Privacy Policy

1. Data Controller

2. Territorial Scope & Applicable Law

3. Types of Data Collected

• Your school email address (.edu, or another student address we accept, such as @mymdc.net). You confirm it with a 6-digit code we email to you.
• First and last name.
• Phone number.
• Date of birth, to confirm you are 18 or older. It is kept in a private record that only you can read in the app; your profile only records that you are 18 or older. (Accounts created before we asked for a date of birth confirm "I am 18 or older" with a checkbox instead.)
• Your password. It is handled by Firebase Authentication; we never see it in plain text.
• A profile photo (required).
• Your university, which the app works out from your email domain and shows as a badge.
• Optional profile details, if you choose to add them: a short bio (up to 300 characters), your major, your year of study, and travel preferences (music, chatting, smoking, and pets). They appear on your profile (see Section 6).
• Your gender, only once Women+ rides are available (see Section 3.13).

• Driver's license: a photo of the front (required) and of the back (optional), the name as it appears on the license, the license number, and the expiry date. A member of our team reviews it. When the AI check is on, an AI model reads the photo first, and a license that passes every check is approved automatically (Section 3.17).
• Vehicle: make, model, year, color, number of seats, license plate, a photo of your insurance card, and the insurance expiry date. We use the date to stop you publishing a trip when your insurance has expired. We do not check your insurance with your insurer. An AI model may read the insurance photo too (Section 3.17).
• Payouts: to receive money, drivers set up a Stripe Connect account. To save you typing, when you start that setup we send Stripe your name, email address, phone number, and date of birth (when we have them), so they are already filled in. The setup screens are Stripe's, shown inside the RideMate app or, if they cannot be shown there, in your phone's browser. Stripe collects the rest of what it needs directly from you (for example your home address, your bank account or debit card, the last 4 digits or, if Stripe asks, the full number of your Social Security number, and, if Stripe asks to verify your identity, a photo of a government ID and a selfie). This includes using your camera if you allow it. Stripe collects and keeps this information under Stripe's own privacy policy (stripe.com/privacy) for its own legal and fraud-prevention duties. RideMate does not see or store it. We still receive only your Stripe account ID and its status (whether payouts are enabled and what information Stripe still needs from you).

• Trips you publish: pickup and drop-off addresses and map coordinates, cities, date and time, number of seats, price per seat, trip distance and duration, the vehicle used, the trip's status, and, if you cancel, the date and reason. If you choose to add them: trip options (luggage size, whether pets are OK, and "max 2 in the back") and a short note for riders (up to 120 characters). Our server checks the note and refuses it if it contains phone numbers, links, email addresses, social or payment handles, or the names of payment or messaging apps.
• Bookings: which trips you booked, how many seats, and any cancellation. If you book seats for companions, we record only the number of seats. We do not collect companions' names or other details.
• Booking requests: on trips that need the driver's approval, your request to join (the number of seats and the pickup you ask for: the driver's own, or another address with its map coordinates and an exact time or a time window), any question you add for the driver, the driver's answer or counter-suggestion, and the request's status. The request message is written by the app from these details. Our server checks your question and a pickup address you type with the same rules as the driver's note above.
• Ride requests and "Notify me" searches you post when no trip matches, or when you ask to hear about new trips on a route: from and to, the time window, seats, and an optional note. Until you book a matching trip or the request's last day passes, we tell you about new matching trips by push and by email, at most once a day per request, and we record when we last alerted you. Every alert email has a link that stops alerts for that request.

