Privacy Policy

1. Who we are

DreamAuto (DreamAuto, A-1/19B, Main Rohtak Road, opposite Metro Pillar No. 256, A1 Block, Paschim Vihar, New Delhi, Delhi 110063) operates an online auction platform for insurance, bank-repossessed and salvage vehicles in India. We are the data controller (data fiduciary under India’s Digital Personal Data Protection Act, 2023) for the personal data described below.

Questions about this policy, or requests about your data: insurance@dreamauto.co.in, or use the contacts in section 12.

2. Who this policy covers

This policy applies to the website dreamauto.co.in, the DreamAuto mobile app for Android, and the emails and calls between you and our auction team. Our auctions are for registered trade buyers, not for consumers buying a personal vehicle.

3. What we collect

We collect only what the platform needs to register you, run an auction, take bids and settle the lots you win.

What we do not collect

• No precise location. The app never asks for location permission.
• No access to your contacts, photos, camera, microphone or files. The app requests none of these permissions. The vehicle photos you see in the app are ours; they are not read from your device.
• No fingerprint or face data. If you switch on fingerprint or face sign-in, that check happens entirely on your device through Android’s biometric system. We only receive the result: nothing biometric is ever sent to us or stored by us.
• No advertising or tracking identifiers. The app contains no advertising SDK, no analytics SDK and no access to your advertising ID.
• No push-notification token. This version of the app does not send push notifications.
• Nothing is uploaded from your device. There is no file, document or photo upload feature for buyers.

Information we receive automatically

Like any online service, our servers record standard technical information when your app or browser talks to us: an IP address, the time of the request, the request itself and a browser/app user-agent string. We use this to run the service, keep it secure, investigate abuse and fix faults. On sign-in, and on some bids, we also run Cloudflare Turnstile, a bot check that evaluates signals from your connection to tell humans from automated scripts.

4. How we use your information

• Create and administer your account, confirm that you may bid, and let you sign in.
• Run auctions: accept, rank and record bids, show you your status, apply the auction’s bid rules (minimum bid, increments, bid limits) and your bidding credit limit.
• Communicate with you: account and password emails, auction and lot notices, and answers to your support requests.
• Keep the platform safe: rate limiting, bot protection, fraud and multi-account detection, and audit records of bids.
• Meet legal, tax and accounting duties, and enforce our Terms of Service.
• Improve the service: understand which features are used and fix what breaks.

We do not use your personal information for advertising, we do not build advertising profiles, and we do not sell your personal information to anyone.

5. Why we are allowed to process it

Depending on the activity, we rely on:

• Performance of our contract with you — the account, the auctions, the bids and the invoices.
• Legal obligations — tax, accounting and record-keeping requirements, and responses to lawful requests.
• Our legitimate interests — keeping the platform available and secure, preventing fraudulent bidding and enforcing our rules, each balanced against your rights.
• Your consent — where we ask for it, for example optional biometric sign-in, which you can switch off in your device settings at any time. Withdrawing consent never prevents you from using password sign-in.

6. Who we share it with

We share personal data only as needed to run the service:

• Service providers that process data for us, under contract and only on our instructions: Cloudflare (content delivery, security and bot protection, and storage of the auction photo sets we publish to bidders), our hosting provider (India), our email provider (Brevo), and the real-time messaging infrastructure that delivers live bid updates to the app.
• Other participants in the same auction. Auctions are competitive and partly transparent by nature: the current highest bid amount is visible to bidders on that lot, and the display name of the current highest bidder is shown to participants in that auction. Contact details, full names, email addresses, phone numbers, credit limits and the bids of other bidders are never shown to other buyers.
• Within DreamAuto: our auction managers, support and accounts staff, on a need-to-know basis.
• Authorities and legal parties when the law requires it, when we must establish or defend legal claims, or to protect someone’s safety.
• A buyer of our business, if DreamAuto is ever merged or sold. You would be told before your data moved to a new controller.

7. Cookies, local storage and similar technologies

On the website, signing in sets WordPress login cookies so the site recognises your session, and a Cloudflare security cookie may be set when a bot challenge completes. The website loads fonts from Google Fonts. We run no advertising or third-party analytics cookies. See our Cookie Policy for the list and how to remove them.

In the mobile app we use no cookies for tracking. The app stores your sign-in token (and, if you enable biometric sign-in, a copy of it in your device’s secure keystore) plus harmless local settings on your device, so that you stay signed in between visits. That token is removed when you sign out or uninstall the app. The app also downloads its fonts from Google Fonts when it starts.

