1. Categories of Information We Collect

RÉYA collects personal information that is reasonably necessary and proportionate to operate a transportation network platform, verify identities, ensure safety, process payments, and comply with legal obligations.

1.1 Information You Provide Directly

RÉYA collects personal information that you voluntarily provide when creating an account, completing onboarding requirements, or interacting with the Platform. Such information may include your full legal name, date of birth, telephone number, email address, and profile photograph. In addition, RÉYA may collect government-issued identification information, including driver’s license details, Social Security numbers (for Drivers only, where permitted by law), and images, for identity verification, tax reporting, background check, and regulatory compliance purposes. For Drivers, RÉYA collects additional information necessary to evaluate eligibility and facilitate services, including vehicle information (such as make, model, year, registration details, and insurance documentation), background check data (including criminal history records, driving records, and sex offender registry checks), certifications, and inspection records. RÉYA may also collect financial information, including bank account details, routing numbers, or other payment credentials, to facilitate payouts and billing. Users may also provide information through communications with RÉYA, including customer support inquiries, dispute submissions, feedback, and other correspondence, all of which may be recorded and retained.

1.1.1 Sensitive Data Protections.

Certain categories of personal information collected by RÉYA are classified as sensitive data and are subject to heightened protections and access controls, including: (a) government-issued identification information and Social Security numbers; (b) background check data, including criminal history records, driving records, and sex offender registry check results; and (c) financial account credentials, including bank account details and routing numbers (collectively, "Sensitive Data"). Access to Sensitive Data is strictly limited to authorized RÉYA personnel and approved third-party service providers who require such access to perform a specific, documented business function. RÉYA personnel with access to Sensitive Data are subject to confidentiality obligations, role-based access controls, and mandatory security training. Sensitive Data is stored in encrypted form using industry-standard encryption protocols, both in transit and at rest, and is segregated from other categories of personal information where technically and operationally practicable. RÉYA does not use Sensitive Data for marketing, profiling, or any purpose beyond those expressly identified in this Privacy Policy. Sensitive Data will not be disclosed to any third party except: (i) as strictly necessary to perform identity verification, background screening, tax reporting, or payment processing functions; (ii) as required by applicable law or regulatory obligation; or (iii) with your explicit consent. RÉYA conducts periodic access reviews to ensure that access to Sensitive Data is revoked promptly upon change of role or termination of the applicable business need.

1.2 Information Collected Automatically

RÉYA automatically collects certain information when you access or use the Platform. This includes precise geolocation data, including real-time and historical GPS coordinates collected continuously while the app is in use (including when running in the background for Drivers), which are essential for matching Drivers and Riders, facilitating trips, ensuring safety, and maintaining accurate records. For Drivers, location data may be collected even when the app is running in the background to enable ride matching and safety features. RÉYA also collects trip-related information, including pickup and drop-off locations, route data, timestamps, duration, and distance traveled. Additionally, RÉYA collects device and technical information, including IP address, device identifiers, operating system, browser type, and app usage metrics. RÉYA may collect diagnostic, crash, and performance data to monitor Platform stability and improve system performance. Usage data, including how you interact with features of the Platform, screen recordings, and in-app behavior patterns, may also be collected for analytics and product development purposes.

1.3 Information from Third Parties

RÉYA may obtain personal information about you from third-party sources where necessary to support its operations. Such sources may include consumer reporting agencies and background check providers (subject to Fair Credit Reporting Act requirements), identity verification services, payment processors, insurance partners, data brokers, marketing partners, and referral networks. In certain circumstances, RÉYA may also receive information from law enforcement, regulatory agencies, or other governmental entities as required by law or in connection with investigations, compliance obligations, or safety-related incidents.

2. Methods of Collection

RÉYA collects personal information through a variety of methods, including directly from you when you complete registration forms, onboarding processes, or in-app submissions. Information is also collected automatically through your use of the Platform, including through embedded technologies such as cookies, software development kits (SDKs), and tracking tools. Additionally, RÉYA collects information through integrations with third-party service providers that support payment processing, communications, background screening, and analytics. By using the Platform, you acknowledge and agree to the collection of your personal information through these methods, to the extent permitted by applicable law.

