CROWDCAR PRIVACY POLICY

Effective Date: May 21, 2026

This Privacy Policy explains what information CrowdCar LLC ("CrowdCar") collects from Users of the CrowdCar mobile application and related services (the "Platform"), how that information is used, who it is shared with, how long it is retained, and what rights Users have over their own data.

Capitalized terms used but not defined here have the meanings assigned in the CrowdCar Terms & Conditions, which are incorporated by reference.

By creating an account or using the Platform, you agree to the practices described in this Privacy Policy.

1. About This Policy

This Policy applies to all Users, including Drivers and Riders, who access or use the Platform. It covers personal information collected through the Platform's mobile application. This Policy does not cover the privacy practices of Third-Party Services integrated with the Platform, including Stripe, Google Maps, Mapbox, and Persona. Each of those services operates under its own privacy policy, and CrowdCar does not control how those services collect or use personal information once it is transmitted to them.

CrowdCar does not sell user data. This Policy is designed to comply with applicable federal privacy laws and the laws of the State of Ohio, including the Ohio Data Protection Act and the Ohio breach notification statute.

2. Definitions

For purposes of this Policy, the following terms have the meanings set forth below. Capitalized terms used but not defined here have the meanings assigned in the CrowdCar Terms & Conditions.

"User" means any individual who accesses or uses the Platform, whether as a Driver, Rider, or account holder.

"Driver" means a User who posts a Trip and offers Seats to other Users.

"Rider" means a User who books a Seat on a Trip posted by a Driver.

"Trip" means a ride offered through the Platform by a Driver. During the current trial phase, a Trip must start, end, and take place within the State of Ohio.

"Personal Information" means any information that identifies, relates to, or could reasonably be linked with a particular User or household, including Sensitive Personal Information as defined below.

"Sensitive Personal Information" means Social Security numbers, government-issued identification numbers, financial account information, and any other category of information treated as sensitive under applicable federal or state law.

"Precise Location Data" means GPS-level location data accurate to within approximately 1,850 feet or less, as that term is used under applicable state privacy laws.

"Platform" has the meaning given in the introduction to this Policy.

"Third-Party Services" means the third-party products and services integrated with the Platform, including Stripe, Google Maps, Mapbox, Persona, and Firebase.

3. Eligibility

All Users must be 18 years of age or older. A Rider may book a Trip only for the Rider or for another individual who is 18 or older.

A Driver must meet all of the following requirements at the time of posting and operating a Trip:

Hold a valid United States driver's license.
Own the vehicle offered on the Trip or operate it with the express permission of the owner.
Serve as the primary driver of the vehicle during the Trip.
Maintain valid third-party liability insurance covering the vehicle.
Have no medical or other restriction that would prevent safe operation of the vehicle.
Offer only a standard touring vehicle with no more than seven seats.
Not post duplicate Trip listings for the same journey.
Offer only the number of seats physically available in the vehicle, each equipped with a working seatbelt.
Maintain the vehicle in safe and legal condition, including current registration and inspection as required by Ohio law.
Act as a consumer and not as a professional transportation service provider.

4. Information CrowdCar Collects

(a) Information You Provide Directly

When you register for an account or use the Platform, CrowdCar collects:

Registration data: name, email address, and phone number.
Profile data: any information you choose to add to your account profile.
Trip posting data (Drivers only): origin, destination, trip date and time, number of Seats offered, Trip Price, and vehicle information.
Booking data (Riders only): trip selection, Booking confirmation, and any information required to complete a Booking.
In-app messages: Content you send to other Users through the Platform's messaging feature.
Support communications: information you provide when contacting CrowdCar for support.

(b) Information Collected Automatically

When you use the Platform, CrowdCar and its service providers automatically collect:

Device identifiers: device type, operating system version, and unique device identifiers.
App usage data: features accessed, pages viewed, session duration, and interaction logs.
Approximate location data: city-level or coarse location used to display available Trips in your area and to power map rendering through Google Maps and Mapbox.
Precise location data: GPS-level location collected only during an active Trip and only when the User has granted location permission. Precise location is collected while the Platform is in the foreground and continues to be collected for the duration of the active Trip if the Platform moves to the background or the User exits the app. The Platform displays a persistent notification while background collection is active, and the User can stop background collection at any time by tapping the notification or by changing device location settings.

(c) Information Received from Third Parties

CrowdCar receives limited information from the following Third-Party Services:

Persona: a “pass or fail” identity verification result only. CrowdCar does not receive, store, or review the underlying identity documents or biometric data submitted to Persona.
Stripe: a payment confirmation and transaction identifier only. CrowdCar does not receive or store payment card numbers or financial account details.