• Reports you file or that are filed about you, from "Report or block", from "Report to RideMate" on a trip, or from the boarding check (below). We store who reported whom, the reason (for example unsafe driving or harassment), any details written (up to 2,000 characters), the trip, where the report came from, and the reporter's IP address and device "user agent" string as our server sees them. When a driver reports a rider on their trip, we also copy into the report the question that rider asked the driver in their booking request. Each new report is emailed to our team's mailbox (see Section 6).
• Blocks: who blocked whom.
• Cancellation-policy records (see the Cancellation & Refund Policy): a rider's late cancellations in the current semester and whether later bookings in that semester are non-refundable; a driver's strikes and any 30-day publishing pause; "didn't show up" marks, disputes, driver no-show reports, and how they were decided; whether you used the 15-minute "booked by mistake" window on a trip; and, when a rider wins a dispute after the driver was already paid, the amount the driver owes back, which is deducted from their future payouts.
• Reliability history: for each trip you were on in the last 12 months, whether it was completed and whether it counted as a cancellation. For a driver, a cancellation is a strike (cancelling a trip with a paid booking, removing a paid rider, or a confirmed driver no-show). For a rider, it is a late cancellation or a confirmed no-show. Courtesy and early cancellations never count, and a strike our team removes is taken back. We use this history to work out the reliability label on your profile ("Rarely cancels", "Sometimes cancels", or "Often cancels"). The label appears only after 3 trips in 12 months. Other members see only the label, never the numbers. Entries older than 12 months are deleted.
• Boarding check: when the driver taps Start Ride, the app asks the driver to tick which riders got in. Each rider can then answer "I'm In" or "Not in This Car". We record the driver's ticks, each rider's answers, and their times. The driver and the rider can see the driver's tick. Only the rider (and our team) can see the rider's answer. "Not in This Car" also files a safety report to our team. This record is evidence only. An unticked rider is not marked as a no-show, and nothing here changes a payment.

• A push-notification token for each device you sign in on.
• Crash reports from Firebase Crashlytics (in released versions of the app): what went wrong in the code, device model, operating system and app version, and an installation identifier created by Crashlytics. We do not add your name, email address, or account ID to crash reports, although an error message can occasionally contain an internal record ID.
• Performance data from Firebase Performance Monitoring: for example how long the app takes to start and screens take to load, and timings of network requests, with device model, operating system, app version, and approximate country.
• Server logs: when your app talks to our servers, Google's infrastructure logs technical details such as your IP address and the time of the request.

• Where it is kept. In a record that only our server can read. It is not on your profile, other members can't see it, and the app itself never receives it back (the app only learns whether you can use Women+ rides).
• What others can work out. Your answer is never shown. But a member who sees that you offer or booked a Women+ ride can infer that you said you are a woman or non-binary.
• Changes. You can change your answer. Changing to an answer that gives Women+ access is allowed once every 30 days. We keep a history of your earlier answers and when you gave them (up to 50), so our safety team can review a "Misrepresented gender" report.
• Reports. When someone reports you for "Misrepresented gender", we copy your current answer and its history into that report.
• How long. Until your account is permanently deleted (Section 9). A copy inside a report is kept with the report.

• Share a ride (drivers). A driver can share a link (go.ridemate.ai/r/…) to a trip that can still be booked. The page shows: the cities, the date, the departure and arrival times, the trip's duration, the seats left, the price per seat, and the driver's first name, the initial of their last name, and their university's logo. The page stops showing the trip once it is full, canceled, or has departed. If the link is opened in the RIDEMATE app, a signed-in member sees the trip in the app as usual.
• Share my trip (the driver or a booked rider). The driver or a booked rider can share a link (go.ridemate.ai/t/…) to their upcoming or current trip. The page shows: the cities, the date, when the trip leaves and is expected to arrive, its status (booked, started, arrived, or canceled), the driver's first name, the initial of their last name, and their university's logo, and the car's color, make, model, and license plate. When a rider shares, the page shows the driver's details, not the rider's. The page refreshes about once a minute. It works until 1 hour after the trip ends, and never more than 48 hours after departure. The person who shared it can stop it at any time in the app.
• What these pages never show. Addresses, a map or live location, phone numbers, email addresses, photos, or the riders on the trip.
• Who can see them. Anyone who has the link, including anyone it is forwarded to. When you paste a ride link into a messaging app, the app's preview may show the route, the day, the seats, and the price. A trip link's preview shows only "Follow my RideMate trip". We ask search engines not to index these pages.
• What we store. For each link: who made it, the trip, the person's role (driver or rider), and when. Link records are deleted automatically, about 30 days after departure for a ride link and about 3 days after departure for a trip link.
• Visitors. The pages set no cookies and use no analytics or advertising trackers. They load fonts from Google Fonts, which receives the visitor's IP address. To stop abuse, we keep a scrambled form of the visitor's IP address combined with the link (a keyed hash that can't be turned back into the address) for about a day. Our servers also log the request (Section 3.11).
• Women+ rides. While Women+ rides are available, they cannot be shared by ride link.
• Text my contacts and Invite a Friend. "Text my contacts" (in Help on a trip) opens your phone's own message app with a ready-made message. The message includes the route (with the destination address), the driver's first name and last initial, the car, the license plate, and the pickup place and time, and, when available, your trip link. "Invite a Friend" opens your phone's share sheet with a fixed message and a link to download the app. In both cases you choose who gets the message. RIDEMATE does not read your contacts and does not learn who you sent it to.

