Legal
Privacy Policy
What ValetBee collects, why, who processes it, how long we keep it, and your rights.
Last updated: 26 October 2026
See also our DPDP notice and Terms of Service.
1. Who we are and what this covers
ValetBee is provided by Valetbee Technologies Private Limited (“ValetBee”, “we”). This policy explains how we handle personal data when venues use ValetBee to run valet parking, when guests open a ValetBee ticket link or receive our WhatsApp messages, and when people visit valetbee.app.
Two roles matter under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”):
- For guest and vehicle data collected at a venue, the venue decides why the data is collected and is the Data Fiduciary. We process that data for the venue as its Data Processor.
- For our business customers’ account details, staff sign-in, billing, and visitors to our website, we are the Data Fiduciary.
2. Data about guests (people whose cars are parked)
When a venue checks in a car, its staff enter:
- the vehicle’s registration number, and optionally its make, model and colour;
- the guest’s mobile number, and optionally their name.
As the car is parked and returned, we record the ticket status and times (checked in, parked, requested, retrieved, ready, handed over), the parking space, and which staff member performed each step. We also keep a count of visits by the same number plate or mobile number at that venue.
If staff log an incident, such as damage, the record may include notes and photos. Photos can show vehicles, number plates and people. Incident photos are visible only to that venue’s staff.
At check-in, staff may photograph the car (up to four photos) to record its condition. These photos are optional, are visible only to that venue’s staff and are never shown on the guest’s ticket link. We delete them 30 days after the ticket ends, or when the venue’s data is anonymised. Photos can show number plates and people nearby.
Staff can also scan a number plate with the phone’s camera. The picture is read on the phone to fill in the number, is not uploaded or stored by us, and is deleted from the phone straight away. Staff confirm the number before the ticket is created.
We send the guest WhatsApp messages about their car, each containing a private ticket link. The first message links to this policy. We record which message was sent to which number, when, and the delivery status reported by WhatsApp; we do not keep the message text. Anyone who has the link can see that one ticket’s status, so guests should not share it.
The guest ticket page links to this policy and does not use analytics or advertising cookies.
3. Data about venue staff and customers
- Name, mobile number and, optionally, email address.
- The business and locations they belong to, their role and membership status.
- Sign-in records: one-time codes (stored only as a one-way hash and expiring shortly after issue) and session records (stored as one-way hashes, with when they expire or were signed out).
- Work activity: shift start and end, availability (available, busy, on break, offline), and the steps they take on tickets.
- For the business: name, contact details, plan, subscription and payment records. Card and bank details are handled by Razorpay; we do not store them.
4. Data about website visitors
On our marketing pages we use Google Analytics to understand how the site is used, but only if you allow it: it does not load, and sets no cookies, until you choose “Allow analytics”. You can withdraw that choice at any time from “Cookie settings” at the bottom of any page, which also clears its cookies. It never runs on guest ticket pages, the sign-up and sign-in pages or the manager console. We send it a page address with query strings removed, and we do not enable Google signals or advertising features.
Our website host, Vercel, receives every visitor’s IP address and the address of the page requested, as any web host does.
Signed-in staff sessions in the web console are kept in your browser’s local storage, not in a cookie, so the console works.
5. Why we use personal data
- To run the valet service for the venue: issue tickets, message guests, dispatch drivers, and return cars.
- To keep a record of who did what, so the venue can resolve questions and disputes.
- To sign people in securely and prevent misuse, including limiting how often one-time codes can be requested.
- To bill customers and keep accounts and tax records.
- To support customers and improve the product, using aggregated or de-identified information where we can.
We do not sell personal data, and we do not use guest data for advertising or to message guests about anything other than their vehicle.
6. Who processes data for us
We use these service providers, only for the purposes above:
- Google Cloud: hosting of our servers, database and stored files, in the Mumbai region (asia-south1), India.
- Meta Platforms (WhatsApp Business Platform): delivering WhatsApp messages to guests. Meta may process message data outside India.
- Razorpay: processing subscription payments from our business customers.
- Google Analytics: website analytics on marketing pages only, and only for visitors who allow it. Google may process this data outside India.
- Vercel: hosting of our website, including guest ticket pages. Vercel receives visitors’ IP addresses and the pages they request, which for a guest ticket page includes the ticket link. Vercel may process this data outside India.
If we add a provider that receives personal data (for example an SMS provider for sign-in codes), we will add it here before it receives any data.
We may also disclose data where required by law, or to protect the rights, property or safety of people or the Service.
7. How long we keep data
- Guests: a guest’s mobile number, name and email are erased 12 months after their last visit to the venue, and a car’s number plate and description 12 months after it was last checked in, even while the venue’s account stays open. Ticket links stop working at the same time, and our records of messages sent lose the mobile number. Visit counts and ticket times are kept without anything that identifies the guest, so the venue’s reports still add up.
- Check-in photos of a car are deleted 30 days after its ticket ends.
- Incident notes and photos are deleted 12 months after the incident is resolved or closed, or 24 months after it was reported if it is never resolved.
- Messages waiting to be sent (which copy the number plate and driver’s name) are deleted 30 days after they are delivered.
- Staff and customers: until the account is deleted or the venue is closed (see below).
A venue can ask us to delete specific records sooner, and we will help it answer a guest’s erasure request.
When an account is closed, we delete or anonymise its data within 90 days, after any export the customer asked for. Billing and tax records are kept for as long as Indian tax law requires.
Deleted data can remain in our encrypted backups for up to 14 days before the backups roll over. We do not restore it into live use.
One-time sign-in codes expire within minutes and are deleted after a day. Website analytics data is kept according to the retention setting in Google Analytics.
8. Security
We use encrypted connections (HTTPS), role-based access for staff, hashed one-time codes, and server-side session revocation on sign-out. Guest ticket links use long random tokens.
No system is perfectly secure. If we become aware of a personal data breach affecting you, we will notify the affected venues without delay so they can meet their own duties, and, where the DPDP Act requires, the Data Protection Board and affected individuals. Please report suspected security issues to privacy@valetbee.app.
9. Your rights
Under the DPDP Act you may ask to access a summary of your personal data, correct or update it, have it erased, or nominate someone to exercise your rights, subject to lawful exceptions. You can also raise a grievance.
Guests: because the venue is the Data Fiduciary for your visit, please contact the venue first. You can also write to privacy@valetbee.app with your mobile number and the venue name, and we will pass the request to the venue and help it respond.
Staff and customers: write to privacy@valetbee.app.
We acknowledge every request and grievance within 7 days and resolve it within 30 days. If we need longer, we will tell you why and when to expect an answer.
If you are not satisfied with our response, you may complain to the Data Protection Board of India.
10. Children
ValetBee is a business tool and is not directed at children. Venue staff accounts are for adults.
11. Changes to this policy
We will update this policy when our practices change and show the date of the latest change at the top. For material changes we will notify customers by email.
12. Contact and grievances
Grievance Officer: Hriday Vanka, Valetbee Technologies Private Limited.
Email: privacy@valetbee.app (privacy questions, rights requests and grievances).
Post: Grievance Officer, Valetbee Technologies Private Limited, [TO BE CONFIRMED].
Response time: acknowledged within 7 days, resolved within 30 days.