5. How CrowdCar Uses Your Information

CrowdCar uses collected information for the following purposes:

To create and maintain your account.
To display available Trips to Riders and allow Drivers to post Trips.
To process Bookings and facilitate communication between Drivers and Riders.
To process payments and issue Driver payouts through Stripe.
To verify User identity through Persona.
To provide map and navigation functionality through Google Maps and Mapbox.
To monitor Platform activity for safety, fraud prevention, and compliance.
To respond to support requests.
To enforce the Terms & Conditions and this Privacy Policy.
To comply with applicable law and respond to valid legal process.
To send Platform-related notices, including updates to these policies.

CROWDCAR DOES NOT USE PERSONAL INFORMATION FOR ADVERTISING AND DOES NOT SHARE PERSONAL INFORMATION WITH ADVERTISERS.

6. Information Shared with Third Parties

CrowdCar does not sell, rent, or trade User personal information to any third party for any purpose. CrowdCar shares User information only as described below.

6.1 Named Third-Party Service Providers

Stripe: CrowdCar transmits transaction data to Stripe to process Rider payments and issue Driver payouts. Stripe receives the information necessary to complete the transaction. CrowdCar does not store payment card numbers. Stripe's privacy policy governs Stripe's handling of this data.

Google Maps and Mapbox: CrowdCar transmits general location data to Google Maps and Mapbox to render maps and navigation features within the Platform. Each service's privacy policy governs its handling of location data.

Persona: Users submit identity information directly to Persona during the verification process. Persona returns only a “pass or fail” result to CrowdCar. Persona's privacy policy governs its handling of identity and biometric data.

6.2 Other Permitted Disclosures

CrowdCar may also disclose User information in the following circumstances:

To other Users, to the extent necessary to facilitate a Trip. For example, a Rider's first name and profile photo may be visible to the Driver for a confirmed Booking, and vice versa.
To comply with a valid court order, subpoena, or other legal process. Before complying with a government or law enforcement request, CrowdCar will review the request for legal sufficiency, limit disclosure to what is specifically required, and notify the affected User where legally permitted to do so.
To protect the rights, property, or safety of CrowdCar, Users, or the public, where disclosure is necessary to prevent imminent harm.
To a successor entity in connection with a merger, acquisition, or sale of substantially all of CrowdCar's assets, in which case Users will be notified.

CROWDCAR DOES NOT SELL USER PERSONAL INFORMATION TO ANY THIRD PARTY FOR ANY PURPOSE.

7. Sensitive Personal Information

Certain information CrowdCar handles is treated with heightened care because federal or state law, or industry practice, treats it as sensitive:

Social Security numbers and government-issued identification numbers, submitted by Drivers to Persona for identity verification. CrowdCar does not receive or store these numbers. Persona returns only a “pass or fail” verification result.
Financial account information, including bank account and routing numbers for Driver payouts and payment card information for Rider transactions. This information is collected and stored by Stripe under its own security and compliance program. CrowdCar does not receive or store full account numbers or card numbers.
Government-issued photo identification, submitted to Persona for verification. Persona retains the underlying image. CrowdCar does not receive or store the image.
Precise Location Data, collected from Drivers and Riders during an active Trip for routing, matching, in-app navigation, and safety purposes. CrowdCar does not sell Precise Location Data and does not share Precise Location Data for advertising or marketing.

CrowdCar uses Sensitive Personal Information solely for the purposes described in this Policy, including identity verification, payment processing, fraud prevention, and compliance with applicable law. CrowdCar does not sell Sensitive Personal Information and does not share it for marketing or advertising purposes.

8. Driver-Specific Data

In addition to standard account information, Drivers provide the following vehicle data when posting a Trip:

Vehicle make, model, and year.
License plate number.

This vehicle data is collected solely to support the Trip posting and to allow Riders to identify the vehicle. CrowdCar retains vehicle data only for the duration of the Trip lifecycle: from the time a Trip is posted through approximately 24 hours after the Trip's scheduled completion date. After that window closes, CrowdCar deletes the vehicle data associated with that Trip.

CrowdCar does not collect, verify, or retain Driver insurance information, driving records, or criminal history. Identity verification is limited to the basic "pass or fail" result received from Persona.

9. Rider-Specific Data

Riders provide Booking data when reserving a Seat, including trip selection and any information required to complete the Booking. CrowdCar retains Booking records for a reasonable period after the Trip completes for dispute resolution and compliance purposes.

