Exactly what we collect on the site and in the apps, why, who processes it for us, who else sees it, how long we keep it, and how to delete your account. No advertising, no third-party trackers, no data sold to anyone.
Last updated 10 October 2026octanedepartment.com
Octane Department® is a registered trademark in India.
Octane Department is operated by IM Integrated-Minerals LLP, Flat No. D-67, Arya Nagar Apartment, 91, I.P. Extension, Patparganj, New Delhi, Delhi 110092, India. We decide what happens to your data, which makes us the data fiduciary under India's Digital Personal Data Protection Act, 2023. This policy covers octanedepartment.com and the Octane Department apps for iPhone and Android, which run on the same servers and the same database.
We collect what the community needs to work: who you are, what you drive, what you post, who you talk to and what you bought.
There is no advertising, no third-party analytics and no tracking SDK on the site or in the apps. We count product events in our own database, under your account.
Photos of your machines are checked for a number plate on your own device, and the blur is burned into the picture before it is uploaded. We never receive the unblurred file.
Ownership documents are private. They are opened only by the people reviewing your application, through links that die after 15 minutes, and they are deleted the moment the application is decided.
Card details never reach us. Razorpay handles them on the site; Apple and Google handle them in the apps.
You can delete your account yourself, in the app or at octanedepartment.com/account/delete. It closes at once and the data is erased within 30 days.
This version is dated 10 October 2026.
02
What we collect
Everything below, and nothing else. The apps collect the same things through the same database; nothing extra is read from your phone.
Account
Your name, email address, a handle, your country and city, the country you are billed in, your profile photo if you sign in with Google, and the time you last used the site. Country and city are what you choose from a list. We do not read your location from your device or your network.
Sign-in
The eight-digit code we email you, kept until it is used or expires 15 minutes later, and the session that a correct code opens: a random token in a cookie on the site, or in your phone's secure storage in the app, valid for 30 days of use. If you sign in with Google on the site, the link between your Google account and ours. The apps sign in by code only.
Garage
Each car or bike you add: make, model, year, nickname, the country and city it is registered in, the specifications, modifications and description you type, and the photos you upload with their number plates already blurred. Also where you placed the focal point on each photo.
03
Why we collect it, and the lawful basis
Data
Purpose
Basis
Name, email, handle, city, country
Create your account, sign you in, show you the clubs and drives near you, contact you about your membership
Performance of our contract with you
Machines and photos
Build your garage, show your machines to the community, prove eligibility for model-specific clubs
04
Photos and number plates
A registration number in a public photo ties a car to a name and an address, so no photo is uploaded until its plate has been dealt with.
When you pick a photo, a small detector runs on your own device, in the browser or in the app, and draws a box where it thinks the plate is. You confirm it, move it or add one. The upload stays blocked until you have answered.
The blur is burned into the pixels on your device. Only that file is uploaded. Our servers, our storage and our logs never receive the original, so there is nothing for us to un-blur.
Nothing is sent anywhere for the detection. The model runs where the photo already is.
The last four characters of a plate are stored only when you send an ownership claim, as text, and are never shown on any page. Nobody but you and the reviewer sees them.
05
Ownership documents, handled carefully
A registration certificate is sensitive. We treat it that way.
Documents go into a private container in Microsoft Azure Blob Storage. The container is not public and has no public URL.
You upload straight to that container through a single-use link that is valid for ten minutes.
Nobody can read a document through a permanent link. When a reviewer opens one, we mint a signed link that expires 15 minutes later and is marked never to be cached.
Only the people reviewing your application or your ownership claim can request that link: for a club founded by a member, that club's founder and admins; for the clubs we run, our staff. Other members never see your documents, not even the members of the club you applied to.
06
Who else touches your data
We share data with a short list of processors, each for one job. None of them may use your data for their own purposes.
Razorpay
Payments on the site. Receives your name, email and the amount, and handles the card, UPI or netbanking details directly. Razorpay is a PCI DSS compliant Indian payment gateway with its own privacy policy.
Apple and Google
Purchases in the apps are made with Apple or Google, which are the merchant and run their own privacy policies. They tell us what is listed under purchases above. We tell them nothing about you beyond a random token that lets us match the purchase to your account.
Resend
Sends the sign-in code and every other email from us. Receives your email address and the message.
Google
Sign in with Google, on the site only, if you choose it. Google confirms your identity and returns your name, email and profile photo.
07
What other members see
Some things are visible by design. The site and the apps show exactly the same things to the same people.
Your machines
Your machines, their photos, modifications and descriptions, your posts and replies, and the clubs you are in are visible to everyone, signed in or not.
Your name
Your profile page shows your name, your city, when you joined and your machines. Beside a machine or in a club's member list, your name is shown in full to Octane+ and Black members and masked to the first letter for everyone else. Switch discovery off on your account page and your name is masked for every member, whatever their tier. Our staff can always see it. The same rule runs in the apps.