3. Purposes for Which Information Is Used

RÉYA processes personal information for legitimate business purposes, including those necessary to operate a transportation network, ensure safety, and comply with applicable law. RÉYA relies on the following lawful bases for processing personal information: (a) performance of a contract or steps taken prior to entering into a contract ("Contractual Necessity"); (b) compliance with a legal obligation ("Legal Obligation"); (c) legitimate interests pursued by RÉYA or a third party, where such interests are not overridden by your interests or fundamental rights ("Legitimate Interests"); and (d) your consent, where explicitly obtained ("Consent"). The applicable lawful basis for each processing activity is identified below. RÉYA uses personal information to facilitate connections between Drivers and Riders, process ride requests, calculate fares, and complete transactions. Personal information also used to authenticate users, verify identities, and maintain account security. These processing activities are carried out on the basis of Contractual Necessity, as they are required to perform the services you have requested. In addition, RÉYA uses personal information to conduct background checks, investigate incidents, and comply with regulatory requirements applicable to transportation network companies. These activities are carried out on the basis of Legal Obligation, to the extent required by applicable law, and on the basis of Legitimate Interests where RÉYA has a legitimate interest in ensuring the safety and integrity of the Platform. RÉYA also uses personal information to monitor for fraudulent or unsafe activity and enforce Platform policies on the basis of Legitimate Interests, which include protecting RÉYA, its users, and the public from harm and misuse. Personal information may also be used to communicate with Users regarding account activity, service updates, safety alerts, and customer support matters, on the basis of Contractual Necessity and Legal Obligation as appropriate. RÉYA may use aggregated or de-identified data for analytics, research, product development, and operational improvements on the basis of Legitimate Interests. Where permitted by law, RÉYA may also use personal information to send promotional communications, offers, and marketing materials on the basis of your Consent, where required, or Legitimate Interests where such basis is permitted under applicable law. You may withdraw consent or opt out of marketing communications at any time by following the unsubscribe instructions in such communications or by contacting us at the address provided in Section 14. Withdrawal of consent does not affect the lawfulness of any processing carried out prior to such withdrawal.

4. Disclosure of Personal Information

RÉYA may disclose personal information to third parties where necessary to provide services, comply with legal obligations, or protect its rights and users. RÉYA shares personal information with service providers and third-party vendors that perform functions on its behalf, including payment processing, cloud storage, communications, analytics, identity verification, marketing services, and data hosting. These service providers are contractually obligated to use personal information only for authorized purposes and to maintain appropriate safeguards. However, RÉYA cannot guarantee the security practices of third-party service providers. RÉYA may share information between Drivers and Riders as necessary to facilitate services, including limited identifying details such as first name, profile photo, rating, vehicle information (make, model, color, license plate), and real-time location during active trips. After trip completion, Drivers and Riders may view limited trip history information about each other. RÉYA may disclose personal information to law enforcement, regulators, courts, or other governmental authorities where required by law, subpoena, court order, or legal process, or where RÉYA believes in good faith that such disclosure is reasonably necessary to: (a) comply with legal obligations; (b) protect the safety, rights, or property of RÉYA, Users, or the public; (c) detect, prevent, or address fraud, security, or technical issues; or (d) respond to emergency situations involving danger of death or serious physical injury. In the event of a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of the transaction, subject to applicable confidentiality protections. RÉYA does not sell personal information to third parties for monetary consideration. However, certain data sharing practices, such as sharing information with advertising partners or analytics providers, may constitute a "sale" or "sharing" under certain state privacy laws (such as the CCPA/CPRA). To the extent such sharing occurs, you may have the right to opt out as described in Section 11.

5. Location Data and Mobility-Specific Processing

Because RÉYA operates a transportation network platform, the collection and processing of precise geolocation data is fundamental to the functionality of the Platform. RÉYA collects location data when the application is active, including during periods when Drivers are available for ride requests and when trips are in progress. Location data is used to match Drivers with Riders, determine routes, calculate fares, enhance safety monitoring, detect fraud, and provide customer support. You may control location permissions through your device settings; however, disabling location services will prevent you from using the core functionality of the Platform, including requesting or providing rides. Drivers must enable location services to receive ride requests and navigate to pickup and drop-off locations. Riders must enable location services to request rides and share their location with Drivers.

6. Cookies and Tracking Technologies

RÉYA uses cookies, pixels, and similar tracking technologies to collect information about user behavior and preferences. These technologies enable RÉYA to analyze usage patterns, improve Platform performance, personalize user experiences, and maintain system security. You may control the use of cookies through your browser settings; however, disabling certain tracking technologies may affect the availability and functionality of the Platform.

7. Data Retention

RÉYA retains personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, including providing services, complying with legal obligations, resolving disputes, and enforcing agreements. Specific retention periods for key categories of personal information are set out below. Specific retention periods for certain categories of personal information are as follows: (a) Trip Records: RÉYA retains trip-related data, including pickup and drop-off locations, route data, timestamps, duration, and distance traveled, for a period of 5 years following the completion of a trip, or for such longer period as may be required by applicable law or regulatory obligations. (b) Financial Data: RÉYA retains financial records, including payment transaction records, invoices, and related documentation, for a period of seven (7) years following the date of the transaction, in accordance with applicable tax, accounting, and financial recordkeeping requirements. (c) Background Check Data: RÉYA retains background check records, including criminal history, driving records, and sex offender registry check results, for the period required under applicable federal and state law, including the Fair Credit Reporting Act (FCRA) and any applicable transportation network company regulations. Upon expiration of the applicable retention period, personal information will be securely deleted or anonymized in accordance with RÉYA's data disposal procedures, except where continued retention is required by law.

