Privacy Policy

Introduction

Exclu-cycle ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and services.

Information We Collect

Account Information

When you create an account, we collect:

• Phone number (required) — Used as your primary identifier and for SMS one-time password (OTP) verification
• Email address (optional) — For account communications
• Name (optional) — For display purposes
• User role — Whether you are a rider or driver

Location Information

We collect precise location data to provide our services:

• Riders: Location is collected when the app is in use to show pickup locations and connect you with nearby drivers.
• Drivers: Location is collected continuously while you are online to match you with ride requests and display your position to riders.
• During active rides: GPS breadcrumbs (coordinates, speed, and heading) are recorded approximately every 3 seconds for both riders and drivers to calculate metered fares and provide real-time tracking.

Payment Information

We use Stripe to process payments. We collect and store:

• Payment method details (card brand, last 4 digits, expiration date)
• Transaction history and payment status
• Stripe Customer ID (for riders)
• Stripe Connect Account ID (for drivers receiving payouts)

Full card numbers are processed and stored by Stripe, not by us.

Ride Information

For each ride, we collect:

• Pickup and dropoff locations (coordinates and place names)
• Number of passengers
• Fare amount, fare boosts, and tips
• Ride status and timestamps
• Ratings and feedback (1-5 stars and optional text comments)
• In-app chat messages between rider and driver during the ride
• Call logs from masked phone calls via Twilio Proxy (call duration and timestamps, not call audio)
• QR code scan data for ride verification

Driver Documents and Compliance Information

If you register as a driver, we collect:

• Driver's license (front and back photos)
• Certificate of Insurance (COI)
• City operator permits (where required)
• Vehicle information: make, model, color, license plate, serial number, seat count, and photos
• Vehicle permits (where required)

These documents are processed using optical character recognition (OCR) technology to extract and verify information such as your legal name, address, date of birth, license numbers, and expiration dates.

Device and Usage Information

We automatically collect:

• Device type, model, and operating system version
• App version
• Push notification device tokens
• Crash reports and error logs (device state, OS version, stack traces)
• Usage patterns and session data

How We Use Your Information

We use the information we collect to:

• Provide and operate our pedicab ride services
• Match riders with nearby available drivers
• Calculate metered fares based on GPS distance and time
• Process payments and driver payouts
• Verify driver eligibility and compliance via document OCR
• Send SMS verification codes for account login
• Deliver push notifications about ride status, driver arrival, and account updates
• Enable in-app chat and masked phone calls between riders and drivers
• Maintain safety and prevent fraud
• Monitor and fix application errors and crashes
• Improve our services and develop new features
• Comply with legal obligations

Third-Party Service Providers

We share data with the following third-party service providers to operate our platform:

• Stripe — Payment processing, card storage, and driver payouts. Stripe receives payment method details and transaction amounts. Stripe Privacy Policy
• Twilio — SMS one-time passwords for login and masked phone calls (Twilio Proxy) between riders and drivers during rides. Twilio receives your phone number. Twilio Privacy Policy
• Firebase / Google Cloud Messaging (FCM) — Push notifications. Firebase receives your device token and notification content. Firebase Privacy Policy
• Sentry — Error monitoring and crash reporting. Sentry receives device information, OS version, and error data. Sentry Privacy Policy
• Mapbox — Maps, geocoding, and turn-by-turn navigation. Mapbox receives GPS coordinates and search queries. Mapbox Privacy Policy
• Google Cloud (Document AI) — OCR processing of driver documents (license, insurance, permits). Google receives document images for text extraction. Google Cloud Privacy Notice
• Amazon Web Services (AWS) — Cloud hosting and data storage in the us-east-1 region. AWS Privacy Notice
• Cloudflare — DNS routing and network security. Cloudflare processes network traffic metadata. Cloudflare Privacy Policy

We do not sell your personal information to third parties.

Information Sharing

Beyond our service providers listed above, we may share your information with:

• Riders and Drivers: When a ride is matched, we share relevant information between parties (name, location, vehicle details) to complete the ride.
• Legal Requirements: We may disclose information if required by law, court order, or to protect our rights, safety, or property.

Data Storage and Security

Your data is stored on servers hosted by Amazon Web Services in the United States (us-east-1 region). We implement appropriate technical and organizational measures to protect your personal information, including:

• Encrypted data transmission (HTTPS/TLS)
• Access controls and authentication
• Secure payment processing via Stripe (PCI DSS compliant)
• Regular security reviews

Driver documents are stored securely and access is restricted to authorized personnel for verification purposes.

Data Retention

We retain your personal information for as long as necessary to:

• Provide our services to you
• Comply with legal obligations (such as tax and financial records)
• Resolve disputes and enforce our agreements

Ride history and transaction records may be retained for up to 7 years for legal and accounting purposes. GPS breadcrumb data from rides is retained for the duration of the ride and summary data is kept with the ride record. You may request deletion of your account and associated data at any time, subject to legal retention requirements.

GPS breadcrumb data is retained as summary records with ride history. Chat messages are retained for the duration of your account. Crash logs and error data are retained for 90 days. Push notification device tokens are retained while your account is active and removed upon account deletion.

Your Rights

Depending on your location, you may have the right to:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate information
• Deletion: Request deletion of your account and personal data
• Portability: Request your data in a portable format
• Opt-out: Opt out of certain data collection or marketing communications

To exercise these rights, contact us at [email protected] with "Privacy Request" in the subject line. We will respond within 30 days.

California Privacy Rights (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights regarding your personal information.

Categories of Personal Information Collected

Your CCPA Rights

• Right to know what personal information we collect and how it is used
• Right to delete your personal information
• Right to opt-out of the sale of personal information — we do not sell personal information
• Right to non-discrimination for exercising your privacy rights

To exercise your CCPA rights, email [email protected] with "CCPA Request" in the subject line.

European Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, you have additional rights under the General Data Protection Regulation (GDPR).

Legal Bases for Processing

• Contract performance: Processing necessary to provide our ride services (account management, ride matching, fare calculation, payments).
• Legitimate interests: Processing for fraud prevention, service improvement, and error monitoring, where our interests do not override your rights.
• Consent: Processing based on your consent, such as location tracking and push notifications. You may withdraw consent at any time through your device settings.
• Legal obligation: Processing required to comply with applicable laws (tax records, financial reporting).

International Data Transfers

Your data is transferred to and processed in the United States. We rely on standard contractual clauses and service provider agreements to ensure adequate protection of your data during transfers.

Your GDPR Rights

In addition to the rights listed above, you have the right to:

• Restrict processing of your personal data in certain circumstances
• Object to processing based on legitimate interests
• Lodge a complaint with your local data protection authority

SMS and Push Notification Consent

By creating an account, you consent to receive SMS messages for login verification (one-time passwords). Standard message and data rates may apply. SMS frequency depends on login activity. You may stop receiving SMS by deleting your account. You may also reply STOP to any SMS message to unsubscribe. Message and data rates may apply.

Push notifications are used for ride status updates (driver arrival, ride completion), account alerts, and service announcements. You can disable push notifications through your device settings at any time.

Children's Privacy

Our services are not intended for users under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of our services after changes constitutes acceptance of the updated policy.

Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at:

Email: [email protected]

Exclu-cycle