TuneTaxi Inc. Privacy Policy

Effective Date: January 17, 2026
TuneTaxi Inc. (“TuneTaxi”, “we”, “us” or “our”) is a Delaware, USA corporation that provides a subscription-based and freemium audio platform for small businesses and creators. We are committed to protecting your privacy. This Privacy Policy describes what personal information we collect, how we use and share it, and your rights regarding this information, in compliance with U.S. federal law, Delaware law, the California Consumer Privacy Act (as amended by the CPRA), and the EU/UK General Data Protection Regulation (GDPR), among other applicable laws. By using TuneTaxi’s services (our website, apps, and related services – collectively, the “Service”), you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Service.

We do NOT knowingly collect or process personal data from children under 13 years of age. The Service is not directed to children, and we adhere to the U.S. Children’s Online Privacy Protection Act (COPPA), which prohibits collecting personal information from children under 13 without parental consent. If you are a parent or guardian and believe your child under 13 has provided personal information to us, please contact us and we will delete the data. (See the Children’s Privacy section below for more details.)

Information We Collect

We collect personal information (“Personal Information” or “Personal Data”) that you provide to us directly, information generated by your use of our Service, and information from third parties as needed. Below we explain the categories of Personal Information we collect and the purposes for which we use it:

• Account and Contact Information: When you register for an account, subscribe to our service, or use our platform, we collect information such as your name, email address, username, password, and any profile details you provide. If you represent a business or creator, we may also collect your business/organization name and contact details. This information is collected directly from you during signup or when you update your profile.
• Payment Information: If you purchase a subscription or make other transactions, payments are handled via our third-party payment processor (for example, Stripe). We do not receive or store your full credit card number or financial account details; those are collected and processed directly by the payment processor in accordance with their privacy policy. We may receive limited information about your payment transactions from Stripe – such as your billing address, the card’s last four digits, payment amount, and confirmation of payment – to record your subscription and handle billing issues.
• Content and Usage Data: We collect data about how you use our Service. This includes the audio content you upload or stream, your playlists or preferences, the creators or channels you follow, and your interactions (such as likes, comments, or other engagement with audio content if those features are available). We also collect any feedback, support requests, or other communications you send to us (e.g., emails or support chat transcripts).
• Device and Technical Information: Like most online services, we automatically collect certain information about your device and how you access the Service. This includes your IP address, device identifiers, browser type, operating system, language preference, referring website, and timestamps. We also collect information about your usage of our website or app via cookies and similar tracking technologies (see Cookies and Tracking below), such as the pages or screens you view, features you use, links clicked, and other analytics data about your interactions. This technical information helps us provide the Service and ensure it functions properly on different devices and browsers.
• Third-Party Data: We may receive information about you from third parties that integrate with our Service. For example, if you log in via a social network account or another platform, we will receive the information you authorize that platform to share with us (such as your profile name or identifier on that platform). Additionally, we use third-party analytics services that collect information on our behalf about your interactions with the Service (see Cookies and Tracking). These indirect sources of data are used to enhance your experience and our understanding of how the Service is used.

We limit our collection of Personal Information to what is relevant and necessary for the purposes described in this Policy. In particular, we do not collect any sensitive personal data (such as government ID numbers, financial account passwords, precise geolocation, racial or ethnic origin, health information, etc.) unless you voluntarily provide it to us for a specific purpose or it’s necessary for us to provide the Service. We also do not collect any information from persons under 13, in compliance with COPPA.

How We Use Your Information

TuneTaxi uses your Personal Information for the following purposes, which are described in detail below. For each of these purposes, we ensure we have a valid legal basis for processing your data (see Legal Bases for Processing (EEA/UK)). We do not use your data for any purpose that is incompatible with the ones listed here:

• Providing and Improving the Service: We use the information we collect to operate, maintain, and provide you with all features of the TuneTaxi Service. This includes using your data to create and manage your account, allow you to upload or access audio content, stream content at your request, manage subscriptions and accounts, and personalize your experience. For example, we might use your listening history to recommend other audio tracks or podcasts you might enjoy. We also use usage and analytics data to understand how our Service is functioning, to debug and fix errors, and to develop new features or enhance existing ones.
• Processing Transactions: We use your Personal Information to process payments for subscriptions or purchases you make. This includes working with our payment processor (e.g., Stripe) to charge your credit/debit card or other payment method and to keep records of your transaction. Payment-related information (like billing name and address, and transaction ID) is used for billing administration, resolving disputes, refunding (when applicable), and preventing fraudulent transactions.
• Communicating with You: We use contact information (like your email address or in-app notifications) to send you service-related communications. These communications include confirmations of sign-up or purchase, receipts, technical or security alerts (such as verification codes or password reset emails), and important updates about your account or the Service (for example, material changes to this Privacy Policy or our Terms of Service). We may also send you newsletters, marketing emails or offers about new features, content, or promotions if you have subscribed to them or as permitted by law. You can opt out of marketing communications at any time (see Your Privacy Choices below). We will not send you marketing emails if you have opted out or, where required, without obtaining your consent first.
• Customer Support: If you contact us for help, feedback, or to report a problem, we will use the information you provide (which may include your contact info and the content of your communications) to respond to you and resolve your issue. We may also use information from support interactions to improve our customer service processes.
• Analytics and Service Improvement: We use data (including cookies and third-party analytics tools) to analyze trends and usage of our Service, so we can understand user behavior and preferences. For example, we might track which features are most frequently used or which content is most popular. This helps us optimize the user experience, fix technical issues, and guide our decisions on what new features or content to develop. These analytics may be performed by our own technology or by third-party analytics providers acting on our behalf (who are contractually bound to only use the data to provide us with analytics services).
• Security and Fraud Prevention: We are dedicated to keeping TuneTaxi secure. We use Personal Information (especially technical data like IP addresses, device IDs, and usage patterns) to monitor and prevent fraud, abuse, and other suspicious or illegal activities on the Service. This includes enforcing our Terms of Service and Community Guidelines (for example, detecting and taking action on spamming, piracy, or other prohibited content or behavior). We may also use automated systems to detect account violations or security threats. If we detect fraud or a security risk, we may use your information to contact you and/or mitigate the issue.
• Legal Compliance: We process and retain your Personal Information as needed to comply with applicable laws, regulations, and legal obligations. For instance, we may keep certain payment records for tax and accounting purposes, or disclose information as required by law enforcement or government authorities (pursuant to a lawful request as described in Sharing Your Information below). If we receive a subpoena or court order, we may need to preserve and share certain data to comply. We also use your data to exercise or defend legal claims, and to fulfill our obligations under consumer protection laws and privacy laws.

