal & platform records: Anonymized booking and Razorpay transaction records (dates, INR amounts, transaction IDs, truck type/number) and Partner payout ledger entries are retained for up to 8 years under Indian GST/tax laws. Submitted reviews remain displayed under "Deleted User".

13. Children's Privacy

Yaan is intended solely for individuals aged 18 years and older (including commercial drivers, fleet staff, and business owners). We do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has provided personal data through Yaan, please email Yaaan.paid@gmail.com or call +91 94085 25988 immediately so we can delete that account and personal data.

14. Cookies and Website Storage

This informational website at https://yaanapp.com does not set cookies, run analytics trackers, load advertising scripts, or write to browser local storage. (Separately, our internal administrative web portal uses strictly necessary browser storage solely for administrator session authentication.)

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in legal obligations, technology, or Yaan features. Whenever changes are made, we update the "Last updated" date at the top of this page and publish the revised version at https://yaanapp.com/privacy-policy.html.

17. Contact & Grievance Officer

For questions about this Privacy Policy, data requests, or DPDP Act / IT Rules grievances, contact:

  • Organisation: Yaan (Private Limited)
  • Designated Contact: Grievance & Data Protection Officer, Yaan
  • Email: Yaaan.paid@gmail.com
  • 24×7 Helpline Phone: +91 94085 25988
  • Registered Office: Ganesh Kunj, Dahej Bypass Rd, Nandelav, Bharuch, Gujarat, 392015, India