Rider payment data is handled entirely by Stripe. CrowdCar does not store, view, or have access to Rider payment card information.

10. In-App Messaging and Communications Data

The Platform includes in-app messaging that allows Drivers and Riders to communicate about Trips. CrowdCar stores message content only as long as necessary to deliver messages and for a reasonable period after delivery to support dispute resolution if a User reports a problem.

CrowdCar does not read message content in the ordinary course of operating the Platform. CrowdCar may access message content in the following circumstances:

In response to a valid court order, subpoena, or other legal process under the Stored Communications Act, 18 U.S.C. Section 2701 et seq.
When a User reports a safety concern or a potential violation of the Terms & Conditions that requires review of message content to investigate.

CrowdCar is not the author, publisher, or distributor of messages exchanged between Users. CrowdCar's role is limited to providing the technical infrastructure that enables User-to-User communication.

CrowdCar is not treated as the publisher or speaker of any User-generated message content and is not liable for the content of messages exchanged through the Platform.

11. Location Data

CrowdCar and its map vendors, Google Maps and Mapbox, receive general location data to power Trip search and map rendering within the Platform. This includes approximate location used to identify nearby Trips and to display maps within the app.

During an active Trip, the Platform collects precise GPS-level location data from the Driver and from any Rider who has booked a Seat on that Trip. CrowdCar uses precise location to route the Driver, match Riders to nearby Trips, support in-app navigation, and respond to safety incidents. Precise location collection begins when the Trip becomes active and ends when the Trip completes or is canceled.

Precise location is collected while the Platform is in the foreground. Collection also continues in the background during an active Trip if the User exits the app or the app moves to the background. The Platform displays a persistent system notification whenever background location collection is active. The User can stop background collection at any time by tapping the notification or by changing device location permissions. Stopping background collection during an active Trip may interrupt routing, matching, and safety features for that Trip.

Location data shared with Google Maps and Mapbox is governed by each provider's respective privacy policy.

You can limit location sharing through your device's location settings. You can also stop background location collection during an active Trip at any time by tapping the persistent notification displayed by the Platform. Doing so may affect the Platform's ability to display relevant Trip results or render maps.

Do Not Track Signals. Some browsers and devices transmit "Do Not Track" or similar signals. The Platform does not respond to those signals because CrowdCar does not engage in cross-site or cross-app behavioral tracking of Users.

Third-Party Tracking. CrowdCar does not allow third parties to collect personal information about an individual User's online activities over time and across different websites or online services through the Platform. Google Maps, Mapbox, Stripe, and Persona receive only the data described in this Policy and only for the purposes described.

12. Payment Data

All payments on the Platform are processed by Stripe. When you submit payment information, it is transmitted directly to Stripe through Stripe's secure infrastructure. CrowdCar never receives, stores, or has access to your payment card number, bank account details, or any other financial account information.

CrowdCar retains transaction records, including the amount, date, and Stripe transaction identifier, for as long as required by applicable accounting and tax law. These records do not include payment card data.

13. Identity Verification Data

CrowdCar uses Persona to perform basic identity verification. When you complete the verification process, you submit identity information, including identity documents and potentially biometric data, directly to Persona through Persona's own platform. CrowdCar does not receive, store, review, or have access to those documents or biometric data.

CrowdCar receives only a “pass or fail” result from Persona confirming whether verification was completed. Persona's privacy policy, available at withpersona.com, governs Persona's collection, use, and retention of identity and biometric data.

This structure means CrowdCar does not qualify as a collector or processor of biometric data under applicable state biometric privacy laws. Users with questions about Persona's data practices should contact Persona directly.

14. Data Retention

CrowdCar retains personal information for the following periods:

Account data: retained for as long as the account is active. After account closure, account data is retained for an additional period of up to 84 months (7 years) to comply with legal obligations, resolve disputes, and enforce agreements. Sensitive Personal Information held outside of CrowdCar's systems by Persona or Stripe is retained under each vendor's own retention schedule.
Vehicle data: retained from the time a Trip is posted through approximately 24 hours after the Trip's scheduled completion, then deleted.
Message data: retained for a reasonable period after delivery for dispute resolution purposes, then deleted.
Transaction records: retained for as long as required by applicable accounting, tax, and financial recordkeeping law.
Booking records: retained for a reasonable period after the Trip completes for dispute resolution and compliance purposes.

Users may request deletion of their personal information. Deletion requests are subject to legal retention requirements that may require CrowdCar to retain certain records notwithstanding a deletion request.

