Privacy Policy

1. Two kinds of information

Account information: when someone signs up to use the app for their company, we hold their name, email address, password (stored only as a one-way hash), two-step login settings, and which company they belong to. We are responsible for this information.

Company information: everything a company puts into the app about its riders, drivers and rides, such as names, phone numbers, email addresses, pickup and drop-off addresses, flight numbers, ride notes, prices, invoices and reviews. The company is responsible for this information; we hold and process it only on the company's behalf and on its instructions.

2. What else the app records

Payments: card details are entered on Stripe's pages and never reach us. When a rider saves a card for a ride, we keep Stripe's reference to it and a label such as "Visa ending 4242", so the company can charge agreed extras.

Driver location: while a driver has an active trip open on their phone link, the phone shares its position so the company can see the car on its map. Only the last known position is kept.

Security: to stop automated abuse we check visitors with Cloudflare Turnstile and count requests per visitor. The visitor's IP address is stored only in a scrambled (hashed) form for this. Our hosting provider keeps short-lived server logs.

Cookies: the app uses only the cookies needed to keep you signed in. There's no advertising and no third-party analytics.

3. How we use it

To run the app: showing a company its own data, sending the emails and notifications the company switches on (booking confirmations, reminders, review requests, run sheets), taking payments, and billing companies for their plan. To keep it secure and fix problems. To answer support requests. We don't sell personal information, and we don't use it for advertising.

4. Who we share it with

Only the service providers that run parts of the app for us, each bound to protect the information and use it only for that purpose: Supabase (database and sign-in), Vercel (hosting), Stripe (payments and plan billing), Resend (email), Cloudflare (the human check on public forms) and AeroDataBox via RapidAPI (flight status; only the flight number and date are sent). Maps load images from OpenStreetMap, which sees the viewer's IP address. Push notifications go through the browser maker's push service. We'll update this list before adding a provider.

We may also disclose information when the law requires it, or to protect someone's safety.

5. How long we keep it

We keep a company's information while its account is open. When a company closes its account and asks us to, we delete its information within 30 days; backups are overwritten on their normal cycle. We keep billing records as long as tax law requires. Riders who want their information removed should ask the company they rode with, or write to contact@rafinitylimoservice.com and we'll pass the request on.

6. Security

Information travels encrypted, each company's data is kept separate from every other company's by the database itself, everyone can turn on two-step login, and the database is backed up daily. If a breach affects personal information, we'll notify the companies affected, and the people and authorities the law requires, without undue delay.

7. Your choices and rights

You can ask to see, correct or delete the personal information we hold about you, and we won't treat you differently for asking. Account holders can change most details in the app. For anything else, write to contact@rafinitylimoservice.com. If the information belongs to a company's records, we'll forward your request to that company.

The app is for businesses: accounts are only for people 18 or older, and it isn't meant for children under 13. If we learn that a child under 13 has given us personal information, we delete it.

8. Changes and contact

If we change this policy in a way that matters, we'll update the date above and email account owners. Questions: contact@rafinitylimoservice.com.