To create an account and use KOMUTE, you may be asked to provide certain personal information such as your name, email address, phone number, and other details needed to identify you. This information enables us to verify your account, communicate with you, and support your use of our service.

Depending on how you use KOMUTE, we may also collect:

• Identity verification data (drivers): images of your government-issued driver's licence, information extracted from that licence (name, address, date of birth, licence number, expiry date), and a selfie used for facial comparison. See Sections 9 and 12 for how this data is protected, retained, and deleted.
• Location data: origin and destination coordinates you enter when posting or searching for a trip, and (with your permission) your device's GPS location when you use the "Locate Me" feature.
• Trip and booking data: trips posted, seats booked, cancellations, and ride history.
• Communications: messages you exchange with other users through the in-app chat, and messages you send to our support team.
• Ratings and reviews: feedback you give and receive after trips.
• Technical data: IP address, device and browser information, and usage logs (see Section 5).

We collect only the personal information that is reasonably necessary to operate the platform, and we retain it only for as long as needed for the purposes described in this policy (see Section 13, Data Retention).

We use cookies and similar tools to improve your experience with KOMUTE. Cookies help you stay logged in, remember preferences, and enable us to analyze usage patterns. You can choose to disable cookies, but doing so may limit some features of our platform.

Your information helps us:

• Verify your account and identity.
• Provide and improve KOMUTE services.
• Communicate important updates or service notices.
• Analyze trends and enhance user experience.

We do not sell or rent your personal information to third parties, except as described in this policy.

KOMUTE may disclose your information:

• If required by law or legal process.
• To enforce our Terms of Service.
• To protect the rights, safety, or property of KOMUTE, our users, or the public.
• For investigations of fraud, abuse, or security issues.

We will attempt to notify you of legal requests unless prohibited by law, court order, or risk of harm.

We automatically collect certain technical data (e.g., IP addresses and device information) to understand usage patterns and improve performance. This information does not directly identify you.

We may send you service-related messages and updates about KOMUTE. These are considered part of using KOMUTE and cannot be opted out of.

If you receive marketing or promotional emails from us, you can opt out at any time using the unsubscribe link included in those messages.

You may close your KOMUTE account at any time through your account settings or by contacting support. After account closure, your account will be deactivated and your personal data will be deleted or anonymized in accordance with the retention schedule in Section 13 and applicable law.

When you request deletion of your account or personal data, we will delete or anonymize the personal data associated with your account — including your profile information, ride history, ride search logs, verification records, and chat messages — within 45 days of a verified request, unless we are legally required or permitted to retain specific records (for example, to comply with a legal obligation, resolve disputes, investigate fraud or safety incidents, or enforce our agreements). Where retention is required, the data is kept only for as long as that specific purpose demands and is then deleted.

To submit a deletion request, use your account settings or contact privacy@komute.net. We may need to verify your identity before acting on a request in order to protect your data from unauthorized deletion.

For safety and compliance, drivers must complete identity verification before posting a trip. Verification involves reading information from your government-issued driver's licence (using optical character recognition) and comparing your licence photo against a selfie. KOMUTE may use trusted third-party services to perform parts of this verification.

• Purpose limitation: verification data is used solely to confirm your identity and eligibility to drive. It is never used for advertising and is never sold, leased, or traded.
• Data minimization: once verification is complete, we retain only the verification outcome (approved or rejected) and the minimum details needed (such as name match and licence expiry). The full extracted licence data is deleted after the verification decision is recorded.
• Security: licence data is encrypted at rest, and access is restricted to authorized personnel who need it to perform verification and safety functions.
• Biometric data: the facial comparison process is subject to the additional protections, consent requirements, and retention limits described in Section 12 (Biometric Information).

If you use the KOMUTE mobile app, we may collect information permitted by app store policies (such as phone number or device data). We only share your phone number with other users when necessary to coordinate a confirmed trip for safety and communication.

KOMUTE uses location information to match drivers and passengers travelling in the same direction. Origin and destination coordinates you enter when posting or searching for trips are associated with your account so the platform can function.

• Search logs: ride search records (including origin and destination coordinates) are automatically deleted no later than 90 days after the search, and are deleted immediately when you delete your account.
• "Locate Me" feature: when you tap "Locate Me," your device's GPS coordinates are sent to Komoot's Photon geocoding service (photon.komoot.io), a third-party provider, to convert your position into a readable address. This transmission is transient — KOMUTE does not store the coordinates from this call, and Komoot processes them only to return the address. If you prefer not to share your GPS position with this provider, you can type your address manually instead.
• No continuous tracking: KOMUTE does not track your location in the background or outside of the features described above.

As part of driver verification, KOMUTE compares the photo on your driver's licence against a selfie you provide, which generates a facial similarity score. In some jurisdictions (including Illinois, Texas, and Washington in the United States), this score and related data may be considered a biometric identifier or biometric information. This section serves as our written policy on biometric data, made publicly available as required by law.

• Consent: we will collect biometric data only after you have been informed in writing that it is being collected, the specific purpose, and the retention period, and only after you have provided your written (electronic) consent. You may decline; however, declining means you cannot be verified as a driver.
• Purpose: biometric data is collected solely to verify that the person creating a driver profile matches their government-issued licence. It is used for no other purpose.
• Retention and destruction: facial similarity scores and any biometric data are permanently destroyed within 30 days after the verification decision is made, or when the initial purpose for collection has been satisfied, or within 3 years of your last interaction with KOMUTE — whichever occurs first. After destruction, we retain only a non-biometric pass/fail verification outcome.
• No sale or profit: we do not sell, lease, trade, or otherwise profit from biometric data, and we do not disclose it to third parties except as required by law, with your consent, or to the verification service provider acting on our behalf under contractual confidentiality and security obligations.
• Security: biometric data is stored and transmitted using a reasonable standard of care at least as protective as the manner in which we protect other confidential and sensitive information.