We will not use your Personal Information in a way that is materially different from what is described in this Privacy Policy without notifying you. If we plan any material changes (for example, using your data for a new purpose that is not compatible with the original purpose), we will update this Policy and, if required by law (for example, under U.S. FTC guidance or applicable privacy laws), obtain your consent before the new use. We will never sell your personal data to data brokers or unrelated third parties for their own marketing purposes without your explicit consent.

Legal Bases for Processing (EEA/UK Users)

If you are located in the European Economic Area (EEA) or the United Kingdom, we must inform you of the legal grounds for processing your Personal Data under the GDPR and UK GDPR. TuneTaxi acts as the “data controller” of your Personal Data. Our processing of your data is based on one or more of the following legal bases:

• Contractual Necessity: We process certain Personal Data to provide our Service in accordance with our contract with you (our Terms of Service). For example, we need to process your registration details to create your account, and we must process payment information to fulfill a subscription. Without this information, we cannot provide the core Service features you request.
• Legitimate Interests: We process Personal Data as needed for our legitimate interests, provided those interests are not overridden by your data protection rights. Our legitimate interests include: maintaining and improving our Service (e.g., analyzing usage, fixing bugs), securing our platform and preventing fraud, communicating with you about updates or new features (for existing customers), and personalizing your experience (such as recommending content). We rely on legitimate interests for data processing that is expected and has minimal privacy impact, after carefully considering any risks to your rights. For example, using cookies for basic analytics or using your listening history to personalize suggestions are activities in our legitimate interest to improve our Service.
• Consent: In certain cases, we rely on your consent to process your Personal Data. For instance, if you are an EEA/UK user, we will obtain your consent before setting non-essential cookies (e.g., analytics or advertising cookies) on your device. Similarly, if we send you direct marketing communications (such as promotional emails) and you are not already our customer, we will do so based on your consent. You have the right to withdraw your consent at any time (see Your Privacy Rights below), and if you do so we will stop the relevant processing which was based on consent. Note that withdrawing consent does not affect the lawfulness of processing before the withdrawal.
• Legal Obligation: We process Personal Data when necessary to comply with a legal obligation to which we are subject. For example, we may retain transaction records to satisfy financial reporting laws, or disclose information if required by a valid legal process (such as a subpoena). When we process data to comply with the law, this is a legal obligation under GDPR.

We will indicate in context where we require you to provide Personal Data (for example, essential account information) and what the consequence is if you do not provide it (typically, we will be unable to provide certain services). Where we rely on legitimate interests, we have conducted a balancing test to ensure your rights and interests do not override our legitimate business needs. If you have questions about the legal bases or need more detail, please contact us (see Contact Us below).

Cookies and Tracking Technologies

Cookies are small data files stored on your browser or device. TuneTaxi and our service providers use cookies and similar tracking technologies (such as web beacons, pixels, and device identifiers) to automatically collect certain information about your device and usage of our Service over time. We use the following types of cookies and tracking technologies:

• Essential Cookies: These are necessary for our website/app to function properly and enable core features such as user login, account navigation, and secure payment processing. Without these cookies, the Service may not perform as expected.
• Analytics and Performance Cookies: We use these to collect information about how users interact with our Service, which pages or content are popular, and other analytical data. For example, we use a third-party analytics service (such as Google Analytics) to help us understand overall user engagement and identify areas for improvement. These cookies may track things like how long you spend on a page, clickstream data, and errors encountered. The information is aggregated and not intended to identify you personally; it helps us improve site functionality and user experience.
• Functional Cookies: These cookies remember your preferences and settings to provide enhanced features. For instance, they might remember your language preference or volume settings for audio playback, so you don’t have to set them each time. They can also enable certain optional features of the platform.
• Advertising and Marketing Cookies: (For our free users or if we run promotional campaigns) – We currently do not host third-party banner ads on the platform for targeted advertising without user consent. However, if in the future we partner with advertisers or run an ad-supported free tier, we may use advertising cookies that collect information about your browsing habits and interests in order to show you relevant ads. We will update this Policy and obtain any necessary consent before introducing such cookies. If advertising cookies are in use, they may collect data such as your device ID, visited pages, or content consumption to build a profile of your interests. You will have the ability to opt out of targeted advertising as described in Your Privacy Rights (see the opt-out of sale/sharing of data).

