Privacy Policy

Introduction

Exclu-cycle ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and services.

Information We Collect

Account Information

When you create an account, we collect:

• Phone number (required) — Used as your primary identifier and for SMS one-time password (OTP) verification
• Email address (optional) — For account communications
• Name (optional) — For display purposes
• User role — Whether you are a rider or driver

Location Information

We collect precise location data to provide our services:

• Riders: Location is collected when the app is in use to show pickup locations and connect you with nearby drivers.
• Drivers: Location is collected continuously while you are online to match you with ride requests and display your position to riders.
• During active rides: GPS breadcrumbs (coordinates, speed, and heading) are recorded approximately every 3 seconds for both riders and drivers to calculate metered fares and provide real-time tracking.

Payment Information

We use Stripe to process payments. We collect and store:

• Payment method details (card brand, last 4 digits, expiration date)
• Transaction history and payment status
• Stripe Customer ID (for riders)
• Stripe Connect Account ID (for drivers receiving payouts)
• Billing name and address provided by your mobile wallet (Apple Pay / Google Pay) or entered manually — used to populate your profile and, if you have not already set one, to suggest a "Home" saved place for faster pickups

Full card numbers are processed and stored by Stripe, not by us.

Ride Information

For each ride, we collect:

• Pickup and dropoff locations (coordinates and place names)
• Number of passengers
• Fare amount, fare boosts, and tips
• Ride status and timestamps
• Ratings and feedback (1-5 stars and optional text comments)
• In-app chat messages between rider and driver during the ride
• Call logs from masked phone calls via Twilio Proxy (call duration and timestamps, not call audio)
• QR code scan data for ride verification

Accessibility and Accommodation Information

If you request a wheelchair-accessible vehicle, we associate that request with the ride. The app also automatically detects whether a device screen reader, such as VoiceOver or TalkBack, is enabled and records that yes-or-no status with a ride so a driver can offer appropriate assistance. We do not collect the content read by the screen reader. These accommodation indicators may be shared with drivers who may receive or fulfill the ride.

Place Searches and Saved Places

When you search for a pickup, drop-off, address, business, or point of interest, the app processes the text you type, the selected result or place identifier, and current-location or service-area coordinates used to bias the results. You may also save named places, such as Home or Work, with their addresses and coordinates.

Tour Bookings, Purchases, and Content

We keep account-linked ride and tour booking and purchase history, including the ride or tour booked, scheduled date and time, pickup, drop-off or tour details, group size, selected add-ons, prices, service fees, payment and cancellation status, and transaction references. For tours, we may also collect special requests, cancellation reasons, booking chat messages, ratings, optional review text, and photos, captions, or location information you choose to add to a shared tour album.

We do not currently display tour review text or review photos publicly. Tour-album photos, captions, location information, and booking chat are available only to the booked rider, the assigned driver, and authorized support or operations personnel. We will provide an additional disclosure and update this Policy before enabling public reviews.

Support and Other Content You Provide

When you contact support, we collect the ticket category, subject, description, messages, optional linked ride, satisfaction feedback, and any file or attachment you choose to provide if attachments are available. Support requests are associated with your account so we can respond, investigate issues, prevent abuse, and maintain support history.

Special requests, cancellation reasons, messages, reviews, captions, and other free-form fields may contain information you choose to provide. Please do not include sensitive information that is not needed to provide the service.

Driver Documents and Compliance Information

If you register as a driver, we collect:

• Driver's license (front and back photos)
• Certificate of Insurance (COI)
• City operator permits (where required)
• Vehicle information: make, model, color, license plate, serial number, seat count, and photos
• Vehicle permits (where required)

These documents are processed using optical character recognition (OCR) technology to extract and verify information such as your legal name, address, date of birth, license numbers, and expiration dates.