A club you apply to
The people who review that club's applications see your name, your email address, your city and country, the machine you applied with, your answers and your documents while the application is open. For a club founded by a member, that is the club's founder and its admins. For the clubs we run, it is our staff. Once the application is decided the documents are gone and the answers stay with the application.
08
How long we keep it
Account, garage, posts
For as long as your account is open.
Deleted account
The account closes the moment you ask. The data is erased within 30 days of the request. Posts and replies stay with your name replaced by a deleted member label, so threads still make sense.
Sign-in codes and sessions
A code for 15 minutes or until it is used. A session for 30 days of use, or until you sign out or delete the account.
Device tokens
Until you sign out of that phone, the phone stops accepting them, or the account is deleted. A request to delete the account removes them at once.
Ownership documents
09
Deleting your account
You can delete your account yourself, at any time, without writing to anyone.
1In the app: open the Account tab, choose Delete account, read what will be erased and type DELETE. The app asks you to enter a fresh sign-in code first, so a phone somebody else is holding cannot do this.
2On the site: sign in and open octanedepartment.com/account/delete, or go to your account page and choose Delete account. Read what will be erased and type DELETE.
We use very few cookies, and none of them follow you around the internet. The apps use no cookies at all: the session token sits in your phone's secure storage.
Session cookie. Set when you sign in, so the site knows it is you. Strictly necessary. Without it you cannot stay signed in.
Security cookies. Short-lived values used during sign-in and to protect forms against cross-site request forgery, and two that carry the country and city you picked on the sign-in form until your account is created.
Country and view. The country you chose to look at, a hint from your browser's time zone so a visitor sees their own country first, whether you answered the country question, and which Hub view you prefer. None of them identify you.
Theme preference.
11
Your rights, and how to use them
Under the DPDP Act you can ask us to:
Access. Give you a copy of the personal data we hold about you, and tell you who we shared it with.
Correct. Fix anything wrong or out of date. Most of it you can edit yourself from your account and garage pages, on the site or in the app.
Delete. Erase your account and your data, except the records we must keep by law. You can do this yourself; the section above says how.
Withdraw consent. Stop us using data you gave by consent, such as photographs, ownership documents and notifications. Withdrawing consent for ownership documents may mean leaving the private clubs that required them.
12
Children
Octane Department is for adults. You must be 18 or older to hold an account, on the site or in the apps, and we do not knowingly collect data about anyone under 18.
If you are a parent or guardian and you think a child has created an account, write to support@octanedepartment.com and we will delete it and everything attached to it.
13
How we protect it
Every page, every API call and everything the apps send runs over HTTPS with a valid TLS certificate. There is no unencrypted route into the service.
There are no passwords to steal. Sign-in is by a one-time code sent to your email, or by Google on the site. Only one code is live per address, it expires in 15 minutes, and five wrong attempts throw it away.
Data sits in a managed database in Azure Central India, encrypted at rest, reachable only by the application.
Uploaded files live in a private container and are served only through short-lived signed links.
Admin tools are limited to a small number of accounts and every review action is logged.
14
Changes to this policy
When our data practices change, this page changes first and the date at the top moves. The apps show the same text, so they change at the same moment. For a material change we email members before it takes effect.
15
Grievance officer
As required by the Information Technology Act, 2000 and the rules under it, and by the DPDP Act, here is the person responsible for complaints about your data.
When you send a machine for verification: whose name is on the registration document and their relationship to you, the last four characters of the number plate, your note, and the documents you attach. The plate characters are private. Only you and the reviewer ever see them, and they are never shown on any page.
Clubs
Which clubs you belong to, your role in them, the clubs you follow, your applications with the answers you gave and the documents you attached, and the people you invite. Inviting someone by email stores the address you typed until the invitation is used or removed.
Drives
Which drives you asked to join, the note you wrote when a drive needs approval, and invitations you received. We do not record whether you turned up.
Hub
Your threads and replies, the likes you give, the threads you save, the machines and clubs you follow, and the timestamps on all of it.
Messages
The conversations you start and the messages you send to other members or to our team, who you have blocked, and reports you make about a message. A message is visible to the person you sent it to and, if either of you reports it, to a moderator.
Reports
When you report a post, a reply, a machine, a person, a drive or a club: the reason you pick, the note you add, a copy of the content as it stood when you reported it, and who posted it. The person reported is never told who reported them.
Notifications
The notifications we show you in the app and on the site, and a log of each email we sent you: the template, the subject, the address and the time. Not the body.
Device tokens
In the apps, if you allow notifications: the push token your phone gives us, whether it is an iPhone or an Android phone, the app version, and when the token was last seen. Nothing is stored if you decline, up to ten devices are kept per account, and a token is removed when you sign out of that phone.
