Public Scanner Terms & Emergency Alert Consent

Last updated: 11 July 2026

This page governs your use of the Vtag Public Scanner Portal — the flow you go through when you scan a Vtag QR code on someone else's vehicle to send them an Alert. It supplements, and does not replace, our main Terms of Service (particularly Sections 6 and 13) and our Privacy Policy. Where this page and the Terms of Service both address the same point, this page controls for anything specific to scanning; the Terms of Service control on everything else.

You do not need a Vtag account to scan a QR code and send an Alert. By completing OTP verification and submitting an Alert, you agree to this page, whether or not you ever create an account.

1. You must be 18 or older

Sending an Alert — and especially an Emergency Alert, which requires a live selfie — requires the legal capacity to consent to identity verification and, where applicable, biometric-style image capture. By proceeding past the identity step, you confirm you are at least 18 years old.

2. Identity verification is mandatory for every Alert

Before you can send any Alert — Normal, Urgent, or Emergency — you must enter your full name and a mobile number you control, and verify that number with a one-time password (OTP) sent by SMS or WhatsApp. This is not optional and applies regardless of how minor the reason for your Alert is. You will see, and must actively accept, this exact consent statement before an OTP is sent:

"I confirm the details above are accurate and consent to VTAG verifying my mobile number via OTP for this alert."

You will also see this notice explaining how your details will be used:

"VTAG verifies your mobile number to prevent spam, fake alerts and misuse. Your name and mobile number will not be shared with the vehicle owner. They will remain accessible only to authorised VTAG administrators."

Entering a name that is not yours, or a mobile number you do not control or have not been authorised to use, is a breach of these Terms — see Section 8.

3. Trusted sessions

After a successful OTP verification, we may remember that verification on your specific device for a limited window (currently up to 24 hours) so you are not asked to re-verify if you scan another Vtag code shortly after. This is a security convenience tied to your device, not a persistent account or profile — it expires automatically, and we may revoke it earlier for any device or number we consider high-risk.

4. What we collect, by Alert type

Every Alert (Normal, Urgent, or Emergency)

• Your full name and mobile number, as entered and OTP-verified.
• A hashed device fingerprint and a hashed IP address, used only for abuse prevention — never stored or shown in a form that identifies your device or network to anyone outside authorised Vtag administrators.
• The timestamp and the QR code / vehicle scanned.
• Location, if you grant browser/device location permission — or, if you decline, an optional short landmark description you can type instead. Neither is required to submit a Normal or Urgent Alert if you choose not to provide either.

Emergency Alerts only

• A live selfie, captured at the time of the Alert (see Section 5).
• Optional incident photos, if you choose to attach them.
• Location is requested at this step the same way as above — granted GPS or a typed landmark — and we encourage providing one, but the mechanism is identical to non-Emergency Alerts.

5. Emergency Alert selfie — read this before you take it

Every Emergency Alert requires a live selfie, captured through your camera at the time of the Alert (we do not accept a photo from your gallery for this step). Before capturing it, you must actively accept this exact consent statement:

"Your selfie will be shared with the vehicle owner and their registered emergency contacts for emergency verification and safety purposes."

• Your selfie is shared only with the vehicle's Owner and the Owner's registered emergency contacts, only for that specific Alert.
• It is not shown to any other Scanner, not made public, and not used for any purpose beyond that Alert (we do not use it for marketing, profiling, or facial-recognition matching).
• It is stored in an access-restricted location, separate from publicly viewable evidence photos, accessible only via a signed, time-limited link generated for an authorised recipient.
• Submitting a selfie for a false, exaggerated, or staged Emergency Alert is a serious breach of these Terms — see Section 8 — and may expose you to criminal liability under the Bharatiya Nyaya Sanhita, 2023 or the Information Technology Act, 2000.

6. How your identity is used — and never used

Your name, mobile number, device fingerprint, and IP hash are used only to: verify you are a real person before an Alert is relayed; detect and prevent spam, duplicate, and fraudulent Alerts; and, where legally required, respond to a police or court request. They are visible only to authorised Vtag administrators through an internal, access-logged dashboard.

