Last updated: 9 October 2026
NowAt (the NowAt app, NowAt Driver, NowAt Business and nowat.in) is run by Laila Group Pvt. Ltd., Kochi, Kerala, India (“NowAt”, “we”, “us”). We are the Data Fiduciary for your personal data under India’s Digital Personal Data Protection Act, 2023. This policy explains, in plain words, what we collect when you use NowAt and what we do with it.
Short version: we collect what we need to run the services you use, we show other people only what the feature needs, we never sell your data and we don’t show ads or use ad trackers.
1. What we collect
| When you… | We collect |
|---|---|
| Create an account | Your name and mobile number. Optionally: email address, date of birth, gender, city, interests and a profile photo. We send a one-time code to your mobile number to confirm it’s yours. |
| Post, comment or report | The photos/videos, text, category (e.g. pothole, event), place name and GPS location you attach; likes, comments, saves, Confirm/Dispute votes, and reports you make. Posts and reports need a photo and location. |
| Check in | A camera photo, the place name and your GPS location at that moment. |
| Message people | Your messages, group chats you create or join, who you invite, and people you block. |
| Follow, review or save | Who you follow, places/shops you save, ratings and reviews you write. |
| Order food or groceries, book a table | What you order, delivery address and its map location, phone number, notes, booking date/time and party size, offers used, and payment details you give us (payment method, UPI reference you enter). We never see or store your card, bank or UPI PIN — UPI payments happen in your own UPI app. |
| Book a ride, parcel or driver | Pickup and drop addresses and map locations, distance, fare, vehicle type, schedule, parcel description and size, and the receiver’s name and phone number you give us. |
| Book a doctor (OP) | Patient name, age, gender, phone number, the reason for the visit you type, hospital, doctor and time. See section 2. |
| Look for a job | Your CV/résumé, photo, qualification, experience, skills and cover letter, and the jobs you apply to. Your profile is only listed for employers if you choose “listed”. |
| Run a business on NowAt (shop, restaurant, hospital, employer, agent/owner) | Business name, type, address, map location, photos, opening hours, menus/products/prices, tables, doctors, job and property listings, and the UPI ID and name customers pay to. |
| Drive with NowAt | Vehicle type and number, an identity document (type, number and a photo of it), and your live location while you are on duty or on a trip. |
| Use the app at all | Your IP address (used for security and abuse limits), a label for each device you are signed in on, and the notifications we send you. We do not use advertising IDs or third-party analytics. |
2. Extra-sensitive data
- Health: when you book an OP visit, the patient’s details and visit reason go only to that hospital (and to us to run the booking). Only type what the hospital needs.
- Identity documents (drivers): seen only by NowAt admins to verify you, and by you.
- Precise location: used only for the features in section 3. We never sell or publish your movements.
3. Why we use it
- To provide the service you asked for — deliver your order, send a driver, hold your table, book your doctor, show your post, deliver your message.
- To show what’s near you — your location (while you use the app) picks the nearby feed, shops, events and map.
- To keep your account secure — one-time sign-in codes, limits on repeated attempts, and spotting fake accounts or abuse.
- To keep the community safe — reviewing reported or held posts, trust scores on reports, removing content that breaks the rules.
- To send you updates — order/booking status, replies and account notices by in-app notification, SMS/WhatsApp or email.
- To meet legal duties — tax and accounting records, and requests from authorities where the law requires it.
We use your data on the basis of your consent (which you can withdraw) and, where the law allows, for legitimate uses such as providing a service you requested or meeting legal obligations.
4. What other people can see
| Item | Who sees it |
|---|---|
| Your name, profile photo, public posts, comments, place tags and trust score | Anyone using NowAt. Posts you set to “followers” or “private” are limited accordingly. |
| Check-ins | Only you and your followers, for 1 hour. The map shows only anonymous counts of people in an area — never names. |
| Messages and group chats | Only the people in that chat. NowAt admins see group names and member counts for safety, not your messages. |
| Orders and table bookings | The shop/restaurant (and the delivery partner for delivery: name, phone, address and location). |
| Rides and parcels | Your assigned driver (pickup/drop, name, phone); you see your driver’s name, vehicle and live location during the trip. |
| OP bookings | The hospital you booked. |
| Job profile and applications | Employers you apply to; your profile is shown to other employers only if you choose “listed”. |
| Business details and listings | Anyone using NowAt (that’s the point of a listing). |
5. Who we share it with
We do not sell personal data and we don’t share it for advertising. We share only what each of these needs to work:
- Other NowAt users involved in your order, ride, booking or chat (section 4).