Payments on the site
The Razorpay order id, the payment id, the amount, the currency, the status, the date, what the payment was for, and any coupon or invitation code you used. Razorpay also sends us its record of each payment, which can carry the card network and type, the last four digits of the card, the name on it, your UPI id or the phone number you gave Razorpay. We never see a full card number or a CVV.
Purchases in the apps
What the App Store or Google Play tells us about a purchase: the transaction id, the product, the date, the storefront country, whether it was a sandbox purchase, and the amount and currency where the store includes them. Never your card, never the name or email on your Apple or Google account.
Membership
Which membership you hold and until when, your Black membership number if you have one, and whether you joined at a founding price.
Delivery address
For Black members only: full name, mobile number, address, city, state, PIN or postal code and country, given at Black onboarding for the member kit. Seen only by the staff who ship it.
Profile choices
Your Instagram handle if you add one, whether other members may find you through your machines, and your two email switches: product notices and occasional notes. All of them are yours to change at any time.
Referrals
Your referral code, how many people joined through it, and, if you entered somebody's code when you joined, whose. You see counts and the holder's name, never the other people's details.
Quote requests
When you ask an Octane Partner for a quote: the service you want, the machine, your message, a preferred date and budget if you give them, and a phone number only if you choose to be called. The business receives exactly that, with your name. It does not receive your email address.
Partner business details
If you apply for a business: the business name, legal name, GSTIN if given, contact phone and email, locations, services, photos, the answers on the application and the payment records for the plan. The contact phone and email are shown publicly only if the business chooses that.
Product events
A record in our own database when you sign up, add a machine, open a club page, apply, start or complete a checkout, RSVP to a drive, create a drive or change your country. Each carries your account id and your country, region and city, so we can see which country something happened in. Nothing about this leaves our servers.
Technical
The cookies listed below, and the standard server logs our host keeps: the IP address, the browser or app version, the page or request and the time. Your IP address is also used in memory, for a few minutes, to slow down repeated sign-in and search requests. We do not write it into our database.
Audit trail
A record of what our staff do to your account, and of the few things you do that matter later: a deletion request and its cancellation, a purchase activated in an app. Each entry names the account it was about.
We do not ask for your Aadhaar, your PAN or your bank details, and you should never send them to us. We do not read your contacts, your precise location, your photo library beyond the photos you pick, or anything else on your phone.
Your consent, given when you upload
Ownership documents, plate characters
Confirm a machine is yours before a club accepts you, and notice when two people claim the same one
Your consent, given when you apply or send the claim
Posts, likes, follows, RSVPs
Run the community features you came here for
Performance of our contract with you
Messages, blocks, reports
Let members talk to each other, and keep that safe
Contract, and our legitimate interest in a safe service
Device tokens
Deliver the notifications you switched on
Your consent, given when you allow notifications; withdraw it in your phone's settings or by signing out
Payment and purchase records
Grant your membership, support you, meet tax and accounting duties, answer a store about a refund
Contract and legal obligation
Delivery address
Send the Black member kit and any other physical Black benefit
Performance of our contract with you
Instagram handle, discovery setting
Show what you chose to show, to whom you chose
Your consent, changeable at any time
Referral code
Count the people who joined through you and give you what that earns
Performance of our contract with you
Quote requests
Pass your request to the one business you chose, and let it reply to you
Your consent, given when you send the request; withdraw it by cancelling the request
Partner business details
List the business, invoice the plan, let members ask it for quotes
Performance of our contract with the business, and legal obligation for invoices
Product events
See what is used and where, and fix what is not
Our legitimate interest in running the service
Server logs, audit trail
Keep the site secure, find abuse, fix faults, answer a complaint
Our legitimate interest in a safe service
Scroll the table sideways for every column.
We do not use your data to profile you for advertising, we do not sell it, and we do not make automated decisions that have a legal effect on you. A human reviews every club application and every ownership claim. The only automatic refusal is a short list of slurs, explicit sexual wording and direct threats that a post or message is checked against before it is stored; the text is not kept or sent anywhere when it is refused.
If you see somebody's plate or private details in a photo or a post, report it. There is a reason for exactly that, and a moderator acts on it.
We use the document to confirm ownership and for nothing else. We do not copy details out of it into a marketing list.
Documents are deleted the moment your application or claim is decided, approved or not, files and records both. There is no retention window and nothing to ask for. If a reviewer asks you for more, the documents stay only until that decision is made. Withdrawing deletes them the same way.
Expo
Delivers push notifications to the apps. Receives the device token and the title and text of each notification, and hands them to Apple's and Google's notification services. Only when you have allowed notifications.
Microsoft Azure
Hosting, database, file storage and server logs. Our servers and your data sit in the Azure Central India region. If you join from outside India, your data is stored and processed in India.