• Write to Us. When you write to us from the app (Profile > Help, or a trip's page), we store and email to our team: the topic you pick, your message (up to 1,000 characters), your name, your account ID, the email address you verified with us (so we can reply), the app version and platform, and, if you write from a trip's page and you were on that trip, the trip.
• Help on this ride. From a booked or current trip's page, riders and drivers can open Help. It offers Call 911 (Section 3.12), a card with trip details to read to a 911 dispatcher, Text my contacts (Section 3.14), and Report to RideMate (Section 3.7). The trip details card shows the driver, the car, the license plate, the route, and the pickup. For a rider, it shows the driver's full name from 2 hours before departure until the trip ends; at other times it shows their first name and last initial.

• What is sent. The photo itself (the front of the license, or the insurance card or declarations page), read twice, with a fixed instruction to copy the printed text. The photo shows everything printed on the document, including your address, date of birth, and the picture on the license. We do not send your account name, email address, or date of birth, and the model is told not to return the date of birth, address, policy number, or vehicle details. The student ID is not sent.
• What the model does. It only reads: document type, the name, license number, and dates printed on it, the insurer and the people named on the policy, and any problem it sees with the photo (for example glare or an edited look). It does not compare faces and does not match your face to any other photo. Our code then checks that the two readings agree and compares them with your account: the name verified with your student ID (your student ID must already be approved), the license number and expiry date you typed, and the expiry date against today. If every check passes, the document is approved automatically. In every other case it goes to our team, which decides as it does today. The AI never rejects a document.
• Re-checks and undo. During the first month after we switch this check on, our team re-checks every automatic approval. After that, it may re-check only a sample of them, always including documents that expire within 60 days. Our team can undo an automatic approval; the document then goes back to our team for review.
• Asking for a person. You can ask for a person to review your document at any time: write to us from the app (Section 3.15) or at contact@ridemate.ai.
• What we keep. A record in our database for each check (the document type, the result, the reasons in codes, the photo's location and fingerprint, times, and our team's decision, re-check, or undo), which is deleted with your account and, if not deleted earlier, after 12 months. Until a person has decided or re-checked the document, this record also holds the reading with the names and license number; it is deleted once a person has done so, and it is not kept at all for an automatic approval that is not picked for a re-check. The AI run log is described in Section 3.18. The photos themselves are kept as before (Section 9).
• Fraud check. The AI run log holds a keyed fingerprint (HMAC hash) of the license number and of names. It lets our team see that the same license number was used on two accounts.

