BACKPASS PRIVACY POLICY BETA

2. DATA MINIMIZATION PRINCIPLE

We are committed to collecting only the minimum data necessary to provide our services. We do not use analytics SDKs, advertising identifiers (IDFA), or tracking technologies.

3. INFORMATION WE COLLECT

3.1 Information You Provide Directly

• Account Information: Name, email address, phone number (via Firebase Authentication)
• Profile Information: Travel preferences, optional Venmo username
• Travel Documents: Passport photos (for journey verification)
• Journey Information: Travel dates, destinations, accommodation selections
• Communications: Support requests, feedback

3.2 Information Collected Automatically

• Device Information: Device model, iOS version, app version
• Usage Information: Features used, session duration (no tracking analytics)
• Push Notifications: Device tokens for service notifications

3.4 iOS Permissions

Our app requests the following permissions:

• Camera: To capture passport photos for journey verification
• Photo Library: To upload existing passport photos
• Notifications: To send booking confirmations and updates

4. HOW WE USE YOUR INFORMATION

4.1 Primary Uses

• Process journey purchases and payments
• Facilitate accommodation bookings
• Send booking confirmations and updates
• Provide customer support
• Improve Service functionality

4.2 Legal Basis for Processing

We process your data based on:

• Contract Performance: To provide services you've requested
• Consent: For optional features like push notifications
• Legitimate Interests: For service improvement and security

5. DATA SHARING

5.1 Service Providers

We share limited data with:

• Stripe: Payment processing (PCI-compliant)
• Firebase (Google): Secure infrastructure and authentication
• Accommodations: Booking information only

5.3 Legal Requirements

We may disclose information when required by law or to protect rights and safety.

6. DATA STORAGE AND SECURITY

6.1 Storage

• Data stored on Firebase/Google Cloud servers
• Encrypted in transit (TLS/HTTPS)
• Access controls and authentication implemented

6.2 Retention

• Account data: Retained while account is active
• Transaction data: 7 years for legal/tax requirements
• Deleted account data: Removed within 30 days of request

7. YOUR PRIVACY RIGHTS

7.1 You Have the Right To:

• Access: Request a copy of your personal data
• Correction: Update incorrect information
• Deletion: Request account and data deletion (completed within 30 days)
• Portability: Receive your data in a portable format
• Opt-out: Disable push notifications in iOS Settings

7.2 Exercising Your Rights

Email matthew@backpass.co with your request. We respond within 30 days.

8. APPLE APP STORE PRIVACY

8.1 Privacy Nutrition Labels

8.2 iOS-Specific Features

• Push notifications can be disabled in Settings
• Camera/Photo access can be revoked in Settings
• No tracking across apps or websites

9. CHILDREN'S PRIVACY

BackPass is not intended for users under 18. We do not knowingly collect information from children. If we discover data from a user under 18, we delete it immediately.

10. INTERNATIONAL DATA TRANSFERS

Your information may be processed in countries with different data protection laws. We ensure appropriate safeguards are in place for any transfers.

11. CALIFORNIA PRIVACY RIGHTS (CCPA)

California residents have additional rights:

• Right to know what information is collected
• Right to delete personal information
• Right to opt-out of sale (we don't sell data)
• Right to non-discrimination

12. EUROPEAN PRIVACY RIGHTS (GDPR)

EU residents have additional rights:

• Right to object to processing
• Right to restriction of processing
• Right to lodge complaints with supervisory authorities
• Clear legal basis for all processing

13. THIRD-PARTY SERVICES

13.1 Payment Processing

Stripe handles payments securely. See: https://stripe.com/privacy

13.2 Infrastructure

Firebase provides secure infrastructure. See: https://firebase.google.com/support/privacy

14. DATA BREACH NOTIFICATION

If a breach affects your personal information:

• We will notify affected users within 72 hours
• Notification via email and in-app message
• Details about affected data and our response

15. CHANGES TO THIS POLICY

We may update this Privacy Policy. Material changes will be notified via email or app notification. Continued use after changes constitutes acceptance.

17. BETA PROGRAM NOTICE

During beta:

• We're actively improving security measures
• Features and data practices may evolve
• Your feedback helps us enhance privacy protections