Privacy Policy

Rail Mutual is an independent platform that helps Indian Railways employees find a colleague who wants to swap postings. We are not part of Indian Railways and we don’t process transfers. This policy explains what we collect and how we use it, in line with India’s Digital Personal Data Protection Act, 2023.

• Account: your name, email address, mobile number, WhatsApp number and HRMS ID. Your password is stored only as a secure hash.
• Profile: department, post, sub post, current zone, division and lobby, pay level, service start date, transfer preferences, an optional photo and an optional “about” note.
• Sensitive details: caste category, whether you are a person with a disability, and gender. Category is used for matching and filters; disability and gender are never shown to other employees.
• Verification: a photo or PDF of your railway ID card, a copy of your HRMS ID, and the result of our checks.
• Activity: interests, saved profiles, profile views, when contact details are opened, sign-in times, IP address and device type.
• Contact with our team: records of calls we make to you and notes about them.

• To find employees whose posting and preferences fit yours, and show you as a match to them.
• To share your mobile and WhatsApp numbers with another employee only when you both agreed to connect and both paid the connection fee, and only if you allow it in Settings. We send them to that employee in the app, by email and on WhatsApp.
• To take payment for a connection. Payments are processed by Razorpay; we keep the amount, status and Razorpay reference, never your card or UPI details.
• To verify your profile so other employees can trust it.
• To send notifications about matches, interest and your account.
• To call you for help and support (see below).
• To keep the platform safe: preventing fake profiles, misuse and unauthorised access.

Our team may call your registered mobile number to welcome you, help you finish your profile, follow up when you show or receive interest, and confirm details when you ask to be verified. Staff write short notes about these calls.

You can ask us not to call you at any time — tell the person on the call. We record it and stop calling.

We use your WhatsApp number to send the code that confirms it at sign-up, password codes, account and connection updates, reminders, and occasional news from Rail Mutual. Agreeing to this is part of our Terms, which you accept when you create an account.

Codes are never stored — only a secure fingerprint of each one, which expires after 10 minutes. Reply STOP to pause reminders and news at any time, and START to turn them back on. If you write to us, our team can read and answer your message; it is never shown to other employees.

• We ask for it only to verify your profile.
• It is kept in private storage that is never publicly reachable, under a random file name.
• Only Rail Mutual staff who carry out verification can open it, and every time they do is recorded.
• It is never shown to other employees.
• We currently keep it as a permanent record of your verification. You can contact us to ask about it.

• Other employees who match you see your name, photo, job and posting — within the visibility you choose in Settings. They never see your HRMS ID, ID card, email, disability or gender.
• Our staff see what their role needs. Access is limited by role, protected with two-factor sign-in, and recorded.
• Service providers who host the platform and send our emails, only to run the service.

• Your account and profile: until you delete your account.
• After you delete your account: your personal details are removed within about 30 days.
• Railway ID cards: see “Your railway ID card” above.
• Security and audit records: up to two years.

• Edit your profile and preferences, or hide your profile, at any time.
• Choose who can see you and whether your contact details are shared, in Settings.
• Ask us not to call you, and reply STOP on WhatsApp to pause reminders and news.
• Delete your account from Settings.
• Ask to see or correct the data we hold about you, or raise a grievance with us.

Passwords are hashed, HRMS IDs are encrypted, staff accounts need a password and an authenticator code, and staff actions are logged. No system is perfectly secure, but we work to keep your information safe.

For questions, requests or complaints about your data, use the Contact page. Details of our grievance officer will be published here before launch.