• Summaries of reports and disputes: the report or dispute record it was made for and the admin account that asked for it; for each item sent and each point of the summary, only a fingerprint (hash), where it came from, and the labels of the items it cites; and how many points were shown or hidden, with the reason each hidden point was hidden. No summary text is kept, and the text sent to the AI is not copied.
• Marketing drafts: the admin's brief (goal, date or season, tone), the audience name, the draft, the admin account that asked for it, and whether the draft was used. If the AI's answer was refused by our checks, the answer is kept too. The brief should hold no personal data and the admin form says so; a brief with an email address, phone number, plate, ID number, or street address is refused. A name typed in a brief cannot be detected and would be kept here.
• License and insurance reading: the raw account ID (the user ID of the driver, not hashed), a reduced copy of the reading (document type, issuing state, class, dates, insurer, readability, photo problems), a fingerprint of the photo (not the photo), the result of the check and its reasons in codes, and, in place of names and the license number, only their initials and the last 4 digits of the license number, plus keyed fingerprints (HMAC hashes) of the names and the number. The account ID stays in the record for the full 12 months, also after you delete your account, so the record can still be tied to you while it exists. The hashes let two readings or two accounts be compared; they are not anonymous, since whoever has our secret key can test a guess.
• How long. 12 months, then deleted automatically. These records are kept even after you delete your account (they hold no photos), to handle disputes and complaints and to check the AI's accuracy. See Section 9.

• which sign-up step you reached and which you finished, and whether you sent your documents or chose to do it later;
• that you ran a search, how many rides it listed (as a range, such as "2 to 5"), the kind of date you picked (for example "this weekend"), and the number of seats; only when a search finds no rides, also the city and state of the start and of the destination, never the address or the exact point;
• that you opened a push notification, whether it was a promotional one, and which screen it opened.

• track your location during a trip or keep a location history;
• show a live map or live location on share links;
• read your phone's contacts;
• use Google Analytics, any advertising or attribution SDK, or advertising identifiers (the only analytics tool is Amplitude, when available, as described in Section 3.20);
• run criminal background checks or check driving records;
• verify insurance coverage with insurers (we only keep the photo and expiry date you give us).

4. Purpose of Processing

• create and run your account, and confirm you are 18 or older and a student with a school email address;
• review student IDs (by a person, not automatically) and driver's licenses and insurance photos (by a person; when the AI check is on, an AI model reads them first and the document is approved automatically only when every check passes, including the name verified with your student ID and the dates; otherwise a person reviews it, and our team re-checks automatic approvals and can undo them);
• let drivers publish trips and riders find, book, pay for, and cancel seats, and post ride requests;
• work out trip distance and the maximum price per seat allowed by our cost formula (using Google Routes), and let you search for addresses (using Google Places);
• show a map of the pickup point (using Google Maps);
• confirm a driver is near the pickup and drop-off points when starting and finishing a trip, and keep a record of how far from the pickup each trip was started, for payouts and disputes;
• let drivers and riders on the same trip chat with each other;
• let you share a ride or trip link, and invite friends;
• take payments, issue refunds, and pay drivers, through Stripe, and show you receipts;
• apply the Cancellation & Refund Policy: refunds, late cancellations, strikes, no-shows, disputes, and deductions from a driver's future payouts;
• manage ratings and reviews, and show them, driving ratings, and reliability labels on profiles;
• handle reports, blocks, boarding checks, and requests for help on a trip, prevent fraud and misuse, including checking whether one person has opened more than one account (Section 6), and keep users safe;
• keep a record of what you agreed to and when;
• send push notifications and account emails, and, unless you unsubscribe, marketing emails; and, only if you turn on "News and ride offers", promotional push notifications;
• find and fix crashes and performance problems;
• see how the app is used, to improve it (where sign-up gets stuck, which searches find no rides, and whether notifications are opened), when available (Section 3.20);
• provide customer support, including answering messages you send from the app;
• run Women+ rides, when available;
• apply sponsor-paid promo codes, when available;
• help our team read a report or dispute faster with an AI summary, draft marketing emails with AI, and read driver's license and insurance photos, when available (Sections 3.17 and 6);
• keep a log of AI use, when available, to handle disputes and complaints and to check the AI's accuracy (Section 3.18);
• keep a log of our team's actions on accounts, documents, refunds, and trips, to be accountable and resolve disputes (Section 3.19); and
• meet legal, tax, and accounting obligations.