Device, Usage, and Diagnostic Information

We automatically collect:

• Device type, model, operating-system version, app version, and push-notification device token
• App activity and session information, including app launches, screens or features used, and network state
• Crash, error, and diagnostic information, which may include an opaque internal account ID, coarse location, ride ID, ride status and fare context, network state, device state, stack traces, and recent in-app actions
• Performance information, including app-start, screen, transaction, and network timing, user-interface responsiveness, slow or frozen frames, and app hangs

How We Use Your Information

We use the information we collect to:

• Provide and operate our pedicab ride services
• Match riders with nearby available drivers
• Calculate metered fares based on GPS distance and time
• Process payments and driver payouts
• Verify driver eligibility and compliance via document OCR
• Send SMS verification codes for account login
• Send ride status notifications and driver dispatch alerts to app users who consented at login
• Deliver push notifications about ride status, driver arrival, and account updates
• Enable in-app chat and masked phone calls between riders and drivers
• Honor accommodation requests and alert drivers when assistance may be useful
• Process place searches and manage saved places
• Manage tour bookings, add-ons, private shared albums, ratings, feedback, and support requests
• Maintain safety and prevent fraud
• Measure and improve app reliability and performance, including crashes, errors, slow operations, and app hangs
• Improve our services and develop new features
• Comply with legal obligations

Third-Party Service Providers

We share data with the following third-party service providers to operate our platform:

• Stripe — Payment processing, card storage, and driver payouts. Stripe receives payment method details and transaction amounts. Stripe Privacy Policy
• Twilio — SMS one-time passwords for login, ride status notifications, driver dispatch alerts, and masked phone calls (Twilio Proxy) between riders and drivers during rides. Twilio receives your phone number. Twilio Privacy Policy
• Firebase / Google Cloud Messaging (FCM) — Push notifications. Firebase receives your device token and notification content. Firebase Privacy Policy
• Sentry — Crash, error, diagnostic, and performance monitoring. Sentry may receive an opaque internal account ID, coarse location and ride or network context, device, operating-system and app information, stack traces, recent app actions, performance timing, and app-hang information. Sentry Privacy Policy
• Google Maps Platform — Place autocomplete and search, place details, nearby-place search, and geocoding. Google receives the text entered into place search, selected place identifiers, and current-location, service-area, or address coordinates used to bias results or resolve an address. Google Privacy Policy
• Mapbox — Map display, routing, map matching, turn-by-turn navigation, terrain information, and some geocoding. Mapbox receives coordinates, destinations, routes, map interactions, and geocoding queries used by those features. Mapbox Privacy Policy
• Google Cloud (Document AI) — OCR processing of driver documents (license, insurance, permits). Google receives document images for text extraction. Google Cloud Privacy Notice
• Amazon Web Services (AWS) — Cloud hosting and data storage in the us-east-1 region. AWS Privacy Notice
• Google Analytics — Visit measurement on the exclu-cycle.com website only (not the mobile app), subject to the choices described under “Website Analytics and Cookies” below. Google receives the page address without its query string, the page title, the referring page, an approximate location derived from your IP address, and general device and browser information. Google Privacy Policy
• Microsoft Clarity — Recordings and heatmaps of how visitors use the exclu-cycle.com website only (not the mobile app), subject to the choices described under “Website Analytics and Cookies” below. Microsoft receives the page address, general device and browser information, and your clicks, taps, scrolling and mouse movement on the page. Microsoft Privacy Statement
• Cloudflare — DNS routing and network security. Cloudflare processes network traffic metadata. Cloudflare Privacy Policy
• Anthropic (Claude) — AI processing for our in-app support/SMS assistant and for reading uploaded driver documents. Anthropic receives the message or document text needed to perform that task. Anthropic Privacy Policy
• Resend — Delivery of transactional emails (receipts, confirmations). Resend receives your email address and message content. Resend Privacy Policy
• Printful — Fulfillment and shipping of merchandise and driver business-card orders. Printful receives the shipping name and address you provide for an order. Printful Privacy Policy
• Spotify — Optional driver music authorization and playback. If a driver connects Spotify, the app communicates with Spotify to access the driver's display name, subscription tier, playlists or library, current playback state, and playback controls. Spotify credentials and related profile metadata are stored on the device. Spotify Privacy Policy
• Weather data providers — The National Weather Service, Open-Meteo, and Iowa State University Mesonet provide forecasts, alerts, and radar imagery. They receive coordinates or map-tile requests needed to return the requested weather information.

We require service providers that receive personal information from us to protect it to the same or an equivalent level as described in this Policy and required by applicable law and the App Store Review Guidelines, and to use it only to provide services to us or as otherwise disclosed here.

We do not sell your personal information to third parties.

Website Analytics and Cookies

This section describes the exclu-cycle.com website only. It does not describe the ExcluCycle mobile app, which is covered by the rest of this Policy.

On our public marketing and support pages we use Google Analytics to count visits and see which pages people read, and Microsoft Clarity to record how people use those pages. Whether we ask first depends on where you are, which we determine from the country — and, in the United States, the state — that our network provider (Cloudflare) associates with your connection.