The vehicle's Owner never sees your name, mobile number, device information, or IP address, through any channel — not the dashboard, not WhatsApp, not SMS, not a voice call, and not email. We do not send email notifications for Scanner-submitted Alerts at all. We do not sell, rent, or use your Scanner identity for advertising, and we do not create a public or cross-Owner profile of you as a Scanner.

7. How long we keep your information

We keep Scanner information only as long as needed for the purposes in Section 6, and no longer as a matter of routine deletion, not manual best-effort:

• Normal and Urgent Alert records, including your name and mobile number, are deleted 180 days after the Alert, unless the Alert has been flagged for active administrative review.
• Emergency Alert records keep your name and mobile number for 180 days, after which they are removed from the record while the underlying Alert (location, evidence, outcome) is retained for the full 365 days set out below — again, unless the Alert is under active review, in which case it is kept until that review concludes.
• The full Emergency Alert record, including your selfie, is deleted 365 days after the Alert, except where connected to an active police investigation, court proceeding, or legal hold, in which case we retain it only as long as that matter requires.
• Your OTP itself is never stored in readable form at any point — it exists only as a short-lived cryptographic hash that is deleted the moment it is verified or expires (within 5 minutes).

Full detail on data categories, legal basis, and your rights (access, correction, deletion) is in our Privacy Policy and our Data Deletion page. Since you do not hold an account as a Scanner, you can exercise these rights by emailing grievance@getvtag.com from the mobile number you used to send the Alert, or by providing enough detail for us to locate your specific Alert record.

8. Your obligations as a Scanner

You agree that you will not:

• Provide a false name or a mobile number you do not control or are not authorised to use.
• Submit a false, exaggerated, staged, or malicious Alert of any priority — Emergency Alerts most of all.
• Use the Public Scanner Portal to harass, threaten, or repeatedly contact a specific Owner without genuine cause.
• Attempt to bypass, automate, or script the OTP verification, rate limits, or Turnstile/CAPTCHA checks.
• Attempt to identify, de-anonymise, or trace the Owner beyond what the Platform itself discloses to you.

Breach of this section may result in your phone number and/or device being permanently blocked from the Public Scanner Portal, and — for serious or repeated misuse, especially false Emergency Alerts — a report to the relevant police authority using the verified identity and Alert record we hold. See Terms of Service Sections 6, 14, and 16 for the full consequences and applicable law.

9. Automated abuse prevention

We run automated checks on every Alert submission, including duplicate-alert detection, location-consistency checks, and OTP-failure monitoring. Depending on the signals a specific submission triggers, we may require an additional CAPTCHA challenge, temporarily rate-limit a phone number or device, hold an Alert for manual administrative review before it is relayed, or block a number or device outright. We do not publish the exact thresholds these checks use, since doing so would let bad actors deliberately stay just under them — this is standard practice for any fraud-prevention system and does not change the rights described elsewhere in this page.

10. No Scanner account, no marketing use

Scanning a QR code and sending an Alert does not create a Vtag account for you, does not subscribe you to marketing communications, and does not add you to any mailing list. If you separately hold a Vtag account as an Owner, your activity as a Scanner on someone else's vehicle is not linked to your Owner account or dashboard.

11. Location accuracy

Any location we capture reflects your device's own GPS reading (or the landmark you typed) at the moment you submitted it, and can be imprecise — particularly indoors, in dense urban areas, or where location permission is restricted. We pass this information to the Owner as received; we do not verify or correct it, and we are not liable for its accuracy. See Terms of Service Section 12.

12. Liability & indemnification

Sections 23, 24, and 25 of our Terms of Service (disclaimers, limitation of liability, and indemnification) apply fully to your use of the Public Scanner Portal. In particular, you indemnify Vtag against any claim arising from a false or malicious Alert you submit, and Vtag is not liable for how an Owner responds — or fails to respond — to an Alert you send.

13. Changes to this policy

We may update this page as the Public Scanner Portal changes. Material changes — particularly anything that changes what we collect during an Emergency Alert — will be reflected in an updated "Last updated" date and, where practical, in the in-flow consent copy itself, so the language you see when you scan a code always matches what is written here.

14. Governing law & contact

This page is governed by the same law, jurisdiction, and dispute-resolution process as our Terms of Service (see Section 31 there). For anything relating to a specific Alert you sent, or to exercise a data right as a Scanner, contact grievance@getvtag.com. For anything else, see our Terms of Service Section 33.