Do Not Track (DNT): Your web browser or device may offer a “Do Not Track” setting or Global Privacy Control (GPC) signal, which allows you to signal your privacy preference regarding tracking by websites. At this time, TuneTaxi’s Service does not respond to browser Do Not Track signals in a standardized way, because no uniform standard for DNT has been adopted across the industry. However, we treat GPC signals as a valid request to opt out of the sale or sharing of Personal Information under applicable laws (like CCPA/CPRA). In other words, if we detect a GPC signal from a California resident’s browser, we will honor it as a Do Not Sell/Share request (see California Privacy Rights below). Aside from that specific case, if standards for DNT are formalized, we will follow them accordingly and update this Policy.

Third-Party Data Collection: We want you to be aware that when you use our Service, certain third parties may collect information about your online activities over time and across different websites or online services. For example, our analytics providers use cookies and scripts that can track your interaction with our site and, in some cases, combine that with information from other sites that use the same analytics or advertising networks. If we eventually implement advertising, third-party ad networks might collect data via cookies on our site to profile users for targeted ads across the web. This Privacy Policy covers only TuneTaxi’s use and disclosure of data, not the practices of third parties. We encourage you to review the privacy policies of any third-party services you interact with. That said, any third-party analytics or advertising partners we use will be obligated to use data collected from our users only for the purposes we authorize, and consistent with this Policy and applicable law.

Your Choices for Cookies: On your first visit to our website, you will be presented with a cookies notice and can choose to accept or decline certain non-essential cookies (for EEA/UK users, we will obtain consent for analytics/ads cookies). You can also control or delete cookies at any time through your browser settings. Most browsers allow you to block or delete cookies – however, please note that if you disable all cookies, some features of our Service may not function properly (e.g., staying logged in). For more information on how to manage cookies, you can visit your browser’s help documentation. For third-party analytics (like Google Analytics), you can typically opt out by installing an opt-out browser add-on provided by the service. For interest-based advertising, you can learn more about opting out via industry websites such as the NAI or DAA in the U.S., or the EDAA in Europe. See Your Privacy Rights for how to opt out of any “sale” or targeted advertising uses of your data.

Sharing Your Information

We do not sell your personal information to data brokers or telemarketers, and we do not share your information with third parties for their own independent marketing or advertising purposes without your consent. However, we do share your Personal Information with certain categories of recipients in order to run our business and comply with legal obligations, as described below:

• Service Providers (Processors): We share Personal Information with trusted third-party companies that provide services on our behalf, commonly known as “service providers” or data processors. These include, for example:
  • Payment Processors: As noted, we use Stripe to process subscription payments. Stripe will receive your payment card details and other billing info as needed to process transactions. They are authorized to use this information only to carry out the payment services.
  • Cloud Hosting and IT: We may host our platform and databases on cloud infrastructure (e.g., Amazon Web Services or similar providers). Those providers store and process data as needed to keep our Service running.
  • Analytics Providers: We use third-party analytics tools (e.g., Google Analytics) to collect usage data. These providers act on our behalf to analyze the data of how users interact with our Service, and they provide us aggregated insights. They may collect data via cookies and similar tech as described in the Cookies section. We ensure any analytics provider does not use the data for their own purposes and, where required, we will seek your consent for their tracking.
  • Email/Communication Services: We may use an email delivery service to send out transactional emails (for sign-ups, password resets, etc.) or customer support replies. In doing so, we share your email address and the content of the communication with those providers for the sole purpose of sending emails on our behalf.
  • Other Vendors: We might also share data with other vendors such as customer support software providers, marketing and CRM tools (to manage email subscriptions if you’ve opted in), or survey platforms (if we ever conduct user surveys). In all cases, these service providers are bound by contracts that restrict how they can access, use, and disclose your Personal Information, consistent with this Policy and applicable privacy laws. They are not allowed to use your data for any purpose other than providing services to TuneTaxi.
• Business Partners (for integrated features): If TuneTaxi offers integration with third-party services (for example, an option to share content to a social media platform, or an integration where a creator can connect their TuneTaxi account with another service), we will share data with that third party at your direction. Such sharing will only occur with your knowledge and typically in context (e.g., if you click a “Connect” or “Share” button, the information needed to fulfill that request will be transferred). We will let you know what data will be shared and require your explicit action to initiate it. Once the third party receives the data, their own privacy policy will apply to their use of the information.
• Advertising Partners: (If applicable) If we provide an ad-supported free version of the Service or run marketing campaigns, we may share limited information with advertising networks or partners. For example, we might allow an ad partner to place cookies or SDKs on our site/app which collect device identifiers and basic interaction info to help decide which ads to display to you (see Cookies and Tracking). We might also share hashed portions of your data (like an email hash) with advertising partners to help identify and reach similar audiences. Important: as of the effective date of this Policy, we are not sharing personal data with third parties for cross-context behavioral advertising (the kind of “sale” or “sharing” regulated by CCPA/CPRA) without consent. If we ever engage in targeted advertising involving personal data, we will provide you with notice and the opportunity to opt out as required by law. You can also exercise an opt-out of such advertising at any time through the mechanisms described in Your Privacy Rights (e.g., “Do Not Sell or Share My Personal Information” requests).
• Affiliates: TuneTaxi Inc. currently operates as a single corporate entity. If in the future we establish any parent, subsidiary, or affiliated companies (under common ownership or control), we may share your Personal Information within that corporate group as necessary to provide the Service and for internal administration. Any such affiliates will be bound to uphold the privacy protections described here. For example, if TuneTaxi establishes an EU-based subsidiary to better serve EU customers, data may be shared between TuneTaxi Inc. and the EU entity, but always under strict safeguards and only for the purposes stated in this Policy.
• Legal Compliance and Protection: We may disclose your Personal Information when we believe in good faith that such disclosure is necessary to comply with the law or legal process, or to protect the rights, property, or safety of TuneTaxi, our users, or the public. This includes:
  • Responding to legal requests: If we receive a valid and binding legal request (such as a subpoena, court order, or search warrant) for data, we may disclose the requested information. We will attempt to redirect such requests to you or notify you where legally permissible. Special higher standards apply to certain types of data (for example, under the Delaware Online Privacy and Protection Act’s “book service” provisions or under other privacy laws) – we will only disclose data in strict accordance with applicable laws.
  • Enforcing our agreements or policies: We may disclose information if necessary to investigate or remedy any violation of our Terms of Service or usage policies, or to investigate fraud or security issues. This may involve sharing data with our legal counsel or consultants.
  • Protecting safety: If we believe an individual’s safety is at risk or to prevent imminent physical harm or financial loss, we may share information with appropriate authorities or parties (for example, sharing information with law enforcement in exigent circumstances).
• Business Transfers: If TuneTaxi undergoes a business transaction such as a merger, acquisition, corporate reorganization, or sale of some or all assets, Personal Information may be transferred to the acquiring or successor entity as part of that transaction. We will ensure any such entity is bound to respect your Personal Information in a manner consistent with this Privacy Policy. If a transfer results in a material change in how your data will be used, we will notify you and/or provide an opportunity to opt-out or exercise your rights as permitted by law. Likewise, in the unlikely event of bankruptcy or insolvency, information may be transferred as a business asset subject to legal restrictions.
• With Your Consent: In cases other than those above, if we want to share your information, we will ask for your consent. For example, if we ever want to post a user testimonial or success story that includes Personal Information (like your name or photo), we would obtain your consent prior to doing so. You are in control of whether we share your information in ways not already described in this Policy.