Google Analytics:

• In the European Union or European Economic Area, the United Kingdom, Switzerland, or Canada — or if we cannot tell which country you are in — nothing is loaded and no analytics request is sent until you choose “Accept” on the banner shown on your first visit. That banner asks about both Google Analytics and Microsoft Clarity recording, and “Accept” turns on both.
• Elsewhere, including the United States, Google Analytics runs without a banner. You can opt out at any time.

Microsoft Clarity recording:

• We ask before recording. Unless one of the exceptions below applies, a bar at the bottom of the page asks “Mind if we record your visit?”, and Clarity is not loaded unless you choose “Record my visit”. If you choose “No thanks”, your choice is remembered and we do not ask again. This applies everywhere in the United States except Maine and Ohio, if we cannot tell which state you are in, and in every country not listed above.
• In Maine and Ohio, Clarity records without asking first. You can turn recording off at any time.
• In the countries listed above, the analytics banner covers recording as well.
• Clarity only ever runs when Google Analytics is also running on the page.

Wherever you are, you can change your choices at any time using the “Analytics choices” link in the page footer. It shows the analytics banner again: “Accept” turns on both Google Analytics and Clarity recording, and “Reject” turns off both — we tell Clarity to stop recording immediately, no analytics code is loaded on later visits, and your choice is remembered. If your browser sends a Global Privacy Control or Do Not Track signal, we do not load analytics or Clarity at all and do not look up your location.

When analytics runs, Google Analytics and Microsoft Clarity set cookies in your browser and we collect:

• The address of the page you viewed, with any query string and fragment removed, plus the page title and the referring page address
• An approximate location — country, state or region, and city — that Google estimates from your IP address. We never ask your browser or device for GPS location on this website
• General device and browser information, such as browser name, operating system, and screen size
• A randomly generated identifier that distinguishes one browser from another
• Which links you click — for example the App Store or Google Play links, our phone number or email address, or links to other pages — and the link’s label. This records a click on a link only. It does not tell us whether an app was downloaded, installed, or opened, or whether a call or message was made
• How you use the page, recorded by Microsoft Clarity: scrolling, clicks and taps, and mouse movement, which we can replay as a recording of the visit and combine into heatmaps. Clarity’s masking hides everything you type into a form field on this site. It also tries to automatically detect and hide other sensitive text, but that detection is not guaranteed to catch everything. Clarity does not run at all on a page opened with a query string or fragment in its address

We have deliberately limited what is collected. We do not enable Google Signals, advertising or remarketing features, cross-site or cross-device tracking, or any attempt to identify you personally. We do not use advertising pixels on this website. We do not send Google or Microsoft your name, email address, phone number, the contents of any form, or any payment, booking, or account identifier. Pages that could carry sensitive information in their address — payment confirmation and cancellation pages, and the account-deletion page — do not load analytics at all.

Analytics measures recorded traffic rather than an exact count of people. Visits are missed when someone rejects analytics, blocks scripts or cookies, or uses a privacy-focused browser, and one person using several devices or browsers is counted more than once. Locations are estimates from IP address and are sometimes wrong, particularly for mobile networks and VPNs.

Google and Microsoft act as our service providers for this data. Their handling of it is governed by the Google Privacy Policy and the Microsoft Privacy Statement. You can also opt out across all sites with the Google Analytics Opt-out Browser Add-on.

Information Sharing

Beyond our service providers listed above, we may share your information with:

• Riders and Drivers: When a ride or tour is offered or matched, we share information needed to evaluate or complete it, such as name, pickup and drop-off location, vehicle information, accommodation indicators, booking details, group size, and special requests.
• Tour Participants: Booking chat and shared tour-album photos, captions, and associated location information are available to the booked rider, assigned driver, and authorized support or operations personnel.
• Legal Requirements: We may disclose information if required by law, court order, or to protect our rights, safety, or property.

Data Storage and Security

Data is primarily stored on Amazon Web Services in the United States. We use safeguards designed to protect personal information, including TLS encryption in transit, authentication and access controls, private cloud object storage for driver documents and uploaded media, and Stripe-hosted payment processing. No storage or transmission method is completely secure, and we cannot guarantee absolute security.

Data Retention

We retain personal information only as long as reasonably needed to provide the service, meet legal and accounting obligations, investigate fraud or safety concerns, resolve disputes, and enforce our agreements.

