1. Information We Collect

We collect information you provide directly to us when using our services, including:

• Name and contact information (email, phone number)
• Booking details (pickup/drop-off locations, dates, times)
• Payment information (processed securely by Stripe)
• Communication preferences and correspondence with us

We also collect some information automatically when you visit our website. See "Cookies and Tracking" below.

2. Payment Information Security

We never see or store your full card number. Payments are processed by Stripe, a PCI-DSS Level 1 certified payment processor; your card details go directly to Stripe.

When you pay for a reservation or add a card for it, Stripe saves that card to your customer record with Stripe, and we see only the card brand and last four digits. We use a saved card only for your reservation:

• a refundable authorization two days before departure, released after the trip, and
• charges for what can come up on the day: extra time beyond your reserved hours, cleaning, or damage.

3. How We Use Your Information

We use the information we collect to:

• Process your bookings and payments
• Send transaction confirmations and receipts
• Communicate with you about your bookings and services
• Coordinate with transportation providers on your behalf
• Improve our services and customer experience
• Respond to your inquiries and support requests
• Comply with legal obligations

4. Information Sharing

We do not sell or rent your personal information. We share it only with:

• Transportation providers, to run your trip
• Stripe, to process payments
• Google Ads and Microsoft Ads, to measure which ads lead to inquiries and bookings, and to use a list of our past customers in our ads (see "Cookies and Tracking")
• Companies that run parts of our business for us: our website security and hosting provider, email provider, text-message provider, phone provider, transcription and AI-assistant provider (call transcripts, our automated phone assistant, and help drafting replies), and IP location lookup services that tell us the approximate city and network of an IP address
• Legal authorities, when the law requires it

5. Data Security

We implement industry-standard security measures to protect your personal information, including:

• 256-bit SSL encryption for all data transmission
• Encrypted off-site backups
• Regular security audits and updates
• Access controls and authentication measures

6. Cookies and Tracking

Our cookies.

• _rt_attr remembers which ad, link or campaign first brought you to our site. It lasts 90 days.
• __Host-rtv is a random ID that lets us recognize your browser when you come back, even from a different network. It lasts 400 days and contains nothing about you.

Cookies set by services we use.

• Stripe sets fraud-prevention cookies (__stripe_mid, which lasts 1 year, and __stripe_sid, which lasts 30 minutes) on pages where you pay or add a card.
• Our chat window runs on our own chat server and sets a cookie (cw_user_…, lasts 1 year) when it loads, so a conversation can continue if you come back.
• Our website security provider, which protects our site from bots, may set a security cookie (cf_clearance, lasts 1 year) on some pages, such as payment pages.

We do not use advertising cookies or tracking pixels from Google, Microsoft, Meta or anyone else.

What we record when you visit. For each visit we record your IP address, your browser type, the pages you view, and the website or ad that sent you (including ad click IDs). We also record basic device settings: time zone, language and screen size. We use your IP address to look up your approximate city and internet provider. Our website security provider also measures how fast our pages load, without cookies.

When a visit is connected to you.Visit records don't carry your name. We connect them to you when you send us a form on our site.

Ads and customer lists. When an inquiry or booking comes from an ad, we tell Google Ads or Microsoft Ads the ad click ID and the time. If there is no click ID, we send your email address and phone number in hashed form instead. We also upload hashed email addresses (and, for Google, phone numbers) of past customers to Google and Microsoft as a customer list for our ads. Hashing is a one-way scramble: the ad platforms can match it to their own users, but they cannot read it. We never send your name, trip details, prices or payment amounts.

Your choices.You can clear or block cookies in your browser settings at any time. Our site works without them; we just won't remember which ad or link first brought you, or recognize your browser when you come back. To ask us to delete visit records connected to you, or to be removed from our customer lists, call us at (800) 901-5101 or, if you have a booking with us, write to the dedicated email address of your booking, provided in your booking confirmation.

7. Phone Calls, Texts and Chat

Calls. We record calls to our phone numbers. Recordings are stored by our phone provider, not on our own servers. Each recording is turned into a written transcript so our team can get your trip details and prices right. Transcripts are deleted after 180 days; a short summary stays with your booking record. Some of our lines are answered by an automated assistant. It tells you at the start of the call that it is automated and that the call is recorded.

Texts and chat. When you text us or use our website chat, we keep those messages with your inquiry or booking so our team can follow up.

8. Your Rights

You have the right to:

• Access your personal information we hold
• Request correction of inaccurate information
• Request deletion of your personal information
• Opt-out of marketing communications
• Receive a copy of your data in a portable format

To exercise these rights, call us at (800) 901-5101 or, if you have a booking with us, write to the dedicated email address of your booking, provided in your booking confirmation.

9. Data Retention

We keep booking, payment and message records as long as we need them to run our business and meet legal and tax rules. Specific limits:

• Call transcripts are deleted after 180 days. We do not store call audio on our servers.
• Security and website request logs are kept for 90 days.
• Visit records (pages viewed, IP address and browser details) are deleted after 25 months. Visits connected to a paid booking are kept as long as that booking's records.

10. Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date.

12. Contact Us

For questions about this Privacy Policy or our data practices, please contact us at:

• Phone: (800) 901-5101
• Existing bookings: in writing to the dedicated email address of your booking, provided in your booking confirmation
• Website: busbie.co