A delivery partner
Only when the Black member kit ships. Receives your name, mobile number and delivery address for that shipment, and nothing else.
We also disclose data when a law, a court or a valid order from an Indian authority requires it. We do not sell data, we do not rent it, and we do not share it with data brokers.
There is no advertising tracker, no third-party analytics and no tracking SDK on the site or in the apps. The product events described above live in our own database and go to nobody. If that ever changes, this page changes first and we tell members.
A message
Visible only to the person you sent it to, and to a moderator if either of you reports it. A thread with our team is read by our staff.
A quote request
Visible to the business you sent it to and to nobody else. Our staff see only how many requests a business has, never what is in them.
Never shown
Your email address outside the one case above, your plate characters, your documents, your delivery address, your device tokens and your payment details are never shown to other members, and no membership tier changes that.
Until the application or claim they support is decided or withdrawn, then deleted at once. Never kept afterwards.
Ownership claim record
The registrant and plate characters stay with the machine for as long as it is in your garage, so the mark it earned can be checked, and go when it goes.
Delivery address
For as long as you hold or have held Black, or until you remove it from your account page. Removed with your account.
Messages
For as long as either person's account is open. A reported message is kept until the report is closed.
Blocks and reports
For as long as your account is open. A report you made that is still open is kept, without your name, until a moderator closes it.
Notifications and the email log
For as long as your account is open. Removed with your account.
Quote requests
For as long as your account is open. Cancelling a request closes it for the business; the record stays with your account until the account is deleted, then your words are removed from it.
Partner business details
For as long as the business is listed or has an open application, then for eight years where the record is part of an invoice.
Black number
Stays with your account after the membership lapses, and is retired when the account is deleted. It is never given to somebody else.
Payment and purchase records
Eight years, because Indian tax and accounting law requires it, and this includes which coupon a payment used. When the account is deleted, these records stop naming you: the address, phone number, UPI id and card name are removed and the amounts and dates stay. This is the one set of records we cannot delete on request.
Product events
Kept as counts. When the account is deleted the events lose your account id and keep only the country.
Audit trail
Kept, because a trail that loses entries is not a trail. When the account is deleted every entry about it stops naming you.
Server logs
30 days, in Azure.
Backups
Database backups are kept for 7 days and then overwritten.
from the address on your account and we start it for you.
At once. The account closes. Every session ends, every phone is signed out, your device tokens are removed and other members can no longer find you. We email you the date and how to cancel.
The wait. For 29 days you can sign in again and cancel, from the same page in the app or on the site, or by replying to that email. The account is then as it was, including your discovery setting.
The erasure. On or after the 29th day, and within 30 days of the request, we erase your profile, your garage and its photos, your club memberships and applications, the documents you uploaded, your delivery address, your follows, likes and saved threads, your notifications and your sign-in methods. Files in storage are removed with the rows.
What stays. Your Hub posts and replies, under the label Deleted member, so the threads other members replied to still make sense. Messages you sent, in the other person's inbox under the same label; a reported message until its report is closed. Payment records for eight years, with your name, address, phone, UPI id and card name removed. Your Black number, retired so it is never given to anyone else. Once the erasure has run, none of it can be brought back.
Before it can go. Three things have to be settled first, and the page tells you which: an owner's or staff seat on our console, a club you founded that still has other members, or a business you are the only owner of. Write to us and we hand the club or the business over or close it, then the request goes through.
Money. Deleting the account does not refund an active membership, and a pass bought through the App Store or Google Play is billed by the store, so cancel it there as well. The Refunds page says what can be refunded and when.
Ask for a copy first
If you want your data before it goes, write to support@octanedepartment.com before you confirm. Once the erasure has run there is nothing left to send.
Stored in your browser so the site remembers dark or light. It never leaves your device.
There are no advertising cookies, no third-party pixels and no cross-site trackers, which is why this site does not throw a cookie banner at you.
Nominate. Name someone who can exercise these rights for you if you die or become incapable of doing so yourself.
2We confirm it is really you, usually by replying to that same address.
3We answer within 30 days. Most requests are done in a few days.
Payment credentials never reach our servers, so there is nothing there to breach.
Deleting the account from the app needs a sign-in code entered in the last 15 minutes, not just a session that may be weeks old.
No system is perfect. If a breach ever affects your data, we will tell you and the Data Protection Board as the law requires, and we will tell you what we are doing about it.
GSTIN
07AAIFI7447K1ZW
Address
Flat No. D-67, Arya Nagar Apartment, 91, I.P. Extension, Patparganj, New Delhi, Delhi 110092, India
We acknowledge a grievance within 48 hours and resolve it within 30 days. If you are not satisfied with the outcome, you may complain to the Data Protection Board of India.