We keep personal data only as long as necessary for the purpose it was collected, after which it is deleted or anonymized. Our standard retention periods are:

• Biometric verification data (facial similarity scores): destroyed within 30 days after the verification decision (see Section 12).
• Extracted driver's licence data (OCR output): deleted once the verification decision is recorded; only the outcome and minimum matching details are retained.
• Verification records (outcome only): up to 1 year after the verification decision.
• Ride search logs: up to 90 days.
• Completed rides and bookings: up to 2 years after trip completion.
• Cancelled rides and bookings: up to 6 months.
• In-app chat messages: up to 1 year after the associated ride is completed or cancelled.
• Account profile data: for as long as your account is active, then deleted per Section 8.

We may retain specific records beyond these periods only where required by law, or where reasonably necessary to resolve disputes, investigate safety incidents or fraud, enforce our agreements, or establish, exercise, or defend legal claims — and only for as long as that purpose requires.

We use administrative, technical, and physical safeguards designed to protect personal data, including encryption of sensitive data at rest and in transit, role-based access controls that restrict sensitive records (such as verification data) to authorized personnel, and scheduled deletion processes that enforce the retention periods above.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach of security affecting your personal data occurs, we will notify you and the relevant regulators or authorities as required by applicable law (including US state breach notification laws, Canada's PIPEDA, and the GDPR), without undue delay and within the timeframes those laws require.

If you are a resident of California or another US state with a comprehensive privacy law (such as Virginia, Colorado, Connecticut, Texas, or Utah), you have the right, subject to certain exceptions, to:

• Know / access: request disclosure of the categories and specific pieces of personal information we have collected about you, including ride and search history.
• Delete: request deletion of your personal information (see Section 8).
• Correct: request correction of inaccurate personal information.
• Portability: receive your personal information in a portable, readily usable format.
• Opt out of sale or sharing: KOMUTE does not sell personal information and does not share it for cross-context behavioural advertising. If that ever changes, we will provide the required notice and opt-out mechanisms first.
• Non-discrimination: we will not deny you service, charge different prices, or provide a different level of service because you exercised a privacy right.

You may exercise these rights by contacting privacy@komute.net. You may designate an authorized agent to submit requests on your behalf. We will verify your identity before responding and will respond within the timeframe required by your state's law (generally 45 days, extendable once where permitted).

If you are in Canada, we handle your personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws (including Quebec's Law 25). You have the right to:

• Access the personal information we hold about you and be informed of how it is used and disclosed.
• Challenge the accuracy and completeness of your information and have it corrected.
• Withdraw consent to the collection, use, or disclosure of your information, subject to legal or contractual restrictions and reasonable notice (withdrawing consent for data essential to the service may mean we can no longer provide it).
• Request deletion of your personal information as described in Section 8.
• File a complaint with the Office of the Privacy Commissioner of Canada or your provincial privacy regulator if you believe your rights have been violated.

Requests and complaints can be directed to our Privacy Officer at privacy@komute.net.

If you are in the European Economic Area, Switzerland, or the United Kingdom, we process your personal data on the following legal bases: performance of a contract (operating your account, matching trips, in-app messaging), legitimate interests (platform safety, fraud prevention, service improvement), consent (biometric verification, marketing communications, device location access), and legal obligation (responding to lawful requests, breach notification). Biometric data is processed only with your explicit consent under Article 9(2)(a) GDPR.

You have the right to:

• Access your personal data and receive a copy (Art. 15).
• Rectify inaccurate or incomplete data (Art. 16).
• Erasure ("right to be forgotten") (Art. 17).
• Restrict processing (Art. 18).
• Data portability (Art. 20).
• Object to processing based on legitimate interests, including profiling (Art. 21).
• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (Art. 7).
• Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects; where verification involves automated elements, you may request human review of an adverse decision (Art. 22).
• Lodge a complaint with your local supervisory authority (or the UK Information Commissioner's Office).

To exercise these rights, contact privacy@komute.net. We respond within one month, extendable by two further months for complex requests as the GDPR permits.

KOMUTE is operated by Indus Network LLC and your data may be stored and processed in the United States, Canada, or other countries where we or our service providers operate. Where personal data is transferred out of the EEA, UK, Switzerland, or Canada, we use lawful transfer mechanisms — such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or an adequacy decision — and require recipients to protect the data to standards consistent with this policy and applicable law.

KOMUTE is intended for adults aged 18 and over. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from a person under 18, we will delete it promptly. If you believe a minor has provided us with personal information, please contact privacy@komute.net.

We may update this policy from time to time. When material changes are made, we will notify you via email or through the app before the changes take effect, so you are aware of what we collect and how it is used. Where a change requires your consent under applicable law (for example, a new use of biometric data), we will obtain that consent before the change applies to you.

For privacy questions, requests, or complaints, contact our Privacy Officer:

• Email: privacy@komute.net
• Legal notices: legal@komute.net
• Operator: Indus Network LLC, operator of the KOMUTE platform.