8. Data Security

RÉYA implements administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure. These safeguards include encryption, secure access controls, monitoring systems, and incident response procedures. Notwithstanding these measures, no system can be guaranteed to be completely secure, and RÉYA disclaims any guarantee of absolute security. In the event of a security incident involving unauthorized access to, acquisition of, or disclosure of personal information that is reasonably likely to result in harm to affected individuals (a "Security Breach"), RÉYA will notify affected Users and relevant regulatory authorities in accordance with applicable federal and state breach notification laws. Where required by law, RÉYA will provide such notification without unreasonable delay and, in any event, within the timeframe prescribed by applicable law (which may include, without limitation, seventy-two (72) hours to relevant supervisory authorities under the GDPR, or such other period as required by applicable state data breach notification statutes). Notification to affected Users will include, to the extent required and reasonably practicable: (a) a description of the nature of the Security Breach; (b) the categories and approximate volume of personal information involved; (c) the likely consequences of the Security Breach; (d) the measures taken or proposed to be taken by RÉYA to address the Security Breach, including measures to mitigate its possible adverse effects; and (e) contact information for obtaining further information. RÉYA maintains an incident response plan designed to facilitate timely detection, containment, assessment, and notification of Security Breaches.

9. User Rights and Choices

Depending on your jurisdiction, you may have certain rights with respect to your personal information, including the right to access, correct, delete, or restrict processing of your data, as well as rights related to automated decision-making and profiling as described in Section 11.4. To submit a request to exercise any of these rights, you may contact RÉYA through any of the following methods: (a) by email at legal@reyaapp.com with the subject line "Privacy Rights Request"; (b) by submitting a request through the privacy settings menu within the Platform; or (c) by written request addressed to RÉYA Mobility LLC at the address set forth in Section 14. Your request must include sufficient information to allow RÉYA to reasonably verify your identity, including your full name, email address associated with your account, and the nature of your request. You may also have the right to request data portability or to object to certain processing activities, including marketing communications. RÉYA will respond to verifiable requests within forty-five (45) days of receipt. RÉYA may decline to act on a request where permitted or required by applicable law, in which case RÉYA will inform you of the basis for its decision. RÉYA will not charge a fee to process or respond to a verifiable request unless such request is manifestly unfounded, excessive, or repetitive.

10. Minors

The Platform is not intended for use by individuals under the age of eighteen (18). RÉYA does not knowingly collect personal information from children under the age of thirteen (13). If RÉYA becomes aware of such collection, it will take reasonable steps to delete the information.

11. Do Not Sell or Share My Personal Information; Global Privacy Controls

As described in Section 4, certain disclosures of personal information to advertising partners, analytics providers, and other third parties may constitute a "sale" or "sharing" of personal information as those terms are defined under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), and analogous state privacy laws. California residents and residents of other states with applicable opt-out rights have the right to direct RÉYA to stop selling or sharing their personal information with such third parties. To exercise your right to opt out of the sale or sharing of your personal information, you may: (a) click the "Do Not Sell or Share My Personal Information" link available on our website and within the Platform settings; (b) submit a request by email to legal@reyaapp.com with the subject line "Do Not Sell or Share Request"; or (c) use an opt-out preference signal recognized by RÉYA, as described below. RÉYA will process your opt-out request within fifteen (15) business days of receipt. RÉYA will not discriminate against you for exercising this right. RÉYA recognizes and honors Global Privacy Control (GPC) signals transmitted by your browser or device. If RÉYA detects a valid GPC signal when you access our website or Platform, RÉYA will treat that signal as a request to opt out of the sale and sharing of your personal information for the browser or device from which the signal originates, consistent with applicable law. Please note that a GPC signal will apply only to the specific browser or device from which it is sent and will not extend to your account globally. If you wish to opt out across all devices and access points, you should also submit a request using one of the methods described above. Following receipt of a valid opt-out request or recognition of a GPC signal, RÉYA will not ask you to re-authorize the sale or sharing of your personal information for a period of at least twelve (12) months, unless you affirmatively re-authorize such processing.

11.2 European Economic Area Rights

Users located in the European Economic Area (EEA) are afforded rights under the General Data Protection Regulation (GDPR), including rights of access, correction, deletion, restriction, objection, and data portability. For the avoidance of doubt, RÉYA's obligations under Section 11.1 are separate from and in addition to any rights afforded to EEA Users under the GDPR. Lawful Bases for Processing. RÉYA processes personal data under lawful bases, including contractual necessity, legal compliance, and legitimate business interests, as further described in Section 3 of this Privacy Policy.