5. Legal Bases for Processing (GDPR Art. 6)

• Performance of a contract: to provide the service (account, checks required to use it, trips, bookings, payments, receipts, refunds, payouts, chat, share links you choose to create, support messages, account emails, and, when available, promo codes).
• Legal obligation: tax, accounting, and payment record keeping, and responding to lawful requests.
• Consent: the location permission on your phone (drivers), push notifications, and promotional push notifications ("News and ride offers"). You can withdraw the first two at any time in your phone's settings. In the app, under Profile > Notifications, you can also turn off each optional push category, including News and ride offers; notifications about bookings and trip changes always stay on.
• Explicit consent (GDPR Art. 9(2)(a), where it applies): your gender answer for Women+ rides. You can withdraw it by changing your answer to "Prefer not to say" (see Section 3.13 for the history we keep) or by deleting your account.
• Legitimate interests: safety (reports, blocks, boarding checks, help on a trip, cancellation-policy records, reviewing documents), preventing fraud and misuse, keeping evidence of what users agreed to, managing ratings, reviews, driving ratings, reliability labels, and disputes, recording how far from the pickup a trip was started (to time payouts and settle no-show disputes), showing the driver's details on a trip link a booked rider shares (so the rider's friends and family know which car they are in), fixing crashes and performance problems, measuring how the app is used (Section 3.20, when available; you can turn it off in the app), measuring whether promotional pushes are opened, sending marketing emails about RIDEMATE to existing users, with a one-click opt-out in every email, and, when available, AI summaries that help our team review cases (a person always decides), AI reading of license and insurance photos (our team decides everything the code does not approve, and re-checks and can undo automatic approvals), the AI run log (Section 3.18), and the admin action log (Section 3.19).

6. Data Processing, Access and Security

7. Storage and International Transfers

8. Third-Party Service Providers

• Google Cloud / Firebase (Google LLC). Database, file storage, and servers, including the share link pages on go.ridemate.ai; sign-in (Firebase Authentication); push notifications (Firebase Cloud Messaging); crash reports (Crashlytics); performance data (Performance Monitoring). Location: United States (address-search relay in Belgium).
• Google Maps Platform (Google LLC). Address search (Places), trip distance and duration (Routes), and the map picture of the pickup point (Maps Static API). Google receives what you type in the address field, the coordinates of the pickup and drop-off points, and your device's IP address. It does not receive your GPS location. Location: United States.
• Google Fonts (Google LLC). The app, our websites, and the share link pages load fonts from Google's servers, which receive your IP address. Location: United States.
• Apple Inc. Delivers push notifications to iPhones (Apple Push Notification service), and distributes the app through the App Store. Location: United States.
• Stripe, Inc. Card payments (including Apple Pay, Google Pay, and Link, where available), saved cards, refunds, fraud prevention, and driver payouts (Stripe Connect). For riders, we send Stripe your name, email address, and phone number to fill in the payment screen, and Stripe tells us the card brand and last 4 digits for your receipt. If you pay with Apple Pay or Google Pay, Apple or Google also handles the payment under its own privacy policy. For drivers' Connect accounts, we send Stripe the driver's name, email address, phone number, and date of birth (when we have them) to prefill the setup; Stripe collects bank, address, and identity details directly, inside the RideMate app or in the browser, and acts under its own privacy policy. Location: United States.
• Resend, Inc. Delivery of account and marketing emails, and of the emails that bring reports and support messages to our team. Location: United States.
• Microsoft 365 (Microsoft Corporation). Hosts our team's mailbox (contact@ridemate.ai), which receives reports and support messages. Location: United States.
• Anthropic, PBC. AI model (Claude Sonnet) used, when available, as our service provider (processor), for the AI summaries (redacted text), the license and insurance photo reading (the photos), and marketing drafts (the admin's brief, no user data), as described in Sections 3.17 and 6. Location: United States.
• Amplitude, Inc. App usage analytics, when available, as our service provider (processor). It receives the usage events, the hashed account identifier, whether you are a rider or a driver, your school's short name, the random app identifier, and the basic device details described in Section 3.20. Location: United States.
• Webflow, Inc. Hosts our website ridemate.ai, served through Cloudflare. Location: United States.