Ride and tour booking, transaction, payout, and other financial records may be retained for up to 7 years. The full GPS path of a ride remains with its retained ride record for fare calculation, safety, and dispute resolution.

When you delete your account, we delete, de-link, or de-identify account profile information, saved places, between-ride driver traces, chat messages, push tokens, support-message content and attachment references, tour special requests and cancellation text, reviews, and your shared-tour photos. We may retain de-identified support ticket status records and ride or tour financial and lifecycle records required for accounting, payouts, fraud prevention, legal compliance, or disputes.

Crash, error, diagnostic, and performance data is retained under the monitoring provider's configured retention period and only as long as reasonably needed to investigate reliability, security, or performance issues. Provider backups and legal holds may expire on a different schedule.

You may request account deletion in the app or by emailing [email protected].

Your Rights

Depending on your location, you may have the right to:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate information
• Deletion: Request deletion of your account and personal data
• Portability: Request your data in a portable format
• Opt-out: Opt out of certain data collection or marketing communications

To exercise these rights, contact us at [email protected] with "Privacy Request" in the subject line. We will respond within 30 days.

California Privacy Rights (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights regarding your personal information.

Categories of Personal Information Collected

Your CCPA Rights

• Right to know what personal information we collect and how it is used
• Right to delete your personal information
• Right to opt-out of the sale of personal information — we do not sell personal information
• Right to non-discrimination for exercising your privacy rights

To exercise your CCPA rights, email [email protected] with "CCPA Request" in the subject line.

European Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, you have additional rights under the General Data Protection Regulation (GDPR).

Legal Bases for Processing

• Contract performance: Processing necessary to provide our ride services (account management, ride matching, fare calculation, payments).
• Legitimate interests: Processing for fraud prevention, service improvement, and error monitoring, where our interests do not override your rights.
• Consent: Processing based on your consent, such as location tracking and push notifications. You may withdraw consent at any time through your device settings.
• Legal obligation: Processing required to comply with applicable laws (tax records, financial reporting).

International Data Transfers

Your data is transferred to and processed in the United States. We rely on standard contractual clauses and service provider agreements to ensure adequate protection of your data during transfers.

Your GDPR Rights

In addition to the rights listed above, you have the right to:

• Restrict processing of your personal data in certain circumstances
• Object to processing based on legitimate interests
• Lodge a complaint with your local data protection authority

SMS and Mobile Information

Exclu-cycle uses SMS solely for transactional purposes related to account login and rides. We collect express written consent before sending SMS, and every message identifies Exclu-cycle and includes STOP instructions.

Mobile information will not be shared with third parties or affiliates for marketing or promotional purposes. No mobile information collected through any SMS opt-in flow (described in our SMS Terms and on the SMS Opt-In page) will be shared with third parties or affiliates for marketing or promotional purposes. Phone numbers are shared only with our SMS delivery provider (Twilio) for the sole purpose of delivering the transactional messages you have consented to receive, and with no other third party for any marketing purpose.

Message categories. We send three categories of SMS, all transactional:

1. OTP / verification codes — sent to riders and drivers who enter their phone number on the Exclu-cycle app login screen and tap Continue beneath an SMS consent disclosure.
2. Ride status notifications — sent to app users who completed the login consent flow. Includes driver-assigned, driver-arriving, ride-started, ride-complete, and receipt messages.
3. Driver dispatch alerts — sent to app-installed drivers who completed the login consent flow. Includes new-ride-offer and pickup-update messages.

Consent records. We retain consent records (phone number, timestamp, flow type) for dispute resolution and regulatory audit per the retention schedule above.

Opt-out. Reply STOP to any Exclu-cycle SMS to opt out at any time. Reply HELP for help. For full SMS terms, see our SMS Terms & Conditions and the public opt-in documentation at Exclu-cycle SMS Opt-In Flow.

Push notifications are used for ride status updates (driver arrival, ride completion), account alerts, and service announcements. You can disable push notifications through your device settings at any time.

Children's Privacy

App accounts are not intended for anyone under 18. A child under 7 may ride only as a passenger on a ride booked by an adult. The adult enters only the number of child passengers; children do not create accounts, and we do not request their names, phone numbers, email addresses, or other account information. We do not knowingly collect personal information directly from children.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of our services after changes constitutes acceptance of the updated policy.

Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at:

Email: [email protected]

Exclu-cycle