Privacy Policy

1. Who We Are

Tebet LLC ("Shuttler," "we," "us," or "our") is a Wyoming limited liability company operating the Shuttler mobile application and website at shuttler.net. We are the data controller for personal information collected through the Service.

For privacy inquiries, contact us at support@shuttler.net.

2. Information We Collect

We collect information in the following ways:

Information you provide directly:

• Account registration details: first name, last name, email address, and phone number
• Organization details: organization name, authentication method, and stop configurations
• Payment information: processed securely through Stripe. We do not store full card numbers
• Communications: messages or emails you send to us

Information collected automatically:

• Location data: drivers share real time location while actively on a shift. Riders may share location to view nearby stops
• Usage data: pages visited, features used, buttons tapped, and time spent in the app
• Device information: device type, operating system, app version, and unique device identifiers
• Push notification tokens and device identifiers: we store your push notification token to deliver shuttle alerts to your device. Device identifiers are used solely for crash reporting and push delivery. They are never used for advertising or cross-app tracking.
• Log data: IP address, browser type, referring pages, and timestamps

Information from third parties:

• If your organization uses Single Sign On (SSO), we receive your name and email address from your identity provider

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve the Shuttler Service
• Display real time shuttle locations to riders
• Notify drivers of active stop requests
• Generate ridership analytics and operational reports for organization administrators
• Process payments and manage subscriptions
• Send transactional emails such as account verification and password resets
• Respond to support requests and inquiries
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations

4. Location Data

Location data is central to how Shuttler works. Here is exactly how we handle it:

• Drivers: Location is shared continuously while a shift is active. Location sharing stops when the driver taps "Stop Sharing" or closes the app
• Riders: Location is accessed only when the rider opens the map view. We do not track rider location in the background
• Location data is stored in Firebase Realtime Database and used solely to power live tracking features
• Historical location data is not retained beyond what is needed for operational reporting

Drivers who have an active shift may have their location collected while the app is running in the background, as long as location sharing is enabled. This is required for the live tracking feature to function reliably. Location sharing stops immediately when the driver taps "Stop Sharing" or ends their shift. Riders are never tracked in the background under any circumstances.

5. AI Assistant Data

The Rider Center and Administrator Hub include an optional AI assistant feature powered by Anthropic's Claude API. When you use this feature, your conversation messages and anonymized operational data about your organization (such as route names, stop names, and boarding summaries) are sent to Anthropic's API to generate a response.

AI conversation content is not stored on Shuttler's servers beyond the duration of your session. Anthropic does not use API data to train their models per their published API terms.

The AI assistant is entirely optional. It is never invoked automatically — it only runs when you actively send a message. You can opt out simply by not using it.

6. How We Share Your Information

We do not sell your personal information. We share information only in the following circumstances:

• Within your organization: Riders can see live bus locations. Administrators can see ridership data and driver activity for their organization only
• Service providers: We use trusted third party services to operate the platform, including Firebase (database and authentication), Stripe (payments), and Resend (email delivery). These providers process data only as directed by us
• Legal requirements: We may disclose information if required by law, court order, or to protect the safety of users or the public
• Business transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. You may request deletion of your account and associated data at any time by contacting us at support@shuttler.net.

Some information may be retained for longer periods where required by law or for legitimate business purposes such as fraud prevention.

8. Data Security

We implement industry standard security measures to protect your information, including:

• Encrypted data transmission using HTTPS
• Firebase Security Rules restricting data access by authenticated role
• Server side authentication with scoped API credentials
• Regular review of access permissions and security configurations

No method of transmission over the internet is 100% secure. We encourage you to use a strong, unique password for your account.

9. Children's Privacy

The Service is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us and we will delete it promptly.

10. Your Rights

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you
• Correction: Request that we correct inaccurate or incomplete information
• Deletion: Request that we delete your personal information
• Portability: Request a copy of your data in a portable format
• Objection: Object to certain uses of your personal information

To exercise any of these rights, contact us at support@shuttler.net. We will respond within 30 days.

To delete your account directly from the app, go to the Rider Center or Administrator Hub → My Profile → Danger Zone → Delete Account. Organization owners can delete their entire organization from Org Setup → Profile → Danger Zone → Delete Organization. Both actions permanently remove all associated data from Shuttler's systems within 30 days. This action cannot be undone.

11. Cookies and Tracking

The Shuttler website uses minimal cookies necessary for the site to function, such as session management. We do not use third party advertising cookies or tracking pixels. The mobile application does not use cookies.

12. Third Party Services

The Service integrates with the following third party providers, each with their own privacy practices:

• Google Firebase — database, authentication, and hosting
• Stripe — payment processing
• Resend — transactional email delivery
• Anthropic (Claude API) — powers the in-app AI assistant. Conversation messages and anonymized organization context (route names, stop names, user role) are sent to Anthropic's API to generate responses. Per Anthropic's API terms, this data is not used to train their models.
• Sentry — used for crash reporting and error monitoring. Collects crash data, stack traces, device type, OS version, and app version. We do not deliberately send personal identifiers to Sentry, though crash context may incidentally include them.
• Expo / Firebase Cloud Messaging — used to deliver push notifications such as shuttle alerts, boarding confirmations, and announcements. Push notification tokens are stored linked to your account and deleted when your account is deleted.

13. International Data Transfers

Shuttler is operated from the United States. If you are accessing the Service from outside the United States, your information may be transferred to and processed in the United States, where data protection laws may differ from those in your country.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the effective date at the top of this page and, where appropriate, by sending a notification through the Service. Your continued use of the Service after changes take effect constitutes your acceptance of the revised policy.