No Unauthorized Third-Party Marketing: We do not disclose personal information to third parties for those third parties’ own direct marketing purposes unless you expressly agree. In accordance with California’s “Shine the Light” law and similar laws, if you are a California resident, you may request information about our disclosures of certain categories of information to third parties for their direct marketing. However, since we do not engage in such sharing, our response will confirm that we have not shared your personal information with third parties for their independent direct marketing purposes.

Additionally, we will never sell your personal information as “sell” is traditionally understood (exchange for money). We also will not “share” your personal information for cross-context behavioral advertising (as defined under California law) unless you opt in, and you have the right to opt out at any time. If in the future our practices change, we will update this Policy and provide required opt-out mechanisms (such as a “Do Not Sell or Share My Personal Information” link on our website).

International Data Transfers

TuneTaxi operates with users around the world, and your personal data may be processed in different countries depending on your location and where our service providers are located. We want to be clear about how we handle cross-border data transfers:

• Users in the European Union/EEA or United Kingdom: If you are an EU/EEA or UK user, your personal data is handled in compliance with European data protection laws. TuneTaxi does not transfer personal data from the EU/EEA to the United States or other countries outside the EU without adequate safeguards. We have structured our operations so that data from EU users is stored and processed on servers within the EU (or in other jurisdictions recognized by the EU as providing an adequate level of data protection). In practice, this means if you sign up from the EU, your account data and content remain on EU-based servers under our control. We do this to respect European privacy expectations and avoid the need for complex transfer mechanisms. If for any reason we need to transfer your data outside the EU/EEA (for example, to our U.S. headquarters or a service provider in another country), we will ensure appropriate safeguards are in place in accordance with GDPR Chapter V. These safeguards may include EU Commission-approved Standard Contractual Clauses (SCCs) or transferring only to organizations under an approved certification like the EU-U.S. Data Privacy Framework (if applicable in the future). We will also only transfer the minimum necessary data and will take steps to pseudonymize or encrypt data where possible.
• Users in the United States and Other Countries: If you reside outside of the EU and use our Service (for example, in the U.S., Canada, or elsewhere), your information will likely be processed and stored in the United States. We may also use cloud infrastructure or service providers located in other countries. By using the Service, you acknowledge that your personal data may be transferred to and processed in the United States or other jurisdictions which may have different data protection laws than your home country. We will protect all personal data as described in this Privacy Policy, wherever it is processed. For instance, if you are in Canada or another country with data export restrictions, we will comply with those requirements when transferring data to the U.S.
• No EU->US Transfers: To reiterate, we do not currently transfer data from EU residents to the U.S. without safeguards. Our company’s decision to keep EU data within the EU means that EU users’ data enjoys the strong protections of GDPR even at rest. If this policy changes, we will update this section and, if required, seek consent or provide additional means to ensure compliant transfers.
• Disclosure for Legal Reasons Across Borders: Please note that personal information stored in one jurisdiction may be subject to lawful access requests by courts, law enforcement, or other authorities in that jurisdiction. However, we will only comply with such requests where they are valid and after careful legal review. When fulfilling cross-border requests, we will also consider any conflict with the law of the country where the data originated (for example, EU data protection law).

In summary, regardless of where your data is processed, we apply the same level of care and security. We take into account the privacy laws applicable to the data (for example, GDPR for EU data) and use contractual and technical measures to ensure continued protection in any transfer scenario. If you have questions about international data handling, feel free to contact our Data Protection Officer (see Contact Us).

