Privacy Policy

Airman2Go ("we," "our," or "us") operates a mobile ride-sharing and delivery platform designed exclusively for military communities. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and services.

Data Controller: Airman2Go is the data controller responsible for processing your personal data. For any questions regarding your data, contact us at privacy@airman2go.com.

By using Airman2Go, you also agree to our Terms of Service.

1. Information We Collect

Account Information:

• Full name, email address, and phone number
• Associated military base selection
• Profile photo (optional, uploaded by you)
• Account credentials (password stored as a secure hash, never in plain text)

Identity Verification:

• Common Access Card (CAC) confirmation for rider verification
• Driver application details: vehicle information (year, make, model, color, type), insurance status, and license confirmation
• Digital signature on liability and driver agreement forms

Location Data:

• Pickup and destination coordinates when requesting a ride or delivery
• Real-time GPS location for drivers during active rides
• Location is used for geofencing to verify service area eligibility
• Location data is only collected while the app is actively in use

Payment Information:

• Payment card details are processed and stored securely by Stripe, Inc. — we never store your full card number on our servers
• Drivers who receive payouts connect a Stripe Express account; bank details are held by Stripe, not by us
• Transaction records (amounts, dates, ride IDs) for earnings and billing history

Usage Information:

• Ride and delivery request history (pickup, destination, price, status)
• Bid and counter-offer activity between riders and drivers
• In-app chat messages exchanged during active rides
• Mutual ratings and feedback: riders rate drivers and drivers rate riders after each completed ride (1-5 stars plus optional written feedback)
• Reliability data: infraction records for cancellations, no-shows, and policy violations (used to maintain platform quality)
• Push notification tokens (Firebase Cloud Messaging) for ride alerts

Device Information:

• Device type and operating system version
• FCM token for delivering push notifications

2. How We Use Your Information

We use the information we collect to:

• Match riders with nearby available drivers through our bidding system
• Process ride and delivery payments, including platform fees and driver payouts via Stripe Connect
• Provide real-time ride status updates and enable in-app chat during active rides
• Send push notifications for ride requests, bid updates, chat messages, and status changes
• Verify that ride requests originate within or are destined for a supported service area
• Manage driver applications, approvals, and compliance documents
• Calculate and display mutual ratings and reliability scores
• Generate anonymized, aggregate statistics for platform improvement
• Detect and prevent fraud, abuse, or unauthorized access

3. Confidentiality Guarantee

Aggregate, anonymized statistics (such as total rides provided per base) may be shared for program reporting and support purposes. These never include personally identifiable information.

4. How Our Bidding System Works

Unlike traditional dispatch services, Airman2Go uses a transparent bidding system:

• Riders set an offered price when requesting a ride
• Nearby drivers can accept the offered price or submit a counter-offer
• Riders choose which bid to accept

During this process, drivers see the pickup area, destination, and offered price. Your name, phone number, and exact pickup location are only shared with the driver whose bid you accept.

5. Payment Processing & Fees

All payments are processed through Stripe, Inc., a PCI-DSS Level 1 certified payment processor.

• Airman2Go charges an 8.5% platform fee on ride transactions and a 12% fee on delivery transactions
• Riders pay via saved card at the time of ride request. Payment is authorized upfront and captured upon ride completion
• Drivers receive payouts directly to their connected Stripe Express account
• We do not store full credit card numbers, CVVs, or bank account details on our servers — all sensitive financial data is held by Stripe

6. Data Security

We implement robust technical measures to protect your personal information:

• Encryption at rest: Personally identifiable information (names, phone numbers, addresses) is encrypted using AES-256-CBC before storage in our database
• Encryption in transit: All communication between the app and our servers uses HTTPS/TLS encryption
• Secure authentication: API tokens with expiration, hashed passwords (bcrypt), rate-limited login endpoints
• Access controls: Role-based access for riders, drivers, and administrators
• Security headers: HSTS, X-Frame-Options, Content-Type-Options, and Referrer-Policy headers on all responses
• Payment security: Card data handled exclusively by Stripe (PCI-DSS Level 1)

7. Information Sharing

We do not sell, trade, or rent your personal information. We share information only in these limited circumstances:

• With your accepted driver: Name, phone number, and pickup/destination locations are shared with the driver you select to fulfill your ride
• With Stripe: Payment and payout information is processed by Stripe under their own Privacy Policy
• With Firebase (Google): Push notification tokens are processed by Firebase Cloud Messaging to deliver ride alerts
• For safety: In case of emergency or imminent threat to personal safety
• Legal requirements: If required by law, valid court order, or legal process

8. Data Retention

We retain your information for as long as necessary to provide our services:

