Gulf Mitra – Privacy Policy

Last Updated: May 4, 2026 | Effective Immediately

At Gulf Mitra ("we", "our", "us", the "Platform"), we are committed to protecting and respecting your privacy. Gulf Mitra is a peer-to-peer community platform that connects verified travelers with verified requesters for the purpose of personal item transfers using spare baggage space. Gulf Mitra is not a courier, logistics, or shipping service. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our Platform, regardless of where you are located in the world. By using the Platform, you agree to the collection and use of information in accordance with this Privacy Policy.

1Information We Collect

1.1 Personal Identification

Full legal name
Email address
Phone number (mandatory, OTP verified)
Profile photograph
Date of birth (for age verification)

1.2 Verification Documents

Government-issued ID (Aadhaar, Passport, National ID)
Proof of travel (PNR, tickets) for Travelers
Live selfie for liveness verification
Vehicle registration details (for applicable travel modes)

1.3 Transaction & Activity Data

Booking and request history
Trip details (origin, destination, dates)
Chat messages between users
Delivery OTP confirmation records
Review and rating data

1.4 Technical & Device Data

IP address, browser type, operating system
Device identifiers and model
Pages visited, time spent, click patterns
Approximate geolocation (for route matching)
Referral source and session data

2Lawful Basis for Processing

We process your data based on the following legal grounds under applicable law (including GDPR Article 6):

Contractual NecessityTo create your account, match you with peers, and facilitate the platform's core services.
Legitimate InterestTo prevent fraud, ensure platform security, improve services, and enforce community standards.
Legal ObligationTo comply with identity verification requirements, tax laws, and respond to lawful government requests.
ConsentFor marketing communications, optional analytics cookies, and geolocation services. You may withdraw consent at any time.

3How We Use Your Information

3.1 Service DeliveryConnecting Requesters and Travelers, facilitating verified peer-to-peer baggage space sharing, and processing Delivery OTP confirmations.
3.2 Identity VerificationVerifying your identity through government ID checks and live selfie liveness detection to maintain a 100% verified community.
3.3 CommunicationSending booking updates, delivery notifications, safety alerts, and responding to support inquiries.
3.4 Safety & Fraud PreventionMonitoring for prohibited items, detecting suspicious activity, and cooperating with law enforcement when required.

4How We Protect Your Data

We implement industry-standard security measures including AES-256 encryption at rest, TLS 1.3 encryption in transit, secure cloud infrastructure, regular security audits, role-based access controls, and automated threat detection. While we take every reasonable precaution, no method of electronic storage or transmission is 100% secure.

5Sharing Your Information

With Other Users: Your verified name, profile photo, rating, and trip/request details are visible to matched peers to facilitate trust and coordination.
Service Providers: Cloud hosting (Vercel, Supabase), email delivery, and analytics providers who process data on our behalf under strict data processing agreements.
Legal Compliance: When required by law, court order, subpoena, or government request from any jurisdiction where we operate.
Safety & Enforcement: To protect the rights, safety, or property of Gulf Mitra, its users, or the public, including cooperation with customs and border authorities.
Business Transfers: In connection with any merger, acquisition, reorganization, or sale of assets, your data may be transferred as part of the transaction.

We never sell your personal data to third parties for advertising or marketing purposes.

6International Data Transfers

Gulf Mitra operates globally. Your data may be transferred to, stored in, and processed in countries other than your country of residence, including India, the United States, and countries within the European Economic Area. When we transfer data internationally, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, data processing agreements with all sub-processors, and compliance with local adequacy requirements. By using the Platform, you consent to the transfer of your data to countries that may have different data protection laws than your jurisdiction.

7Your Data Protection Rights

Depending on your location, you may have the following rights under applicable data protection laws:

Access & Rectification: Right to view, correct, or update your personal data at any time.

Erasure ("Right to be Forgotten"): Right to request deletion of your data, subject to legal retention obligations.

Data Portability: Right to receive a copy of your data in a structured, machine-readable format.

Restriction of Processing: Right to limit how we process your data in certain circumstances.

Object to Processing: Right to object to processing based on legitimate interests or for direct marketing.

Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting prior processing.

Jurisdiction-Specific Rights

EU/EEA (GDPR): You have the right to lodge a complaint with your local Data Protection Authority.
California (CCPA/CPRA): You have the right to know, delete, and opt-out of the sale of personal information. We do not sell personal information.
India (DPDPA 2023): You have the right to access, correct, erase, and nominate a representative for your data.
UAE/GCC: You have rights under the UAE PDPL, Saudi Arabia PDPL, Bahrain PDPA, and other applicable GCC data protection laws.

To exercise any rights, contact: privacy@gulfmitra.com. We will respond within 30 days.

8. Data Retention

We retain your data for as long as your account is active or as needed to provide services. After account deletion, we may retain certain data for up to 5 years to comply with legal obligations, resolve disputes, and enforce agreements. Anonymized and aggregated data may be retained indefinitely for analytics.

9. Automated Decision-Making

Gulf Mitra uses automated systems for route matching between Travelers and Requesters. These systems do not make decisions that produce legal effects or significantly affect you. Identity verification involves automated liveness detection but is supplemented by manual review where required. You have the right to request human intervention in any automated decision.

10. Children's Privacy

Gulf Mitra is not intended for users under the age of 18. We do not knowingly collect personal data from minors. If we discover that a child under 18 has provided personal data, we will delete it immediately. If you believe a minor has created an account, contact us at privacy@gulfmitra.com.

11. Cookies & Tracking

We use cookies and similar technologies for authentication, security, and analytics. For complete details, please see our Cookie Policy.

12. Third-Party Links

The Platform may contain links to third-party websites or services. We are not responsible for the privacy practices of these external sites. We encourage you to read their privacy policies before providing any personal data.

13. Changes to This Policy

Gulf Mitra reserves the right to modify, update, or replace this Privacy Policy, our Terms of Service, and any other policies or guidelines at any time, at our sole discretion, without prior notice. Changes become effective immediately upon posting on the Platform.

Important Notice

Your continued use of Gulf Mitra after any changes constitutes your acceptance of the revised terms. We strongly recommend reviewing this page periodically. If you do not agree with any modifications, you must discontinue use of the Platform immediately.

14. Data Protection Officer

For privacy concerns, data requests, or complaints:

Privacy:privacy@gulfmitra.com

Support:info@gulfmitra.com