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law, whichever is longer. This means:

• Active Account Data: If you have an account with TuneTaxi, we will keep your personal information for as long as your account is active or as needed to provide you with the Service. This allows us to deliver your playlists, content, and other account functionalities each time you use TuneTaxi. If you remain an active user, we will retain your data to serve you.
• Inactive Accounts: If you stop using your account or request to deactivate it, we will initiate deletion of personal data associated with your account. In general, if your account is inactive for an extended period (e.g., 2 years), we may contact you to ask if you want to maintain the account; if not, we may delete or anonymize the data in accordance with our retention policy. We also periodically review our user data and will not keep data indefinitely without purpose.
• Account Deletion Requests: If you choose to delete your account (or specific personal data), we will promptly delete or anonymize your personal information, except for any data we are required or permitted to keep by law. Deletion of your data from our live systems will be completed within a reasonable timeframe (typically within 30 days). Please note that residual copies might persist in backup systems for a short period (e.g., backups are typically cycled every few weeks) but will be overwritten in the normal course of business, and we maintain safeguards to prevent restored backups from reintroducing deleted data into active databases.
• Transaction and Payment Records: We retain payment and transaction records as long as necessary for financial reporting and compliance (for example, tax laws may require retention of records for a number of years). Typically, we would keep subscription purchase records for at least 7 years (depending on local regulations). This may include records of invoices, payment dates, and the subscription plan, but not your full card details (which we do not store).
• Communications and Support: If you contacted us for support or we notified you of a policy update, we may retain those communications (including email correspondence or chat logs) for a certain period to ensure we have a record of your request and our response. These records are usually kept for a shorter period (a couple of years) unless needed for legal purposes.
• Analytics Data: Aggregate analytics data that does not directly identify individuals may be retained longer for historical analysis and to improve the Service. However, this data will not be linked back to an identifiable user once the retention period for raw data has passed.
• Legal and Security Retention: We may retain information for longer periods if we have a legal obligation to do so (such as retaining data involved in an investigation, a litigation hold, or in response to a government order) or if necessary for legitimate business interests such as fraud prevention or enhancing safety. For example, if we disable an account for violating our terms (e.g., for fraud or abuse), we might retain certain information about that account to prevent that user from re-registering or to support potential legal claims. Similarly, logs of security events may be kept longer to analyze and bolster our cybersecurity measures.

In all cases, when determining retention periods, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure if we keep it too long, the purposes of processing, and whether those purposes can be achieved through other means. When data is no longer needed, we either delete it or irreversibly anonymize it so it can no longer be associated with you. For anonymized data, we may use it for statistical purposes without further notice, since it no longer constitutes personal information.

Data Security

TuneTaxi takes data security very seriously. We implement a variety of technical and organizational measures to protect your Personal Information from unauthorized access, loss, misuse, or alteration. These measures include:

• Encryption: Our website is encrypted using HTTPS/TLS, which means the data transmitted between your device and our servers is protected in transit. For any sensitive data (such as passwords and payment information handled by Stripe), we ensure it is transmitted over secure channels. We also encrypt certain data at rest in our databases, especially sensitive fields, to add an extra layer of protection.
• Access Controls: We restrict access to personal data to authorized personnel who need it to operate our Service. Our staff and contractors are bound by confidentiality obligations. Administrative access to systems that contain Personal Information is limited to trained employees with a valid business need. We use measures like two-factor authentication and strong password requirements for our internal systems.
• Network & System Security: We maintain up-to-date security software and practices. This includes firewalls, intrusion detection systems, anti-malware protections, and system monitoring. We regularly update our software and dependencies to address security vulnerabilities, and we perform periodic security audits and penetration testing to evaluate the strength of our defenses.
• Data Minimization: Wherever possible, we minimize the personal data we collect and store. For example, as noted, we do not store full credit card numbers on our systems. By limiting the data in our possession, we reduce the risk exposure. We also pseudonymize or anonymize data where feasible, especially in analytics contexts.
• Employee Training: We train our team about the importance of privacy and security. We have protocols in place in case of a security incident, and employees know how to identify and report potential security issues. Our Data Protection Officer oversees compliance with relevant security standards and privacy regulations.
• Vendor Security: Before engaging any third-party service provider who will handle personal data, we vet their security practices. Our contracts with processors require them to implement appropriate security measures to protect personal data and to notify us promptly in the event of any data breach involving our users’ information. We only work with vendors who commit to compliance with strong data protection standards.

Despite our efforts, no method of transmission over the Internet or method of electronic storage is completely secure. Therefore, we cannot guarantee 100% security. However, we follow industry best practices to protect your data. In the unlikely event of a data breach that affects your personal information, we will notify you and the relevant authorities as required by law (for example, we will comply with any applicable breach notification laws in the U.S. and the EU, which might include informing you without undue delay if a breach is likely to result in a high risk to your rights). We also continuously update and refine our security procedures to counter new threats as they emerge.

You also play a role in keeping your information secure. We encourage you to use a strong, unique password for your TuneTaxi account and to keep your login credentials confidential. If you suspect any unauthorized access to your account or any security vulnerabilities, please contact us immediately at dpo@tunejacksy.com.

Children’s Privacy

As noted, TuneTaxi is not intended for children under the age of 13. We do not knowingly solicit, collect, or maintain personal information from anyone under 13 years old. In fact, our Terms of Service prohibit children under 13 from using the Service, and we strive to screen out and prevent under-13 users from registering. This policy is in accordance with the U.S. Children’s Online Privacy Protection Act (COPPA), which makes it unlawful for operators of websites or online services to collect personal information from children under 13 without verifiable parental consent.

If you are under 13, do not use or attempt to register for TuneTaxi. If we learn that we have inadvertently collected personal data from a child under 13, we will take prompt action to delete that information from our records. For example, if an under-13 user manages to create an account by falsifying their age, as soon as we are made aware (through a report or by detecting it in our systems), we will terminate the account and erase any personal data to the extent feasible.