8. How we protect your information

• All traffic between the app or website and our servers is encrypted with HTTPS/TLS.
• Account passwords are stored as one-way hashes; nobody at DreamAuto can read your password.
• Sign-in tokens can be revoked, and sessions end when you sign out.
• Access to auctions, bidding data and bidding credit is limited to authorised staff, and each account is restricted to the auction regions it has been granted.
• Bot protection and rate limits reduce automated abuse of the bidding endpoints.

No service can promise absolute security. If we become aware of a breach affecting your data, we will tell you and the relevant authorities as the law requires.

9. How long we keep it

We keep account data for as long as your account is open. Bid records, winning bids, auction results and the related settlement and accounting records are kept after that (0 Days) because they are the record of a completed commercial transaction and are needed for tax, accounting, dispute and legal purposes. Technical security logs are kept only as long as needed to investigate abuse and faults. When a retention period ends we delete or irreversibly anonymise the data.

10. Your rights

Subject to applicable law, you can ask us to:

• show you the personal data we hold about you (access), and give you a copy;
• correct anything inaccurate or out of date (you can also edit most of it yourself in your profile);
• delete your account and personal data (see section 11);
• restrict or object to certain processing, and withdraw consent where we rely on it;
• complain to us, and to your data-protection authority.

Write to insurance@dreamauto.co.in and we will verify the request and respond within the period the law allows. There is no charge for a reasonable request.

11. Deleting your account and your data

You do not need the app to make the request, and you do not have to reinstall it. We delete through a reviewed, staffed process rather than an instant button: an account holds bids, winnings and obligations, so we first check that nothing is left hanging before we erase it.

Step 1 — we confirm it is you. We reply to your registered email address to verify the request.

Step 2 — we settle what is open first. If you still have obligations on the account, we will tell you exactly what needs to be cleared before deletion, and help you do it. Typically these are:

• a lot you have won but not yet paid for or collected;
• bids you have placed in an auction that is still running (we can withdraw live bids for you as part of the request);
• an invoice, refund or dispute that is still open.

This step exists to protect the auction: it stops an account being deleted to walk away from a won lot, and it protects other buyers from bids that cannot be honoured.

Step 3 — we delete and confirm. Once nothing is outstanding, we will:

• delete your account and profile details, your mobile number, your watchlist and your bidding credit record, and close your access to auction data;
• delete or anonymise your contact details from our active bidding systems;
• keep only the minimum transaction records we are legally required to retain (for example bid and tax records for the period in section 9), after which they are deleted or anonymised;
• keep a minimal record that an account in your name was deleted, so that a new account cannot be used to avoid the obligations described above. This record is kept only for that purpose and is not used for marketing;
• confirm to you in writing when it is done.

Deletion is normally completed within 30 days of step 2 being cleared, unless we must keep specific records longer by law. Data held only on your own device — your sign-in token and any biometric enrolment — is removed when you sign out or uninstall the app.

12. Contact us

Privacy questions, data requests and grievances: insurance@dreamauto.co.in

Auction and account support: insurance@dreamauto.co.in, phone +91 81307 33177 (Mon–Sat, 9:00–18:00 IST). Regional contacts are listed on our contact page.

Postal address: A-1/19B, Main Rohtak Road, opposite Metro Pillar No. 256, A1 Block, Paschim Vihar, New Delhi, Delhi 110063

13. Children

DreamAuto is a trade platform for businesses: you must be at least 18 years old and authorised to act for a registered buyer to use the app or bid on our website. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

14. Where your data is processed

Our systems run on servers located in India, and our providers (for example Cloudflare) operate worldwide, so your data may be processed outside your own state or country. Where data moves across borders we rely on our providers’ contractual safeguards and on lawful transfer mechanisms, and we require anyone processing data for us to protect it to the standard this policy describes.

15. Changes to this policy

We will update this page when our practices change, and the “Last updated” date above will always show the current version. If a change materially affects your rights, we will notify you in the app or by email before it takes effect.

16. App store disclosure

The DreamAuto Android app is distributed through Google Play. The Data safety information on our Play Store listing describes the same practices as this policy: account details, bidding activity and bidding credit are collected to provide the service; app activity and device/connection data are used for security and to run the auction; nothing is used for advertising and nothing is sold. Data is encrypted in transit, and you can request deletion as described in section 11.