InnovaRide — Privacy Policy
This Privacy Policy describes how M12 Solutions Inc. (“M12,” “we,” “us,” or “our”) collects, uses, shares, and protects personal information when you use the InnovaRide mobile application (the “App”) and any related services (collectively, the “Service”).
InnovaRide is a white-label mobility platform that connects riders (“Riders”) with independent transportation operators and drivers (“Operators”) who fulfill ride requests. Each Operator may operate under its own brand on top of the InnovaRide platform. M12 is the data controller for information you submit through the App; the Operator that fulfills your trip is an independent data controller with respect to the trips it accepts and the personal information it processes to complete those trips.
By creating an InnovaRide account or otherwise using the Service, you acknowledge the practices described in this Privacy Policy.
1. Information We Collect
1.1 Account Information
When you create an InnovaRide account, we collect:
- Email address and password (authentication is handled by Supabase Auth; passwords are stored only as a salted hash and are never visible to us in plaintext);
- First and last name;
- Mobile telephone number, used for ride coordination, verification codes, and trip-related notifications.
1.2 Location Data
The App uses your device’s precise location (via the standard iOS Geolocation API and the Capacitor Geolocation plugin) to:
- Determine your pickup point when you request a ride;
- Calculate the estimated fare, distance, and arrival time to your drop-off;
- Share your real-time location with the assigned Operator and driver during an active trip, so they can find you and complete the trip safely;
- Display your live trip on the in-app map.
We do not collect background location when the App is closed or backgrounded outside of an active trip. iOS will prompt you for permission before the App accesses your location, and you may revoke that permission at any time in Settings → Privacy & Security → Location Services. Disabling location access will prevent the App from booking or tracking trips.
1.3 Payment Information
Payments are processed by Stripe, Inc. Card numbers, expiration dates, CVCs, and full bank credentials are entered directly into Stripe’s PCI-DSS Level 1 certified payment elements. M12 does not store, transmit, or have access to your full card number or CVC on our servers. We retain only a Stripe customer identifier, a tokenized payment-method reference, the card brand (e.g., Visa), the last four digits, and the expiration month and year, so we can charge approved trips and display your saved payment methods inside the App.
1.4 Trip and Usage Data
- Pickup and drop-off addresses, the route taken, trip start and end times, distance, fare, tip, and ratings;
- Messages and ride-status events exchanged between you and the Operator through the App;
- Push notification token issued by Apple Push Notification service (APNs), used solely to deliver trip-related notifications (driver assigned, driver arriving, trip complete, receipts);
- Device and app diagnostics collected via the Capacitor App plugin: iOS version, device model, App version, locale, time zone, and crash or error logs.
2. What We Do Not Collect
We do not access your microphone, camera, contacts, calendar, photo library, or any HealthKit data. The App does not implement App Tracking Transparency tracking, does not request the IDFA, and does not share any data with third parties for cross-app advertising or behavioral profiling.
3. How We Use the Information
- Provide the Service. Authenticate you, dispatch your ride to an Operator, calculate fares, process payments, and deliver trip notifications.
- Customer support. Respond to your requests, investigate trip disputes, and resolve payment issues.
- Safety and fraud prevention. Detect abuse, suspicious payment activity, and violations of our Terms of Service.
- Service quality. Aggregate, anonymous analytics to monitor App stability and improve product features.
- Legal compliance. Comply with tax, accounting, transportation, and consumer-protection laws applicable in Massachusetts and the jurisdictions where Operators run.
4. How We Share Information
We share personal information only as needed to operate the Service, and only with the following categories of recipients:
- Operators and drivers. When you request a ride, we share your name, phone number, pickup and drop-off locations, and live trip location with the Operator and the assigned driver, so they can complete the trip. Operators are contractually required to use this information solely to fulfill your ride request.
- Stripe, Inc. — payment processing, payout management, and fraud detection. Stripe’s handling of card data is governed by the Stripe Privacy Policy.
