Privacy Policy
Last updated: May 19, 2026
This Privacy Policy describes how Shangrila Group ("the Company", "We", "Us", or "Our") collects, uses, and discloses your information when you use the Yatroo mobile application ("Application" or "Service"), and explains your privacy rights and how the law protects you.
By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy.
Interpretation and Definitions
Interpretation
Words whose initial letters are capitalised have meanings defined under the following conditions. These definitions apply whether the terms appear in singular or plural form.
Definitions
- Account — a unique account created for you to access the Service or parts of the Service.
- Application — the Yatroo mobile application, provided by the Company.
- Company — Shangrila Group, Rudramati Marga, Kathmandu, Nepal (also referred to as "We", "Us", or "Our").
- Country — Nepal.
- Device — any device that can access the Service, such as a smartphone or tablet.
- Driver — a user who has registered and been verified to provide ride-sharing or delivery services through the Application.
- Passenger — a user who books rides or services through the Application.
- Personal Data (or "Personal Information") — any information that relates to an identified or identifiable individual.
- Service — the Yatroo Application.
- Service Provider — any third-party company or individual employed by the Company to process data on its behalf, facilitate the Service, or assist in analysing how the Service is used.
- Usage Data — data collected automatically, either generated by use of the Service or from the Service infrastructure (for example, the duration of a session).
- You — the individual accessing or using the Service.
Information We Collect
Personal Data
Depending on whether you use the Application as a Passenger or a Driver, we collect different categories of personal data.
All users:
- Full name
- Phone number
- Email address
- Profile photo
Passengers:
- Precise GPS location (real-time during ride booking and active rides)
- Pickup and drop-off addresses
- Trip history (addresses, timestamps, fare information)
- Payment transaction references
- Device identifiers (for push notifications)
- In-app chat messages between driver and passenger
Drivers (in addition to the above):
- Government-issued identity document (citizenship card or national ID) — uploaded for verification
- Selfie with identity document
- Driving licence (front and back photo)
- Vehicle information (make, model, colour, number plate, production year)
- Vehicle photos
- Vehicle registration document (bluebook — 2nd & 3rd page, 9th page)
- Emergency contact name, phone number, and relationship
- Background location (when the Application is running in the background while online for ride requests)
Usage Data
Usage Data is collected automatically when you use the Service. It may include:
- Your device's IP address
- Device type and operating system
- Unique device identifiers
- The pages or screens of the Application you visit
- Time and date of your visit, and time spent on each screen
- App crash reports and diagnostic data
Location Data
The Application collects your device's location to provide core Service features. Specifically:
- Passengers — location is collected when you open the Application to set your pickup point, and in real-time during an active ride to track progress.
- Drivers — location is collected continuously while you are online and available for rides, including when the Application is running in the background. This is necessary to dispatch ride requests and display your position to matched passengers.
Location is not collected when the Application is closed and you are not on an active ride.
We use location data to:
- Match passengers with nearby drivers
- Display real-time ride tracking
- Calculate routes and fare estimates
- Detect and resolve disputes about trip routes or completion
- Improve the accuracy and performance of the Service
Camera and Photo Library
The Application requests access to your camera and photo library to allow:
- Drivers to upload identity documents, vehicle documents, and profile photos during registration
- Users to update their profile photo
Access is requested only at the moment of upload and is not accessed continuously.
How We Use Your Information
The Company uses your Personal Data for the following purposes:
- To provide and maintain the Service — including matching drivers and passengers, processing ride requests, and monitoring Service health.
- To verify Driver accounts — identity documents and vehicle information are reviewed by our team before a Driver may go online.
- To process payments — transaction references are used to confirm and record fare payments.
- To manage your Account — to maintain your registration and give you access to the features available to your account type.
- To contact you — to send push notifications, SMS, or email about ride status updates, account activity, security alerts, and promotional communications. You may opt out of marketing communications at any time.
- To handle disputes — trip history, location data, and chat messages may be reviewed to resolve disputes between drivers and passengers.
- For safety and fraud prevention — to detect and prevent fraudulent activity, investigate complaints, and protect the safety of users.
- For analytics and service improvement — anonymised and aggregated usage data helps us understand how the Service is used and where it can be improved.
- To comply with legal obligations — where required by law, regulation, or court order.
