Privacy Policy

1. Information We Collect

1.1 Information You Provide Directly

When you create an account or use our Services, we may collect the following information:

• Account Information: First name, last name, email address, phone number, and password (stored as a one-way cryptographic hash — we never store your plaintext password).
• Business Information: Company name, company slug (used for branding purposes), and subscription plan selection.
• Trip Information: Customer names, email addresses, phone numbers, pickup and dropoff locations, trip dates and times, passenger counts, mileage, fare amounts, and trip notes.
• Expense Information: Vendor names, amounts, dates, categories, notes, and receipt images.
• Invoice Information: Customer names, email addresses, line item descriptions, amounts, and optional notes.
• Payment Information: We do not directly collect or store credit card numbers, bank account details, or other financial account information. All payment processing is handled by Stripe, Inc. (see Section 4).

1.2 Information Collected Automatically

When you use our Services, we may automatically collect:

• Device Information: Device type, operating system version, and unique device identifiers (for push notification delivery only).
• Push Notification Tokens: Expo push notification tokens used solely to deliver notifications to your device.
• Usage Data: We do not use third-party analytics services. The only usage data displayed is your own personal dashboard (earnings, trip counts, expense totals), which is derived from the data you enter into the App and is visible only to you.

1.3 Information from Third-Party Services

When you use certain features, third-party services may process data on our behalf:

• Google Places API: When you search for pickup or dropoff addresses, your search queries are sent to Google to provide address autocomplete and distance calculations. Google's privacy policy governs this data.
• Google Gemini AI: When you use the receipt scanning feature, your receipt image is sent to Google's Gemini AI service for text extraction (vendor, amount, date, category). The image is processed in real time and is not stored by us beyond what you save as an expense record.
• Stripe: When you set up payment processing or pay an invoice, Stripe collects and processes payment information directly. We receive only transaction identifiers, payment status, and payout information — never full card numbers.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Provide and maintain the Services: Create and manage your account, process trips, track expenses, generate and send invoices, and facilitate payments.
• Communicate with you: Send transactional emails (welcome emails, invoice emails, booking confirmations, password reset codes) and push notifications (new trip requests, payment confirmations, subscription updates).
• Process payments: Facilitate payment processing and payouts through Stripe Connect.
• Improve our Services: Diagnose technical issues and improve the reliability and performance of our Services.
• Comply with legal obligations: Respond to legal requests and prevent fraud or abuse.

We do not use your information for:

• Advertising or marketing to third parties
• Selling or renting your personal information
• Behavioral tracking or profiling
• Automated decision-making that produces legal effects

3. How We Share Your Information

We do not sell, rent, or trade your personal information. We may share your information only in the following circumstances:

3.1 With Your Customers

When you send an invoice or booking confirmation through the App, the recipient (your customer) will receive an email containing the information you provided: their name, trip details, line items, amounts, and your business name and reply-to email address. You are responsible for ensuring you have the right to share your customers' information through our Services.

3.2 With Service Providers

We use the following third-party service providers who process data on our behalf under contractual obligations to protect your information:

3.3 For Legal Reasons

We may disclose your information if required to do so by law, regulation, legal process, or governmental request, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others, investigate fraud, or respond to a government request.

3.4 Business Transfers

If Luex Digital LLC is involved in a merger, acquisition, or sale of all or a portion of its assets, your information may be transferred as part of that transaction. We will notify you via email or prominent notice within the App before your information becomes subject to a different privacy policy.

4. Payment Processing

All payment processing is handled by Stripe, Inc. We use Stripe Connect to enable drivers to accept payments from their customers. When you set up Stripe Connect through our App:

• You create a Stripe Express account directly with Stripe.
• Stripe collects and manages your financial information (bank account, tax information) under their own terms and privacy policy.
• We store only your Stripe account identifier, connection status, and transaction references — never your bank details or full card numbers.

Stripe's privacy policy is available at: https://stripe.com/privacy

Subscription payments for Pro and Premium plans are processed directly through Stripe. We store your Stripe customer identifier and subscription status but do not have access to your payment method details.