- Supabase, Inc. — managed database, authentication, and storage infrastructure used to host the InnovaRide backend. Data is encrypted in transit and at rest.
- Apple Inc. — Apple Push Notification service (APNs) for delivering push notifications to your device.
- Legal recipients. Courts, regulators, or law-enforcement agencies, when we are legally required to disclose information by a valid subpoena, court order, or applicable law.
- Corporate successors. In the event of a merger, acquisition, or sale of substantially all of M12’s assets, personal information may be transferred to the acquirer, subject to this Privacy Policy.
5. Data Retention
We retain your account information and trip history for as long as your InnovaRide account remains active, so you can review past trips and receipts. If you delete your account, we will delete or irreversibly anonymize your personal information within 30 days, except for records we are legally required to retain (for example, payment, tax, and accounting records may be kept for up to seven years to comply with U.S. financial regulations).
6. Your Rights and Choices
Regardless of where you live, you may exercise the following rights with respect to your personal information:
- Access and portability. Request a copy of the personal information we hold about you, in a portable format.
- Correction. Update inaccurate or incomplete personal information directly in the App or by contacting us.
- Deletion. Request deletion of your account and associated personal information. You may also delete your account in-app from Profile → Account → Delete Account.
- Withdrawal of consent. Revoke location, notification, or marketing permissions at any time through iOS Settings or in-app settings.
If you are located in the European Economic Area or the United Kingdom, you also have rights under the General Data Protection Regulation (GDPR), including the right to object to processing, the right to restrict processing, and the right to lodge a complaint with your local supervisory authority. If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA / CPRA), including the right to know, the right to delete, the right to correct, and the right to opt out of the “sale” or “sharing” of personal information. M12 does not sell or share personal information as those terms are defined under California law.
To exercise any of these rights, email legal@m12solutions.com from the email address associated with your account. We will respond within the time frames required by applicable law (typically within 30 days).
7. Children’s Privacy
InnovaRide is intended for users aged 18 and older and is not directed to children under 13. Consistent with the Children’s Online Privacy Protection Act (COPPA), we do not knowingly collect personal information from any child under 13. If we learn that we have collected personal information from a child under 13 without verified parental consent, we will delete that information promptly. If you believe a child has provided personal information to InnovaRide, please contact legal@m12solutions.com.
8. Security
- All traffic between the App and our servers is encrypted with TLS 1.2 or higher (HTTPS only).
- Data at rest in our managed Supabase databases and storage buckets is encrypted using AES-256.
- Authentication credentials are hashed and salted; raw passwords are never logged or stored.
- Payment card data is handled exclusively by Stripe, which maintains PCI-DSS Level 1 certification — the strictest tier in the payments industry.
- Access to production systems is restricted to authorized M12 personnel through multi-factor authentication and least-privilege role controls.
No system can be guaranteed to be 100% secure. If we become aware of a security breach affecting your personal information, we will notify you and the appropriate regulators in accordance with applicable U.S. state and federal breach-notification laws.
9. International Users
InnovaRide is operated from the United States. If you access the Service from outside the United States, you understand that your personal information will be transferred to, stored, and processed in the United States, where data-protection laws may differ from those in your country of residence. Where required, we rely on appropriate transfer mechanisms (such as the European Commission’s Standard Contractual Clauses) for transfers of personal information from the EEA, the UK, or Switzerland.
10. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes to the Service, our practices, or applicable law. When we make material changes, we will: (i) update the “Last updated” date at the top of this page, (ii) post the revised policy at this URL, and (iii) notify registered users by email at the address associated with the account at least seven (7) days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the revised Privacy Policy.
11. Contact Us
For any question, request, or concern related to this Privacy Policy or your personal information, please contact:
M12 Solutions Inc.
Attn: Legal — Privacy
Commonwealth of Massachusetts, United States
Email: legal@m12solutions.com