To create an account and use KOMUTE, you may be asked to provide certain personal information such as your name, email address, phone number, date of birth, and other details needed to identify you. We ask for your date of birth to confirm that you are 18 or over. This information enables us to verify your account, communicate with you, and support your use of our service.

Depending on how you use KOMUTE, we may also collect:

• Identity verification data (drivers): a photo of your government-issued driver's licence, which is used only during verification and is not stored; the licence details you enter on your profile (licence number, issuing province and expiry date) along with your name and date of birth; and a selfie used for facial comparison, which is also not stored. See Sections 9 and 12 for how this data is protected, retained, and deleted.
• Location data: origin and destination coordinates you enter when posting or searching for a trip, and (with your permission) your device's GPS location when you use the "Locate Me" feature.
• Trip and booking data: trips posted, seats booked, cancellations, and ride history.
• Communications: messages you exchange with other users through the in-app chat, and messages you send to our support team.
• Ratings and reviews: feedback you give and receive after trips.
• Technical data: IP address, device and browser information, and usage logs (see Section 5).

We collect only the personal information that is reasonably necessary to operate the platform, and we retain it only for as long as needed for the purposes described in this policy (see Section 13, Data Retention).

We use only the cookies needed to run KOMUTE: a session cookie that keeps you signed in, and a security cookie that protects our forms from forgery. We don't use analytics, advertising or tracking cookies. While you write a chat message, your browser keeps the unsent text in temporary session storage until you send it or close the tab. If you block cookies, you won't be able to sign in.

Your information helps us:

• Verify your account and identity.
• Provide and improve KOMUTE services.
• Communicate important updates or service notices.
• Review reports about user conduct, act on them, and keep the platform safe.
• Find and fix errors, and keep the service running well.

We do not sell or rent your personal information.

Service providers. We use the following companies to run KOMUTE. Each receives only what it needs for its task:

• DigitalOcean (United States): hosts our servers, database and stored files, so it holds all the information described in this policy on our behalf.
• Amazon Web Services, Simple Email Service (United States): sends our emails, so it receives your email address and the content of the emails we send you.
• Komoot, Photon address search (Germany): receives the addresses you type into place search, your device's position if you use "Locate Me", and your IP address and browser information (see Section 11).
• Open Source Routing Machine (OSRM) public routing service (outside Canada): receives a trip's start, stop and end coordinates, and your IP address and browser information, to work out the route (see Section 11).
• OpenStreetMap Foundation (United Kingdom): supplies the map images, so it receives your IP address, browser information and the map area you are viewing.
• unpkg (a global content delivery network): delivers the map software on ride pages, so it receives your IP address and browser information.
• Unsplash (a global content delivery network): delivers some photos on our About and How It Works pages, so it receives your IP address and browser information.

Driver verification runs on KOMUTE's own servers. Your licence photo and selfie are not sent to any other company (see Sections 9 and 12).

Other users. To arrange shared rides, other users see your name, rating and reviews, and the trips you post or book. Passengers also see the driver's vehicle details. A driver's phone number is shown only to passengers whose booking the driver has confirmed.

KOMUTE may disclose your information:

• If required by law or legal process.
• To enforce our Terms of Service.
• To protect the rights, safety, or property of KOMUTE, our users, or the public.
• For investigations of fraud, abuse, or security issues.

We will attempt to notify you of legal requests unless prohibited by law, court order, or risk of harm.

Our servers automatically record technical data with each request, such as your IP address, browser information, the page requested and the time. We use it to keep the service secure (for example, to block repeated failed sign-in attempts) and to find and fix errors. We don't use analytics tools, and we don't use this data for advertising.

We may send you service-related messages and updates about KOMUTE. These are considered part of using KOMUTE and cannot be opted out of.

If you receive marketing or promotional emails from us, you can opt out at any time using the unsubscribe link included in those messages.