For parents or guardians: If you discover that your child under 13 has an account on TuneTaxi or has provided personal information to us without your consent, please contact us at dpo@tunejacksy.com. We will take steps to delete the child’s personal information and (if applicable) close the child’s account.

For teens between 13 and 18: Our Service is generally intended for adult users and businesses, but teens 13 or older are allowed to use the Service with appropriate supervision and consent from a parent or guardian where required. We do not knowingly market or target our Service to anyone under 18 in a manner that would violate any youth privacy or advertising laws. For example, we avoid showing any inappropriate content or ads to minors and comply with restrictions on marketing to minors as required by law (such as Delaware’s privacy laws which restrict targeted advertising to minors without consent). If you are a minor (under 18), you should use TuneTaxi only with involvement of a parent/guardian. If you are in California and under 18 and have posted content on our Service that you want removed, please contact us as well – while our platform is not designed for personal social postings, we will honor applicable “minor eraser” laws to remove content by minors upon verified request.

In summary, we prioritize protecting children’s privacy and comply with all applicable laws such as COPPA. We do not knowingly collect data from children, and we do not profile or target children for any kind of advertising or other processing. We encourage parents to talk with their children about online safety and privacy.

Your Privacy Rights and Choices

You have important rights and choices regarding your personal information. Depending on your jurisdiction (for example, whether you are an EU/EEA resident, a California resident, a Delaware resident, or covered by another U.S. state law), different privacy rights may apply to you. TuneTaxi is committed to helping all our users exercise their privacy rights, and we provide tools or contact methods to do so.

Below, we outline the rights available and how you can exercise them:

Rights of Individuals in the European Economic Area (EEA) and United Kingdom

If you are in the EEA or UK, you have the following data subject rights under the GDPR (and UK GDPR). You can exercise these rights by contacting us (see Contact Us section). We will respond to any valid requests within one month (or inform you of any extension if needed, as allowed by law). These rights include:

• Right to Access: You have the right to request confirmation of whether we are processing your personal data, and if so, to request a copy of the personal data we hold about you. This is sometimes called a “Data Subject Access Request.” We will provide you with a copy of your data, along with information on how it’s used, in a commonly used format. For additional copies, we may charge a reasonable fee as permitted by law.
• Right to Rectification: You have the right to request that we correct any inaccurate or incomplete personal information we have about you. If any of your information (such as your name or contact info) has changed or is incorrect, please let us know. You can also correct and update some of your information directly by logging into your account settings (for example, you can update your profile details or email address on your own). For any other corrections, contact us and we will rectify the data.
• Right to Erasure (Deletion): You have the right to request that we delete your personal data. You can achieve a lot of this by using the “delete account” function on our platform (if available) or by contacting us for assistance. The right to erasure is not absolute – for example, we might retain certain information if needed for legal obligations or legitimate interests (we will inform you if that’s the case). But generally, if you ask for deletion of your data and there’s no lawful reason for us to keep it, we will comply and erase it. This is also known as the “Right to be Forgotten.”
• Right to Restrict Processing: You have the right to ask us to restrict or pause the processing of your personal data in certain circumstances. This could apply, for instance, if you contest the accuracy of the data (while we are verifying it) or if you object to our processing (pending our assessment of overriding interests). When processing is restricted, we will still store your data but not use it further until the issue is resolved.
• Right to Object: You have the right to object to our processing of your personal data when that processing is based on legitimate interests or involves direct marketing. For example, you can object to any profiling or analytics we perform under our legitimate interest ground if you feel it impacts your rights. If you object, we will stop that processing unless we have compelling legitimate grounds that override your rights or if it’s needed for legal claims. Importantly, you can always object to direct marketing – if you object, we will stop sending you marketing messages. (Note: you can also unsubscribe from marketing at any time by using the opt-out link in emails.)
• Right to Data Portability: You have the right to receive the personal data you have provided to us in a structured, commonly used, machine-readable format, and to have that data transmitted to another controller where technically feasible. This right applies to information processed by us by automated means, based on your consent or on a contract. If you need an export of your data, we can provide you a JSON or CSV file containing your account information, content, and other data that you have provided, to enable you to port it to another service if you wish.
• Right to Withdraw Consent: Where we rely on your consent to process your data, you have the right to withdraw that consent at any time. For example, you can withdraw consent for marketing emails by unsubscribing, or withdraw consent for cookies by adjusting your cookie settings. Withdrawing consent will not affect the lawfulness of any processing we did before withdrawal, and it won’t affect processing under other legal bases, but it will mean we stop the activities that relied on consent.
• Right to Lodge a Complaint: If you believe we have infringed your privacy rights or GDPR obligations, you have the right to complain to a supervisory authority (data protection regulator) in the EU/EEA or the UK. For example, if you are in the EU, you can contact the data protection authority in the country of your residence or where TuneTaxi might have an EU representative. We would, however, appreciate the chance to address your concerns directly before you do this – so we encourage you to contact us first, and we will do our best to resolve the issue.

How to Exercise (EEA/UK): You may contact us at dpo@tunejacksy.com to exercise any of the rights above. Please specify your request and include any relevant details that will help us fulfill it. We may need to verify your identity before acting on the request (to ensure that we don’t give your data to an unauthorized person). Verification might involve checking your email address or requiring additional information. There is generally no fee to exercise these rights, unless requests are manifestly unfounded or excessive (in which case, we may charge a reasonable fee or refuse the request, but we’ll explain why). We will respond to your request as quickly as possible, and in any event within the timeframe required by law (usually within 30 days).