• Account data: Until you request deletion
• Ride and delivery history: 12 months for billing records and dispute resolution
• Chat messages: Deleted 30 days after ride completion or cancellation
• Location data: Only retained during active rides; not stored after completion
• Payment records: Retained as required by financial regulations (typically 7 years for transaction records held by Stripe)
• Driver application documents: Retained while the driver account is active
• Reliability infractions: Subject to a rolling expiration window; older infractions are automatically removed

9. Your Rights

You have the right to:

• Access the personal information we hold about you (GDPR Article 15)
• Rectify inaccurate or incomplete information (Article 16)
• Erase your account and all associated data ("right to be forgotten") (Article 17)
• Restrict processing of your data in certain circumstances (Article 18)
• Data portability: receive a copy of your data in a structured, machine-readable format (Article 20)
• Object to processing based on legitimate interest (Article 21)
• Withdraw consent at any time for processing based on consent, without affecting the lawfulness of processing before withdrawal
• Opt out of non-essential push notifications via device settings
• Withdraw location permissions at any time (this will limit app functionality)
• Lodge a complaint with a supervisory authority (see Section 14)

To exercise these rights, use the Account Deletion page or contact us at privacy@airman2go.com. We will respond to data subject requests within 30 days.

10. Location Permissions

• Riders: Location is used to set your pickup point and verify you are within a supported service area
• Drivers: Location is shared with riders during active rides so they can track your approach

You can disable location permissions at any time through your device settings. Without location access, you will not be able to request rides or accept ride requests.

11. Push Notifications

We use Firebase Cloud Messaging (FCM) to send notifications for:

• New ride requests near your location (drivers)
• Bid and counter-offer updates
• Ride status changes (accepted, driver arrived, in progress, completed)
• New chat messages during active rides

You can manage notification preferences in your device settings.

12. Third-Party Services

Airman2Go integrates with the following third-party services, each governed by their own privacy policies:

• Stripe, Inc. — Payment processing and driver payouts
• Firebase / Google Cloud — Push notifications
• Mapbox — Map tiles and routing (with OpenStreetMap fallback)

13. Children's Privacy

Airman2Go is intended for active-duty military members, dependents, and authorized personnel who are 18 years of age or older. We do not knowingly collect information from individuals under 18.

14. GDPR Compliance & Legal Basis for Processing

Airman2Go operates at military installations in the European Union (including Germany) and complies with the General Data Protection Regulation (EU) 2016/679 ("GDPR"). We process your personal data under the following legal bases:

• Contractual necessity (Article 6(1)(b)): Processing your name, location, and payment data is necessary to provide the ride-sharing service you have requested
• Legitimate interest (Article 6(1)(f)): Fraud prevention, platform security, aggregate analytics, and maintaining the reliability/rating systems serve our legitimate interest in operating a safe and functional platform
• Consent (Article 6(1)(a)): Marketing communications and non-essential data collection require your explicit consent, which you may withdraw at any time
• Legal obligation (Article 6(1)(c)): Retention of financial transaction records as required by applicable tax and financial regulations

Automated Decision-Making: Our platform uses automated processes for ride matching (matching riders with nearby drivers based on location), reliability scoring (calculating infraction points that may lead to automatic suspension), and rating calculations (averaging ride ratings). These automated decisions may affect your ability to use the platform. You have the right to request human review of any automated decision that significantly affects you by contacting privacy@airman2go.com.

Supervisory Authority: If you are located in the EU and believe your data protection rights have been violated, you have the right to lodge a complaint with your local data protection authority. For Germany, the relevant authority is the Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI) or your state-level data protection authority (e.g., LfDI Rheinland-Pfalz for the Spangdahlem area).

15. International Data Transfers

Airman2Go's servers are located in the United States. If you use our services from the European Economic Area (EEA), your personal data is transferred to the United States for processing.

We safeguard these transfers through:

• Standard Contractual Clauses (SCCs) approved by the European Commission, which provide contractual guarantees for the protection of your data
• EU-US Data Privacy Framework where applicable to our service providers (including Stripe and Google/Firebase)
• Technical measures including encryption in transit (TLS) and at rest (AES-256-CBC) to protect data regardless of location

By using our services, you acknowledge and consent to the transfer of your data to the United States under these safeguards.

16. Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms:

• We will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR Article 33
• If the breach is likely to result in a high risk to your rights, we will notify you directly without undue delay (Article 34)
• Notifications will include the nature of the breach, likely consequences, and measures taken to address it

17. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will post the updated policy on this page and notify you via push notification or email. Where required by GDPR, we will obtain fresh consent for any new processing activities that require it.