9. Data Retention

• Profile, email address, phone number, date of birth, profile photo, push tokens, notification settings, and in-app notifications: until you delete your account.
• Student ID photo, driver's license photos and details, vehicle details, and insurance photo: until you delete or replace them in the app, or delete your account.
• Location: your GPS position is not stored. The Start Ride check (Section 3.12) is kept on the trip record for as long as the trip exists.
• Trips you publish, bookings, and ratings: kept on the trip record for as long as the trip exists. A driver's trips are deleted when the driver's account is deleted.
• Reviews: kept in our records. Your three most recent reviews show on your profile until you delete your account.
• Chat messages: kept with the trip they belong to, and deleted when that trip is deleted.
• Ride requests: marked as expired after their last requested day, and deleted when you delete your account.
• Reliability history: each trip counts for 12 months, then its entry is deleted.
• Share link records: deleted automatically about 30 days after departure (ride links) or about 3 days after departure (trip links). The scrambled visitor addresses are deleted after about a day.
• Gender answer and its history: until you delete your account.
• AI document check records (Section 3.17): 12 months, or until you delete your account if earlier.

• Payment, refund, and payout records (including the name and email address attached to them, and the card brand and last 4 digits): kept for tax, accounting, and dispute purposes. Stripe also keeps its own records under its own policy, including the customer record and any card you saved (you can remove a saved card in the payment screen).
• Consent records: kept as evidence of what was agreed and when.
• Safety reports, including reports from the boarding check, and boarding-check records: kept for safety purposes. This includes any copy of a gender answer and its history in a "Misrepresented gender" report.
• Cancellation-policy records (late cancellations, strikes, no-show reports, disputes, and amounts a driver owes back): kept to apply the policy and resolve disputes.
• Support messages you sent us, and our email exchanges with you: kept as a record of the request.
• Lists of the addresses each marketing email was sent to, and, for promotional pushes, who each one was sent to and who opened it: kept as a record of what was sent.
• Promo code uses and sponsor payment records: kept for accounting.
• AI run log (Section 3.18): kept 12 months from the AI call, then deleted automatically, including after you delete your account. It holds no photos and no summary text. For license and insurance readings it holds your account ID and only initials, the last 4 digits of the license number, and keyed fingerprints.
• Admin action log (Section 3.19): 2 years. An entry about your account stays for that time after you delete your account.
• Messages you sent and ratings you gave on other drivers' trips: they stay on those trips, linked to your deleted account (the chat's member list keeps the name and photo you had), until those trips are deleted.
• Reviews you wrote and reviews written about you: kept in our records. A review you wrote can still appear on the other person's profile, with your first name.
• App usage events (Section 3.20), when available: kept by Amplitude until the end of their retention period (below). They carry only the hashed identifier, so they are not deleted with your account; you can ask us to have them deleted (Section 11).
• A short record that your account was deleted and when, with no other personal data.

10. User Communications

11. User Rights (EU/EEA)

• access their data;
• request rectification or erasure (you can also delete your account yourself in the app, under Profile > Delete account);
• restrict or object to processing, including objecting to marketing emails at any time and turning off app usage analytics in the app (Profile > Share app usage);
• withdraw consent (for location and push notifications, in your phone's settings; for each optional push category, including promotional pushes, in the app under Profile > Notifications, where notifications about bookings and trip changes always stay on; for your gender answer, as described in Section 5); and
• receive their data in a portable format.

11A. Region-Specific Disclosures — U.S. State Privacy Laws (If and When Applicable)