You may delete your KOMUTE account at any time from your profile, from our account deletion page (no sign-in needed), or by contacting support. We email you a link to confirm. Once you confirm, your account is closed immediately and your personal data is deleted or anonymized in accordance with the retention schedule in Section 13 and applicable law.

When you request deletion of your account or personal data, we will delete or anonymize the personal data associated with your account — including your profile information, ride history, ride search logs, verification records, and chat messages — within 45 days of a verified request, unless we are legally required or permitted to retain specific records (for example, to comply with a legal obligation, resolve disputes, investigate fraud or safety incidents, or enforce our agreements). Where retention is required, the data is kept only for as long as that specific purpose demands and is then deleted.

To submit a deletion request, use your profile, the account deletion page, or contact privacy@komute.net. We may need to verify your identity before acting on a request in order to protect your data from unauthorized deletion.

For safety and compliance, drivers must complete identity verification before posting a trip. Verification involves reading information from your government-issued driver's licence (using optical character recognition) and comparing your licence photo against a selfie. Verification runs on KOMUTE's own servers; your licence photo and selfie are not sent to any other company.

• Purpose limitation: verification data is used solely to confirm your identity and eligibility to drive. It is never used for advertising and is never sold, leased, or traded.
• Licence photo, processed only: you add the photo of your licence when you start verification. It is checked with your selfie by our verification system, used for that check, and never saved by KOMUTE: not in our database, our file storage or our logs.
• Data minimization: after verification we keep the verification outcome (approved or rejected) and the licence details you entered on your profile (licence number, issuing province and expiry date), which we need to know when your licence expires and to tell when your details change. The information our verification system reads from your licence photo is not stored; we keep only which checks passed.
• Security: your licence number and issuing province are encrypted in our database, and access is restricted to authorized personnel who need it to perform verification and safety functions.
• Biometric data: the facial comparison process is subject to the additional protections, consent requirements, and retention limits described in Section 12 (Biometric Information).

We ask for your phone number when you sign up. We only share a driver's phone number with passengers whose booking the driver has confirmed, so they can coordinate the trip.

KOMUTE uses location information to match drivers and passengers travelling in the same direction. Origin and destination coordinates you enter when posting or searching for trips are associated with your account so the platform can function.

• Search logs: ride search records (including origin and destination coordinates) are automatically deleted no later than 90 days after the search, and are deleted immediately when you delete your account.
• "Locate Me" feature: when you tap "Locate Me," your device's GPS coordinates are sent to Komoot's Photon geocoding service (photon.komoot.io), a third-party provider, to convert your position into a readable address. This transmission is transient — KOMUTE does not store the coordinates from this call, and Komoot processes them only to return the address. If you prefer not to share your GPS position with this provider, you can type your address manually instead.
• Address search: as you type a place into a search or ride form, the text is sent to Komoot's Photon service (photon.komoot.io) to suggest matching addresses. Komoot receives the text you type, plus your IP address and browser information, but not your name or account details.
• Route calculation: to show a trip's distance, estimated drive time and route on the map, your browser sends the trip's origin, stop and destination coordinates to the Open Source Routing Machine (OSRM) public routing service (router.project-osrm.org), a third-party provider hosted outside Canada. This happens when a driver posts or edits a ride and when the trip's details or summary are viewed. As with any web request, the provider also receives your IP address and browser information. It does not receive your name or account details, and it uses the coordinates only to return the route. KOMUTE keeps the resulting estimated drive time with the trip.
• No continuous tracking: KOMUTE does not track your location in the background or outside of the features described above.

As part of driver verification, KOMUTE compares the photo on your driver's licence against a selfie you provide, which generates a facial similarity score. In some jurisdictions (including Illinois, Texas, and Washington in the United States), this score and related data may be considered a biometric identifier or biometric information. This section serves as our written policy on biometric data, made publicly available as required by law.

