Privacy Policy

California residents have the following rights under the CCPA as amended by the California Privacy Rights Act (CPRA, effective January 1, 2023):

• Know — Request disclosure of the categories and specific pieces of personal information we have collected about you
• Delete — Request deletion of your personal information, subject to legal exceptions
• Correct — Request correction of inaccurate personal information
• Opt Out of Sale/Sharing — We do not sell or share personal data; this right is automatically honored
• Limit Sensitive Data Use — Limit use of sensitive personal information to necessary purposes only
• Non-Discrimination — We will not discriminate against you for exercising these rights
• Portability — Receive a copy of your data in a portable, machine-readable format

Response deadline: 45 days (extendable 45 days with notice). To opt out: privacy@transit-mesh.net

Illinois residents have specific biometric data rights under BIPA:

• Right to Refuse — You may refuse biometric data collection; this will prevent you from using driver features but will not affect your rider access
• Written Policy — This page and the Biometric Consent Notice constitute the required written policy
• Retention Schedule — Biometric data destroyed within 90 days of last use or account deletion, whichever is sooner (BIPA § 15(a))
• No Sale or Trade — Biometric data will not be sold, leased, traded, or profited from in any way (BIPA § 15(c))
• No Disclosure — Biometric data not disclosed to third parties without separate written consent (BIPA § 15(d))
• Data Breach Notification — Notification under PIPA (815 ILCS 530) if your personal information is compromised

BIPA private right of action: $1,000–$5,000 per intentional violation. We take Illinois compliance seriously.

Texas residents have the following rights under the TDPSA:

• Access — Confirm whether we process your personal data and obtain a copy
• Correct — Request correction of inaccurate personal data
• Delete — Request deletion of personal data you have provided or we have collected
• Portability — Obtain a portable copy of personal data in a commonly used format
• Opt Out — Opt out of processing for targeted advertising, sale, or profiling (we do none of these)

Response deadline: 45 days. Enforcement by Texas Attorney General only (no private right of action).

Texas biometric data: We collect biometric identifiers from drivers as defined under Tex. Bus. & Com. Code § 503.001 (Texas Capture or Use of Biometric Identifier Act). Such data is used solely for identity verification and not sold or disclosed to third parties.

Residents of these states have similar privacy rights under their respective state consumer data protection laws, including rights to access, correct, delete, and opt out of sale or targeted advertising. All such requests are honored within 45 days.

We do not sell personal data, engage in targeted advertising, or use profiling for decisions with significant legal effects. Residents of all these states benefit from these baseline protections regardless of whether their specific state law has a private right of action.

Washington State residents: Additional protections apply under the Washington My Health MY Data Act (SB 1155, eff. March 2024) for any health-related data. Transit Mesh does not collect health data.

Federal baseline: All U.S. residents are protected by the Driver's Privacy Protection Act (18 U.S.C. § 2721) regarding driver's licence information, which is used solely for the permissible purpose of identity verification.

Canadian residents have the following rights:

• Access — Request access to personal information we hold about you (PIPEDA Principle 9)
• Correction — Request correction of inaccurate or incomplete personal information
• Withdrawal of Consent — Withdraw consent at any time, subject to legal or contractual restrictions
• Complaint — File a complaint with the Office of the Privacy Commissioner of Canada (OPC)

Quebec residents (Law 25): Additional rights include the right to data portability (eff. Sept 2024), the right to be de-indexed, and the right to object to automated decision-making. Biometric data is considered "sensitive information" under Law 25 and receives the highest level of protection.

A Privacy Impact Assessment (PIA) is maintained as required by Quebec Law 25 for systems involving biometric data. Contact the Privacy Officer for a summary: privacy@transit-mesh.net

Lawful basis for processing:

• General personal data: Article 6(1)(b) — contract performance; Article 6(1)(f) — legitimate interests
• Biometric data (special category): Article 9(2)(a) — explicit consent obtained before any biometric processing

Your rights under UK GDPR:

• Access (Article 15) · Rectification (Article 16) · Erasure / "Right to be forgotten" (Article 17)
• Restriction of processing (Article 18) · Data portability (Article 20) · Object (Article 21)
• Not be subject to solely automated decisions with significant effects (Article 22)
• Withdraw consent at any time without affecting lawfulness of prior processing

Response deadline: 1 month (extendable 2 months for complex requests). Complaint: Information Commissioner's Office (ICO)

Data is processed and stored on servers located in the United States (AWS US-East). We rely on standard data transfer provisions for UK-to-US transfers as permitted under the UK-US Data Bridge (eff. Oct 2023).

Australian residents have rights under the Australian Privacy Principles (APPs):

• APP 3 — Data collected only for the primary purpose of identity verification (driver safety)
• APP 5 — Notification of collection (this policy)
• APP 6 — Data not used or disclosed for secondary purposes without consent
• APP 11 — Reasonable steps to protect against misuse, interference, loss, and unauthorized access
• APP 12 — Right to access personal information we hold about you
• APP 13 — Right to request correction of inaccurate, out-of-date, or incomplete information

Complaint: Office of the Australian Information Commissioner (OAIC) at oaic.gov.au

For biometric data, we comply with the OAIC's guidance on biometric technologies and the applicable APPs. Sensitive information (including biometric data) is handled with a higher duty of care.

Note on state/territory laws: Australian state and territory privacy laws (e.g., NSW Privacy and Personal Information Protection Act 1998; Information Privacy Act 2009 (Qld)) apply to state government agencies, not private companies. The federal Privacy Act 1988 governs our operations.

Regardless of where you are located, we apply the following baseline protections to all users:

• Data minimization — collect only what is necessary
• Purpose limitation — use data only for stated purposes
• Accuracy — keep data reasonably accurate and up to date
• Storage limitation — delete data when no longer needed
• Security — appropriate technical and organizational measures
• No sale — personal data never sold for commercial purposes

If your jurisdiction has specific privacy laws not listed here, contact privacy@transit-mesh.net and we will advise on applicable rights.