- Hosting and network: our web host GoDaddy stores the service on servers in Singapore; Cloudflare carries traffic to protect against attacks.
- Maps: map images come from OpenStreetMap, which receives the area of the map you view and your IP address; route distances are calculated by an OSRM routing service, which receives pickup and drop coordinates (no names). Tapping “Directions” opens Google Maps.
- Messages: sign-in codes and alerts go through our SMS/WhatsApp messaging provider; emails through our email provider.
- Fonts and icons on the website load from Google Fonts, which receives your IP address.
- Authorities when required by law, or to protect someone’s safety.
- A buyer of the business, if NowAt is ever sold or merged — under this same policy.
6. How long we keep it
| Data | Kept for |
|---|---|
| Check-in photos | Deleted automatically when the check-in ends (1 hour); the rest of the check-in record within about a day. |
| Sign-in codes | 15 minutes. |
| Security records of failed attempts (IP address) | 1 day. |
| Your account, profile, posts, messages | While your account is open. When you delete your account it is hidden at once, kept for 90 days (in case of a mistake or dispute — we can restore it if you ask), then erased for good. |
| Order, payment and booking records | As long as Indian tax and accounting laws require (with your personal details removed once your account is erased), then deleted. |
| Driver identity documents | While you have a driver account; erased together with your account (see above). |
| Backups | Kept on secure storage for up to 90 days, then deleted. |
7. App permissions
- Location (while using the app) — nearby feed and map, ride pickup, delivery address, and tagging posts/check-ins. Drivers: while on duty.
- Camera and photos — only when you choose to take or attach a photo/video, or scan a table QR code.
- We don’t access your contacts, microphone, call logs or SMS inbox.
You can turn permissions off in your phone’s settings; the features that need them will then ask again or stop working.
8. How we protect it
- Encrypted connections (HTTPS) everywhere; passwords are stored only in scrambled (hashed) form, and sign-in codes expire after 15 minutes.
- Private files — CVs and identity documents — are not publicly reachable and are shown only to the people allowed to see them.
- Limits on repeated sign-in attempts; admin accounts require 2-step verification and every admin action is logged.
- No system is perfectly secure. If a breach affects you, we will tell you and the Data Protection Board of India as the law requires.
9. Your rights
Under the Digital Personal Data Protection Act, 2023 you can:
- Get a summary of the personal data we hold about you and who we shared it with;
- Correct or update it — most of it you can change yourself in your profile;
- Delete it, including your whole account (hidden at once, erased after 90 days) — in the app: Profile → Account settings → Delete account, or without the app at nowat.in/careers/delete-account.php (we keep only what the law requires, see section 6);
- Withdraw consent at any time (this may stop features that need that data);
- Nominate someone to use these rights for you if you die or become unable to;
- Complain to our Grievance Officer (below), and if you’re not satisfied, to the Data Protection Board of India.
To use any right, contact us as in section 12. We may need to confirm it’s really you first.
10. Children
NowAt is for people aged 18 and over. We don’t knowingly collect data from children. If you believe a child has an account, tell us and we will delete it. Bookings for a child (for example an OP visit) must be made by a parent or guardian.
11. Changes to this policy
If we change this policy in a way that matters, we will tell you in the app before it takes effect. The date at the top shows the latest version.
12. Contact & Grievance Officer
Grievance Officer, Laila Group Pvt. Ltd.
Email: [email protected] · WhatsApp/phone: +91 99956 26111
Address: Kochi, Kerala, India
We acknowledge complaints within 24 hours and aim to resolve them within 15 days.