• Consent: we will collect biometric data only after you have been informed in writing that it is being collected, the specific purpose, and the retention period, and only after you have provided your written (electronic) consent. You may decline; however, declining means you cannot be verified as a driver.
• Purpose: biometric data is collected solely to verify that the person creating a driver profile matches their government-issued licence. It is used for no other purpose.
• Retention and destruction: facial similarity scores and any biometric data are permanently destroyed within 30 days after the verification decision is made, or when the initial purpose for collection has been satisfied, or within 3 years of your last interaction with KOMUTE — whichever occurs first. After destruction, we retain only a non-biometric pass/fail verification outcome.
• No sale or profit: we do not sell, lease, trade, or otherwise profit from biometric data, and we do not disclose it to third parties except as required by law or with your consent. The facial comparison runs on KOMUTE's own servers, not at another company.
• Security: biometric data is stored and transmitted using a reasonable standard of care at least as protective as the manner in which we protect other confidential and sensitive information.
• Automated decision and human review: whether you are verified as a driver is decided by KOMUTE's automated verification system, and we tell you so on the result screen. The decision is based on the selfie and licence photo you provide, your vehicle's details and photo, and the name, date of birth and licence details in your profile. There are three checks: whether the selfie matches the photo on your licence, whether your licence details match what is read from the licence photo, and whether your vehicle matches its photo. You are verified only if all three pass; the result screen lists the reasons for a rejection. You can correct your profile details and verify again. You can also ask a member of our team to review a rejection, and send them your comments, from the result screen or your profile page, or by writing to privacy@komute.net. When the automated system can't reach a clear decision, a member of our team decides without being asked. We email you the outcome of every review.

We keep personal data only as long as necessary for the purpose it was collected, after which it is deleted or anonymized. Our standard retention periods are:

• Biometric verification data (facial similarity scores): destroyed within 30 days after the verification decision (see Section 12).
• Driver's licence photo: not stored; used only while the verification check runs.
• Information read from the licence photo (OCR output): not stored; only which checks passed is kept.
• Licence details you enter (number, province, expiry): for as long as your account is active, then deleted per Section 8.
• Verification records (outcome only): up to 1 year after the verification decision. This includes any request for human review, the comments you sent with it, and the reviewer's decision.
• Ride search logs: up to 90 days.
• Completed rides and bookings: up to 2 years after trip completion.
• Cancelled rides, and bookings that were cancelled or that the driver declined: up to 6 months after the cancellation or decline, then deleted.
• Reviews: up to 2 years after the ride, then deleted.
• In-app chat messages: up to 1 year after the associated ride is completed or cancelled.
• Reports about other users: the reason, your description, the people and booking involved, and our decision. Kept while we review the report and up to 1 year after we close it. The reported person isn't told who made the report.
• Blocked users: kept until you unblock the user or either account is deleted.
• Account profile data: for as long as your account is active, then deleted per Section 8.

We may retain specific records beyond these periods only where required by law, or where reasonably necessary to resolve disputes, investigate safety incidents or fraud, enforce our agreements, or establish, exercise, or defend legal claims — and only for as long as that purpose requires.

We use administrative, technical, and physical safeguards designed to protect personal data, including encryption of all data in transit, field-level encryption of sensitive data at rest (such as licence numbers and facial similarity scores), role-based access controls that restrict sensitive records (such as verification data) to authorized personnel, and scheduled deletion processes that enforce the retention periods above.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach of security affecting your personal data occurs, we will notify you and the relevant regulators or authorities as required by applicable law (including US state breach notification laws, Canada's PIPEDA, and the GDPR), without undue delay and within the timeframes those laws require.

