Privacy Policy

Last updated: March 1, 2026

1. Information We Collect

Account Information: Name, email, phone number, and payment information when you create an account.

Trip Data: Pickup/dropoff locations, routes, timestamps, and fare details for completed trips.

Driver Documents: License, insurance, registration, and specialized credentials submitted during onboarding.

Device Data: IP address, device type, browser, and location data when using the platform.

2. How We Use Your Information

• Provide and improve transportation services
• Process payments and payouts
• Verify driver identity and credentials
• Send trip notifications and receipts
• Ensure safety and prevent fraud
• Comply with legal obligations

3. Data Sharing

With Operators: Your trip data is shared with the Operator who fulfills your ride. Each Operator is a separate data controller for their tenant's data.

With Drivers: Limited information (first name, pickup location) is shared with assigned drivers. Phone numbers are masked.

With Service Providers: Payment processors, cloud infrastructure providers (Google Cloud, Supabase), and analytics services process data on our behalf.

4. Tenant Data Isolation

UrWay Dispatch is a multi-tenant platform. Each Operator's data is logically isolated using PostgreSQL Row Level Security (RLS). No Operator can access another Operator's data. Platform administrators have access limited to cross-tenant operational needs.

5. Data Retention

We retain account data for the duration of your account plus 7 years for tax/legal compliance. Trip data is retained per Operator policy (minimum 3 years). In-app messages are retained per Operator-configured retention policy with automatic PII masking.

6. Your Rights (CCPA/GDPR)

• Right to Access: Request a copy of your personal data
• Right to Deletion: Request deletion of your personal data
• Right to Portability: Receive your data in a machine-readable format
• Right to Correction: Request correction of inaccurate data
• Right to Opt-Out: Opt out of data sale (we do not sell personal data)

Submit a Data Subject Access Request (DSAR) at privacy@urwaydispatch.com. We process requests within 30 days.

7. Security

We use industry-standard security measures including: encryption at rest (AES-256) and in transit (TLS 1.3), role-based access control, audit logging, and regular security assessments. Backup and disaster recovery with RPO ≤ 15 minutes.

8. Children's Privacy

The Service is not intended for users under 18. We do not knowingly collect personal information from children.

9. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via email or in-app notification at least 30 days before taking effect.

10. Contact

Privacy inquiries: privacy@urwaydispatch.com
Data Protection Officer: dpo@urwaydispatch.com