Third-Party Services
The Application uses the following third-party services, each of which has its own Privacy Policy:
| Service | Purpose | Privacy Policy |
|---|---|---|
| Google Play Services | App distribution and device services | google.com/policies/privacy |
| Google Analytics for Firebase | Usage analytics and crash-free sessions | firebase.google.com/support/privacy |
| Firebase Crashlytics | Crash reporting and diagnostics | firebase.google.com/support/privacy |
| OneSignal | Push notifications | onesignal.com/privacy_policy |
| Baato Maps | Map display and route calculation | baato.io/privacy-policy |
We do not use Artificial Intelligence (AI) technologies to make automated decisions about you.
Sharing Your Personal Data
We may share your Personal Data in the following circumstances:
- Between drivers and passengers during a ride — a matched passenger can see the driver's name, profile photo, vehicle details, and real-time location. A matched driver can see the passenger's name and pickup location. This sharing ends when the ride is completed or cancelled.
- With Service Providers — we share data with third-party providers (listed above) who process it on our behalf under strict confidentiality obligations.
- For legal compliance — we may disclose your data when required to do so by law, a court order, subpoena, or request from a government authority.
- To protect rights and safety — we may disclose data when we believe in good faith it is necessary to protect the rights, property, or safety of the Company, our users, or the public, or to investigate fraud.
- In business transfers — if the Company is involved in a merger, acquisition, or asset sale, your Personal Data may be transferred. We will notify you before your data becomes subject to a different privacy policy.
- With your consent — for any other purpose with your explicit consent.
We do not sell your Personal Data to third parties.
Data Retention
The Company retains your Personal Data only for as long as necessary for the purposes described in this Privacy Policy. The following periods apply:
| Data Category | Retention Period |
|---|---|
| Account information (name, phone, email) | Duration of account plus up to 24 months after closure |
| Trip history (routes, timestamps, fares) | Up to 36 months for dispute resolution and legal compliance |
| Driver registration documents (ID, licence, vehicle docs) | Duration of active Driver account plus up to 36 months |
| Real-time location data | Not stored beyond the duration of an active ride session |
| In-app chat messages | Up to 12 months |
| Usage and diagnostic data | Up to 24 months |
| Payment transaction references | As required by applicable financial regulations in Nepal |
We may retain data beyond these periods where:
- We have a legal obligation to do so (e.g. tax or financial records)
- The data is necessary to establish, exercise, or defend legal claims
- You have explicitly requested retention
When retention periods expire, data is securely deleted or anonymised so it can no longer be linked to you.
Transfer of Your Personal Data
Your information is processed at the Company's operating offices in Nepal and on servers operated by our third-party Service Providers, which may be located outside Nepal. By using the Service, you consent to this transfer. The Company takes all steps reasonably necessary to ensure your data is treated securely and in accordance with this Privacy Policy.
Deleting Your Personal Data
You have the right to request deletion of the Personal Data we hold about you.
- Passengers may request account deletion by contacting us at support@yatroo.com.np.
- Drivers may request account and document deletion by contacting us at the same address. Note that certain records (trip history, transaction references) may be retained as required by law even after account deletion.
You may update or correct your profile information at any time from within the Application's account settings.
Security
The security of your Personal Data is important to us. We implement physical, electronic, and procedural safeguards to protect the information we collect and store. Driver identity documents and sensitive data are stored on secured servers with restricted access.
No method of transmission over the internet or method of electronic storage is 100% secure. While we strive to use commercially reasonable means to protect your data, we cannot guarantee absolute security. In the event of a data breach that is likely to result in risk to your rights and freedoms, we will notify affected users in accordance with applicable law.
Children's Privacy
The Service is not directed at anyone under the age of 16. We do not knowingly collect personally identifiable information from children under 16. If you are a parent or guardian and become aware that your child has provided us with Personal Data, please contact us at support@yatroo.com.np and we will take steps to remove that information from our systems.
Links to Other Websites
The Application may contain links to third-party websites or services. If you click on a third-party link, you will be directed to that site. We strongly advise you to review the Privacy Policy of every site you visit. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of any changes by posting the updated Policy on this page and updating the "Last updated" date. Where changes are material, we will provide a more prominent notice (such as a notification within the Application or by email).
You are advised to review this Privacy Policy periodically. Continued use of the Service after changes are posted constitutes your acceptance of the updated Policy.
Your Consent
By downloading and using the Application, you consent to the collection and use of your information as described in this Privacy Policy.
You may withdraw consent at any time by uninstalling the Application. To stop all data collection, use the standard uninstall process available on your mobile device or through the app marketplace.
Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or your Personal Data, please contact us:
Yatroo Support
Shangrila Group, Rudramati Marga, Kathmandu, Nepal
Email: support@yatroo.com.np
We will respond to all requests within a reasonable time, and no later than 30 days from receipt.