12. Cookies and Tracking

13. Age (18+)

14. Changes to this Policy

Summary

• Account and profile (name, school email, phone, date of birth, photo, and the optional bio, major, year of study, and travel preferences on your profile). Purpose: running your account, the 18+ check, and your profile. Basis: contract. Kept until you delete your account.
• Student ID and driver's license (photos and license details). Purpose: review by our team and, for driver's licenses when the AI check is on, the automatic check (see below). Basis: contract and legitimate interest (safety). Kept until you delete or replace them, or delete your account.
• Vehicle and insurance (make, model, color, plate, insurance photo and expiry). Purpose: trip listings and the insurance-date check. Basis: contract. Kept until you remove the vehicle or delete your account.
• Location (drivers only, at Start Ride and Finish Ride). Purpose: confirm the driver is near pickup and drop-off, and keep a record of how far from the pickup the trip was started, for payouts and disputes. Basis: consent (phone permission) for the check; legitimate interest for the record. Your GPS position is never sent to us or stored; the Start Ride record is kept with the trip.
• Pickup map. Purpose: show where the pickup is. Basis: contract. Google receives the pickup point's coordinates; nothing new is stored by us.
• Trips, bookings, ride requests (including trip options, the driver's note, and your question to the driver). Purpose: the service. Basis: contract. Kept while the trip exists; a driver's trips are deleted with their account.
• Chat. Purpose: coordinating the trip, moderation, and disputes. Basis: contract and legitimate interest. Kept with the trip.
• Ratings and reviews (1–5 stars, an optional comment and tags, and an optional driving rating; riders and drivers review each other). Purpose: the rating system and helping members choose who to travel with. Basis: legitimate interest. Kept in our records, also after account deletion; your three most recent reviews and, for drivers, the driving rating show on your profile.
• Reliability label (from a 12-month history of trips and counted cancellations). Purpose: helping members choose who to travel with. Basis: legitimate interest. Only the label is shown; the history is deleted with your account, and each entry after 12 months.
• Reports, blocks, boarding checks, cancellation-policy records (reports include the reporter's IP address and device string). Purpose: safety and applying the Cancellation & Refund Policy. Basis: legitimate interest and contract. Blocks are deleted with your account; the rest is kept after it.
• Share links. Purpose: letting you share a ride or a trip. Basis: contract (for the person sharing) and legitimate interest (for the driver whose details appear on a trip link). What the page shows is in Section 3.14. Link records are deleted automatically within days to weeks after departure.
• Support messages. Purpose: answering you. Basis: contract. Kept after account deletion as a record of the request.
• Payments, refunds, payouts (including the card brand and last 4 digits). Purpose: billing, receipts, payouts, and accounting. Basis: contract and legal obligation. Kept after account deletion.
• Consent records (including IP address and app version). Purpose: evidence of what you agreed to. Basis: legitimate interest. Kept after account deletion.
• Emails and promotional pushes. Purpose: account emails and, unless you unsubscribe, marketing emails; promotional pushes only if you turn them on. Basis: contract, legitimate interest, and consent (promotional pushes). Opt-outs and consent recorded; recipient lists and push opens kept.
• Crash, performance, and device data. Purpose: fixing problems. Basis: legitimate interest. Kept by Google for a limited period.
• App usage analytics (when available; sign-up steps, searches, push opens, a hashed account identifier, rider or driver, school, basic device details). Purpose: seeing how the app is used, to improve it. Basis: legitimate interest; you can turn it off in the app. Kept by Amplitude for 12 months.
• Gender (Women+ rides, when available). Purpose: deciding who can see, book, and offer Women+ rides, and reviewing "Misrepresented gender" reports. Basis: explicit consent. Not shown to anyone. Kept until you delete your account; a copy in a report is kept with the report.
• Promo codes (when available). Purpose: applying sponsor-paid discounts. Basis: contract. Sponsors don't learn who used a code. Kept for accounting.
• AI summaries for our team (when available; redacted report, dispute, and chat text sent to Anthropic). Purpose: helping our team review a case; a person decides. Basis: legitimate interest. Neither the text sent nor the summary is stored; the AI run log keeps only technical records, without text.
• AI reading of license and insurance photos (when available; photos sent to Anthropic). Purpose: faster document review; our team decides everything not approved by the checks, and re-checks and can undo automatic approvals. Basis: contract and legitimate interest. Records deleted with your account or after 12 months.
• AI run log (when available). Purpose: disputes, complaints, checking the AI. Basis: legitimate interest. 12 months, also after account deletion.
• Admin action log. Purpose: accountability and disputes. Basis: legitimate interest. 2 years.