11.3 Cross-Border Data Transfers.

RÉYA is based in the United States and may transfer personal data of EEA, UK, and Swiss Users to the United States and other countries that may not provide a level of data protection equivalent to that in your jurisdiction. Where RÉYA transfers personal data originating from the European Economic Area, the United Kingdom, or Switzerland to a third country that has not been the subject of an adequacy decision by the relevant supervisory authority, RÉYA relies on the Standard Contractual Clauses approved by the European Commission (or, as applicable, the equivalent mechanism approved by the UK Information Commissioner's Office or the Swiss Federal Data Protection and Information Commissioner) as the lawful mechanism for such transfers. Copies of the applicable Standard Contractual Clauses are available upon request by contacting RÉYA at the address set forth in Section 14. Where RÉYA engages third-party processors located in third countries, RÉYA ensures that appropriate transfer safeguards, including executed Standard Contractual Clauses, are in place prior to any transfer of personal data to such processors. RÉYA will cooperate with competent supervisory authorities and comply with advice given by such authorities with regard to transfers of personal data to third countries.

11.4 Automated Decision-Making and Profiling.

RÉYA uses automated processing, including algorithmic and machine-learning-based tools, to make or assist in making certain decisions that may significantly affect Users. These automated processes include, without limitation: (a) Driver eligibility determinations based on background check results, driving record data, and identity verification outcomes; (b) dynamic fare calculation and surge pricing algorithms based on real-time supply and demand data; (c) ride-matching algorithms that determine which Drivers are offered ride requests based on proximity, ratings, acceptance rates, and other operational factors; (d) fraud detection and risk scoring systems that assess transactional and behavioral data to identify potentially fraudulent or unsafe activity; and (e) account suspension or deactivation triggers based on policy violation detection, safety incident data, or rating thresholds. Where any such automated process produces a decision that has a legal or similarly significant effect on a User, RÉYA has implemented appropriate human oversight measures to review such decisions upon request. EEA User Rights Regarding Automated Decisions. To the extent that any automated processing described above constitutes solely automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 of the GDPR, you have the right to: (a) not be subject to a decision based solely on automated processing, unless such processing is necessary for the performance of a contract between you and RÉYA, is authorized by applicable law, or is based on your explicit consent; (b) obtain human intervention by a RÉYA representative to review the automated decision; (c) express your point of view with respect to the automated decision; and (d) contest the decision. To exercise these rights, please contact RÉYA using the contact methods set out in Section 9. RÉYA will acknowledge your request within ten (10) business days and will provide a response, including the outcome of any human review, within thirty (30) days of receipt of a verifiable request. U.S. State Law Rights Regarding Automated Decisions and Profiling. Residents of California, Virginia, Colorado, Connecticut, and other states with applicable privacy legislation may have additional rights with respect to automated decision-making and profiling, including: (a) the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects, including decisions related to the provision or denial of services, financial terms, or account status; (b) the right to access meaningful information about the logic involved in automated decisions that affect you, including the categories of personal information used and the likely outcomes of such processing; and (c) the right to appeal an automated decision that has adversely affected you. To opt out of profiling for such purposes, or to request access to information about an automated decision, please submit a request using the contact methods set out in Section 9 with the subject line "Automated Decision-Making Request." RÉYA will process such requests in accordance with the timelines set forth in Section 9 and will not discriminate against you for exercising these rights. Safeguards. RÉYA has implemented the following safeguards with respect to automated decision-making processes that produce significant effects on Users: (a) periodic internal audits of automated decision systems to assess accuracy, consistency, and potential bias; (b) defined escalation procedures allowing Users to request human review of any automated decision that has materially and adversely affected their use of the Platform; (c) access and correction rights allowing Users to update personal information that serves as an input to automated decisions, where inaccurate data may have contributed to an adverse outcome; and (d) documentation of the key variables and data inputs used by automated systems that produce significant decisions, available to Users upon request. Requests for human review, access to decision logic, or correction of inputs should be submitted to legal@reyaapp.com with the subject line "Automated Decision-Making Request."

12. Third-Party Services

The Platform may contain links to or integrations with third-party services. RÉYA is not responsible for the privacy practices of such third parties, and Users are encouraged to review their policies before providing personal information.

13. Changes to This Privacy Policy

RÉYA reserves the right to modify or update this Privacy Policy at any time. Material changes will be communicated through the Platform or other reasonable means. Continued use of the Platform following such changes constitutes acceptance of the updated Privacy Policy.

14. Contact Information

If you have any questions regarding this Privacy Policy or wish to exercise your rights, you may contact RÉYA at: Email: support@reyaapp.com Legal: legal@reyaapp.com Mailing Address: RÉYA Mobility LLC Attn: Legal Department 100 Southeast 3rd Avenue, Suite 1000 Fort Lauderdale, FL 33394 United States