If you are a resident of California or another US state with a comprehensive privacy law (such as Virginia, Colorado, Connecticut, Texas, or Utah), you have the right, subject to certain exceptions, to:

• Know / access: request disclosure of the categories and specific pieces of personal information we have collected about you, including ride and search history.
• Delete: request deletion of your personal information (see Section 8).
• Correct: request correction of inaccurate personal information.
• Portability: receive your personal information in a portable, readily usable format. You can use Download my data on your profile page to get a copy yourself, as a JSON file.
• Opt out of sale or sharing: KOMUTE does not sell personal information and does not share it for cross-context behavioural advertising. If that ever changes, we will provide the required notice and opt-out mechanisms first.
• Non-discrimination: we will not deny you service, charge different prices, or provide a different level of service because you exercised a privacy right.

You may exercise these rights by contacting privacy@komute.net. You may designate an authorized agent to submit requests on your behalf. We will verify your identity before responding and will respond within the timeframe required by your state's law (generally 45 days, extendable once where permitted).

If you are in Canada, we handle your personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws (including Quebec's Law 25). You have the right to:

• Access the personal information we hold about you and be informed of how it is used and disclosed. You can use Download my data on your profile page to get a copy yourself, as a JSON file.
• Challenge the accuracy and completeness of your information and have it corrected.
• Withdraw consent to the collection, use, or disclosure of your information, subject to legal or contractual restrictions and reasonable notice (withdrawing consent for data essential to the service may mean we can no longer provide it).
• Request deletion of your personal information as described in Section 8.
• Be told when a decision about you is made only by automated processing, which for KOMUTE is driver verification; on request, be told what personal information was used and the reasons and main factors behind the decision; have that information corrected; and send your comments to a member of our team who can review the decision (Quebec Law 25, s.12.1 of the private sector Act). See Section 12, "Automated decision and human review".
• File a complaint with the Office of the Privacy Commissioner of Canada or your provincial privacy regulator if you believe your rights have been violated.

Requests and complaints can be directed to our Privacy Officer at privacy@komute.net.

If you are in the European Economic Area, Switzerland, or the United Kingdom, we process your personal data on the following legal bases: performance of a contract (operating your account, matching trips, in-app messaging), legitimate interests (platform safety, fraud prevention, service improvement), consent (biometric verification, marketing communications, device location access), and legal obligation (responding to lawful requests, breach notification). Biometric data is processed only with your explicit consent under Article 9(2)(a) GDPR.

You have the right to:

• Access your personal data and receive a copy (Art. 15). You can use Download my data on your profile page to get a copy yourself, as a JSON file.
• Rectify inaccurate or incomplete data (Art. 16).
• Erasure ("right to be forgotten") (Art. 17).
• Restrict processing (Art. 18).
• Data portability (Art. 20).
• Object to processing based on legitimate interests, including profiling (Art. 21).
• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (Art. 7).
• Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects; driver verification is decided automatically, so you may ask for a person to review a rejection, express your point of view and contest the decision (Art. 22; see Section 12).
• Lodge a complaint with your local supervisory authority (or the UK Information Commissioner's Office).

To exercise these rights, contact privacy@komute.net. We respond within one month, extendable by two further months for complex requests as the GDPR permits.

KOMUTE is operated by Indus Network LLC and your data is stored and processed in the United States, where our servers and email provider are located. Some of the service providers listed in Section 3 are in other countries. Where personal data is transferred out of the EEA, UK, Switzerland, or Canada, we use lawful transfer mechanisms — such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or an adequacy decision — and require recipients to protect the data to standards consistent with this policy and applicable law.

KOMUTE is intended for adults aged 18 and over. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from a person under 18, we will delete it promptly. If you believe a minor has provided us with personal information, please contact privacy@komute.net.

We may update this policy from time to time. When material changes are made, we will notify you by email or on the website before the changes take effect, so you are aware of what we collect and how it is used. Where a change requires your consent under applicable law (for example, a new use of biometric data), we will obtain that consent before the change applies to you.

For privacy questions, requests, or complaints, contact our Privacy Officer:

• Email: privacy@komute.net
• Legal notices: legal@komute.net
• Operator: Indus Network LLC, operator of the KOMUTE platform.