California Privacy Rights (CCPA/CPRA)

If you are a resident of California, you have specific privacy rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). These rights, which we describe below, apply to personal information we have collected about you, subject to certain exceptions and limitations. The rights include:

• Right to Know: You have the right to request that we disclose the personal information we have collected about you and how we have used and shared it in the past 12 months. This includes the right to ask for: (1) the categories of personal information we have collected about you; (2) the categories of sources from which the personal information was collected; (3) our business or commercial purposes for collecting (or selling/sharing, if applicable) that information; (4) the categories of third parties to whom we disclosed your personal information; and (5) the specific pieces of personal information we have collected about you. Essentially, you can ask, “What information do you have about me and how have you shared it?” You may request this information up to twice in a 12-month period, free of charge. When we receive and verify a valid request to know, we will provide the required information for the preceding 12 months (or longer, to the extent permitted by law). Please note that certain information may be exempt from disclosure, for example if the disclosure would create a substantial, articulable risk to the security of the information or our systems.
• Right to Delete: You have the right to request that we delete personal information that we have collected from you. Upon receiving and confirming a verifiable deletion request, we will delete (and instruct our service providers to delete) your personal information from our records, subject to certain exceptions. Important: The law permits us to retain information that is necessary for specific purposes, even if you request deletion. For example, we may keep information needed to complete a transaction you requested, to detect security incidents, to comply with a legal obligation, or other such exceptions listed in Cal. Civ. Code § 1798.105(d). If any such exception applies, we will inform you in our response and limit retention to the allowed purpose. Otherwise, we will comply with your deletion request and confirm once completed. (If you maintain an account with us, a deletion request may require closing your account, as our Service cannot function without certain basic info.)
• Right to Correct: Under the CPRA amendments, you have the right to request that we correct inaccurate personal information we hold about you. Upon a verifiable request, we will use commercially reasonable efforts to correct the information, taking into account its nature and purpose. In many cases, you can correct your information directly (e.g., by editing your profile on our site). For other corrections, you can contact us and provide the correct data or indicate what is inaccurate, and we will rectify it in our systems.
• Right to Opt Out of Sale or Sharing: You have the right to direct us not to sell your personal information or share it for cross-context behavioral advertising purposes. “Sale” in this context means selling or licensing your personal information to third parties for monetary or other valuable consideration (we do not do this, as stated). “Sharing” means disclosing your personal info to third parties for cross-context behavioral advertising (targeted ads) whether or not for money. As of the date of this Policy, TuneTaxi does not sell or share personal information as defined by the CCPA/CPRA (we don’t trade your data for money or allow external ad targeting using your data). If that ever changes, we will implement a prominent “Do Not Sell or Share My Personal Information” link or mechanism on our website, and honor any California consumer’s request to opt out. We will also treat Global Privacy Control (GPC) signals from California residents’ browsers as opt-out of sale/sharing requests automatically. If you have enabled GPC in your browser, our site should detect it and process it accordingly (for example, by disabling any trackers that would sell/share data). If for some reason a sale or sharing is occurring and you want to ensure opt-out, you can also contact us to formally request it. Once we receive an opt-out, we will refrain from selling or sharing your data unless you later provide permission to do so.
• Right to Limit Use of Sensitive Personal Information: The CPRA gives you the right to limit how a business uses and discloses “sensitive personal information” (SPI) about you. SPI includes data like precise geolocation, account passwords, genetic data, etc. We do not collect or process sensitive personal information for any purposes that would trigger this right (we don’t use SPI to infer characteristics about you or for any secondary purposes). The limited sensitive data we might handle (for instance, payment card info, which is handled by Stripe, or a login password) is used only for providing the Service you expect. Therefore, there is no additional use of SPI for you to limit. If in future we engage in uses of SPI beyond what is necessary to provide the Service (for example, using precise location for new features), we will provide a “Limit Use of My Sensitive Personal Information” option and honor requests to limit usage to only what is necessary to perform the Service or comply with law.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights. This means we will not deny you our Service, charge you different prices, or provide a lesser quality of service just because you exercised your privacy rights. However, please note that if the exercise of your rights renders us unable to provide you with certain services (for example, if you ask us to delete all your data, we cannot provide your account anymore), that’s a consequence of your request, not discrimination. In any permitted scenario where offering a different price or service is related to your data (for example, a loyalty program that requires using some personal info), we would only do so if compliant with CCPA and we would explain the differences to you.

Exercising California Rights: If you are a California resident, you (or your authorized agent) can submit requests to know, delete, or correct by contacting us via dpo@tunejacksy.com. In the future, we may provide web forms or a dedicated toll-free number for CCPA requests and will update this Policy accordingly (the CCPA requires two methods for requests – because we operate primarily online with a direct relationship with users, an email method is sufficient for now under Cal. Civ. Code § 1798.130). When you submit a request, please:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information (or their authorized representative). This might be at least two or three data points we have on file (like your email, username, last transaction amount, etc.).
• Describe your request with enough detail that we can properly understand and respond to it.

We will verify your identity for these requests by matching information you provide with our records. If we cannot verify your identity from the information we have, we may ask for additional proof (we only use it for verification and deletion if applicable). If you have an account with us, we may ask you to submit the request through the account (if applicable) for additional verification.

If you designate an authorized agent to make a request on your behalf, we will need proof of that authorization. For example, the agent should provide a signed permission from you, and we may still verify your identity directly.

We aim to respond to California consumer requests within 45 days as the law requires. If we need more time (up to an additional 45 days, totaling 90 days), we will inform you of the reason and extension in writing. Our response will be delivered either through your account (secure inbox) or via email, depending on the nature of the data.