15. How CrowdCar Protects Your Information

CrowdCar uses commercially reasonable technical and organizational measures to protect User personal information from unauthorized access, disclosure, alteration, or destruction. CrowdCar's information security program is designed to align with widely recognized industry frameworks for privacy and cybersecurity, including the framework published by the National Institute of Standards and Technology (NIST). These measures include encrypted data transmission, access controls, and vendor security requirements.

No method of electronic storage or transmission is 100% secure. CrowdCar cannot guarantee the absolute security of User data. If CrowdCar becomes aware of a breach of the security of User personal information, CrowdCar will notify affected Users in the most expedient time possible and without unreasonable delay, and in any event no later than 45 days following discovery of the breach. If the breach affects more than 1,000 Ohio residents, CrowdCar will also notify the Ohio Attorney General and the major consumer reporting agencies as required by that statute. Notice may be delayed at the documented request of law enforcement if notice would impede a criminal investigation.

16. Your Privacy Rights

16.1 All Users

All Users may:

Access and update their account information at any time through the Platform.
Request deletion of their account and associated personal information by contacting CrowdCar at privacy@crowdcarapp.com.
Opt out of non-essential communications by following the unsubscribe instructions in any such communication.

16.2 Ohio Residents

CrowdCar is based in Ohio. Ohio residents may ask CrowdCar to provide a copy of, correct, or delete the personal information CrowdCar holds about them by sending a request to privacy@crowdcarapp.com. CrowdCar will respond within a reasonable time.

17. Tracking Technologies

The Platform uses the following technologies in connection with operating the application:

Local storage and session identifiers maintained by Firebase Authentication to keep Users signed in across sessions.
Firebase Analytics, which records aggregated usage data such as session length, screen views, and crash reports. Firebase Analytics does not receive your name, email address, or phone number.
Mapbox SDK, which receives approximate location and map view requests during Trips to render maps and routing.
Google Maps SDK, which receives address and location data submitted in connection with posting or booking a Trip.

The Platform does not use third-party advertising cookies and does not participate in cross-context behavioral advertising. CrowdCar does not allow third parties to track User activity across other websites or applications through the Platform. Section 11 explains how the Platform responds to "Do Not Track" signals and similar controls.

18. Children's Privacy

The Platform is restricted to Users who are 18 years of age or older, as stated in the Terms & Conditions. CrowdCar does not target the Platform to children, does not market the Platform to children, and does not knowingly collect personal information from anyone under the age of 18.
CrowdCar does not knowingly collect personal information from children under the age of 13.
CrowdCar will not knowingly collect, use, or disclose personal information from a child under 13 without verifiable parental consent. Because the Platform is restricted to Users 18 and older, CrowdCar does not seek that consent and does not permit children under 13 to register, post Trips, book Seats, or use any feature of the Platform.
If CrowdCar learns or has a reasonable basis to believe that a User is under 18, CrowdCar will promptly suspend the account, investigate, and, if the User is confirmed to be under 18, terminate the account and delete any personal information associated with that account from CrowdCar's active systems within 30 days. CrowdCar will also instruct its Third-Party Service providers to delete personal information about the affected User from their systems where they hold information on CrowdCar's behalf.
Parents or guardians who believe a child under 18 has registered for or used the Platform may contact CrowdCar at privacy@crowdcarapp.com to request review, account termination, and deletion of any personal information collected from the child. CrowdCar will verify the request before acting on it and will respond in the most expedient time possible.

19. Changes to This Policy

CrowdCar reserves the right to update this Privacy Policy at any time. For material changes, CrowdCar will provide at least fourteen (14) days' advance notice via email or a prominent notice on the Platform before the change takes effect. The updated Policy will be posted with a revised effective date.

Continued use of the Platform after a revised Policy takes effect constitutes acceptance of the revised terms.

20. Ohio-Only Trial Restriction

The Platform is operating in a trial phase limited to the State of Ohio. During the trial phase, every Trip must start, end, and take place entirely within Ohio. Drivers are responsible for confirming that each Trip posted on the Platform satisfies this restriction.

Users accessing the Platform from outside the United States do so on their own initiative and are responsible for compliance with the laws of their jurisdiction. CrowdCar makes no representation that the Platform is appropriate for use outside the United States.

21. Contact Information

For questions about this Privacy Policy or to submit a privacy rights request, contact CrowdCar at:

CrowdCar LLC

Email: privacy@crowdcarapp.com

Website: www.crowdcarapp.com

Last Updated: May 22, 2026