5. Data Storage and Security

5.1 Where We Store Your Data

Your data is stored on secure servers located in the United States. We use industry-standard cloud infrastructure providers.

5.2 How We Protect Your Data

We implement appropriate technical and organizational measures to protect your personal information, including:

• Password Security: Passwords are hashed using bcrypt with a cost factor of 12. We never store plaintext passwords.
• Authentication: Access to your account is secured via JSON Web Tokens (JWT) with a 30-day expiration.
• Secure Storage: On mobile devices, authentication tokens are stored using encrypted secure storage (iOS Keychain / Android Keystore) rather than plaintext storage.
• Transport Security: All data transmitted between the App and our servers is encrypted using HTTPS/TLS.
• Access Controls: Your data is accessible only through authenticated API requests tied to your account.
• Rate Limiting: Our API implements rate limiting to prevent brute-force attacks on authentication endpoints.
• Security Headers: Our servers implement industry-standard security headers to protect against common web vulnerabilities.

5.3 Data Breach Notification

In the event of a data breach that affects your personal information, we will notify you via the email address associated with your account within 72 hours of becoming aware of the breach, as well as any applicable regulatory authorities as required by law.

6. Data Retention

• Active Accounts: We retain your personal information for as long as your account is active and as needed to provide you with our Services.
• Deleted Accounts: When you request account deletion, your personal data (account information, trips, expenses, invoices, and uploaded receipt images) is deleted immediately and permanently from our systems. We do not retain copies of your data after deletion.
• Transactional Records: Emails that have already been delivered to your customers (invoices, booking confirmations) are not under our control after delivery and cannot be recalled.
• Stripe Records: Payment records maintained by Stripe are governed by Stripe's own data retention policies.

7. Your Rights

As a user of our Services, you have the following rights regarding your personal information:

7.1 Access and Portability

You can access your personal information at any time through the App. Your trip history, expense records, and invoice data are available in your account dashboard.

7.2 Correction

You can update your account information (name, company name, company slug) directly through the App. To update your email address, please contact us at luexdigital@gmail.com.

7.3 Deletion

You may request deletion of your account and all associated personal data by contacting us at luexdigital@gmail.com. Upon receiving your request, we will delete your account and all associated data immediately. We are actively developing an in-app account deletion feature to make this process self-service.

7.4 Opt-Out of Communications

You can disable push notifications at any time through your device settings. Transactional emails (password resets, invoice delivery) cannot be opted out of while your account is active, as they are necessary for the functioning of the Services.

7.5 Texas Data Privacy and Security Act (TDPSA)

If you are a Texas resident, the Texas Data Privacy and Security Act provides you with additional rights, including:

• The right to confirm whether we are processing your personal data
• The right to access your personal data
• The right to correct inaccuracies in your personal data
• The right to delete your personal data
• The right to obtain a copy of your personal data in a portable format

To exercise any of these rights, contact us at luexdigital@gmail.com. We will respond to your request within 45 days. If we deny your request, you may appeal by contacting us at the same email address, and we will respond to your appeal within 60 days.

7.6 California Residents (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (as amended by the California Privacy Rights Act) provides you with additional rights. We do not sell or share your personal information for cross-context behavioral advertising. You may exercise your rights to know, delete, and correct your personal information by contacting us at luexdigital@gmail.com.

8. Children's Privacy

Our Services are not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at luexdigital@gmail.com and we will promptly delete such information from our systems.

If you are between the ages of 13 and 18, you may use the Services only with the involvement and consent of a parent or guardian.

9. Third-Party Links

Our Services may contain links to third-party websites or services (such as Stripe's billing portal or Google Maps). We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing them with your information.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the App or by sending an email to the address associated with your account at least 30 days before the changes take effect. Your continued use of the Services after the effective date of the updated policy constitutes your acceptance of the changes.

The "Last Updated" date at the top of this page indicates when this Privacy Policy was last revised.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Luex Digital LLC
Email: luexdigital@gmail.com

12. Governing Law

This Privacy Policy is governed by the laws of the State of Texas, United States, without regard to its conflict of law provisions.