For requests to know or delete, we will cover the period of 12 months preceding your request, and identify the categories of data, sources, recipients, etc., as required. For deletion requests, we will specify how we deleted the data or if we must deny deletion of any item due to an exemption, we will explain that.

We do not charge a fee for processing your verifiable consumer requests. If for some reason a request is excessive or unfounded, the CCPA allows us to refuse or charge, but we will generally work with you to fulfill your request to your satisfaction.

Delaware and Other U.S. State Privacy Rights

Several U.S. states, including Delaware, have enacted comprehensive privacy laws that afford consumers rights similar to those in California and the EU. TuneTaxi’s policy is to extend applicable privacy rights to users in these states as required by law. If you are a Delaware resident (or a resident of states like Colorado, Connecticut, Virginia, etc.), you may have the following rights regarding your personal data under the Delaware Personal Data Privacy Act (DPDPA) and similar state laws:

• Right to Confirm and Access: You can request confirmation whether we are processing your personal data, and to access that data. This is similar to the “right to know/access” – you may ask for a copy of the personal information we maintain about you, and details about how we use it. Delaware’s law explicitly gives you the right to confirm if we process your data and to access it.
• Right to Correct: You have the right to correct inaccuracies in your personal data, taking into account the nature of the data and purpose of processing. If something we hold about you is wrong, let us know and we will fix it (see also our general notes on keeping your info updated).
• Right to Delete: You can request deletion of personal data you provided or that we obtained about you. Subject to certain exceptions (e.g., for legal compliance), we will delete your information upon your verified request.
• Right to Data Portability: You have the right to obtain a copy of the personal data you provided to us, in a portable and (to the extent technically feasible) readily usable format, so you can transmit it to another entity if you wish. We will provide this as a digital file (such as JSON or CSV).
• Right to Opt Out of Targeted Advertising, Sale, or Profiling: You have the right to opt out of:
  • Targeted Advertising: We will not process your personal data for targeted advertising purposes if you opt out. “Targeted advertising” means showing you ads based on your personal data obtained from your activities across nonaffiliated websites or apps. As noted, we currently don’t do this in any significant way, but if we ever do (e.g., using cookies to show retargeted ads on other platforms), Delaware residents (and others with similar laws) can opt out.
  • Sale of Personal Data: We do not sell personal data (exchange for money) as explained. If we ever consider selling data, you would have the right to opt out.
  • Profiling in Furtherance of Decisions with Legal or Similar Significance: This refers to automated processing to evaluate personal aspects and make decisions that produce legal or similarly significant effects (like denial of service, or something that affects your rights). TuneTaxi does not make any such automated decisions about users without human involvement. If that changes, you would have the right to opt out of such profiling.
• Right to List of Third-Party Categories: Uniquely under Delaware law, you have the right to request “a list of the categories of third parties” to which we have disclosed your personal data. In practice, our Privacy Policy already discloses categories of third-party recipients (see Sharing Your Information). If you would like to receive a specific list of categories of third parties that actually received your personal data, we will provide that (e.g., “payment processors, cloud hosting providers, analytics providers” etc., which is essentially what is in this Policy). Keep in mind this is not an itemized list of every company, but categories. Other states generally require only a general disclosure of categories of third-party recipients in the privacy policy, which we have done, but Delaware allows consumers to specifically request and obtain those categories tied to their data.
• Right to Appeal: If we decline to take action on a request you make under a state privacy law (for example, if we cannot comply with a deletion request due to an exemption, or we deny an access request), you have the right to appeal our decision. We will provide instructions in our response on how you can submit an appeal. Typically, you can do so by replying to our response or contacting us at the same email with a subject line indicating it’s an appeal. We will have a designated person (likely our DPO or legal team not involved in the initial decision) review the appeal and respond within the time frame required (commonly 45 days). If the appeal is denied, we will inform you of any further options, such as contacting the state Attorney General.

Exercising Delaware/State Rights: To exercise these rights, you may contact us at dpo@tunejacksy.com with your request. Please specify that you are a Delaware (or relevant state) resident and which right you wish to exercise. We will need to verify your identity similarly to the process described for California requests. That might involve confirming some information we have on file about you. For certain opt-out requests (like opting out of targeted advertising or sale), we may offer automated tools on our website if applicable (for instance, a cookie settings manager or a Do Not Sell/Share link, if those become relevant). Currently, since we don’t sell data, a simple email stating “Do not share my data for targeted advertising” or “opt-out of sale” with your identifying information (like the email associated with your account) will suffice and we will record that preference. Also, as noted, enabling Global Privacy Control in your browser is a recognized method to signal an opt-out of sale/sharing, which we honor for California and will honor for Delaware by January 1, 2026 as required (and we are honoring it already in practice).

We will respond to your state-law requests within the required period (generally 45 days). If needed, we may take a one-time extension of another 45 days (for a total of 90 days) but we will inform you of the delay and the reason. For Delaware specifically, the law becomes effective January 1, 2025, and we are prepared to comply from that date.

For residents of other states with privacy laws (such as Colorado, Connecticut, Utah, Virginia, etc.): although each law has its nuances, the core rights are very similar (access, correction, deletion, opt-out of targeted ads/sale, etc.). We intend to honor valid requests from residents of those states in a manner consistent with each law. If you reach out to us, we will apply the appropriate standards. For example, Virginia residents can opt out of targeted advertising and we will comply; Colorado residents have a right to appeal similar to Delaware’s and we will provide that. If you have any questions about whether a particular state law applies to you or how to exercise your rights, please contact us.

Note: We will not retaliate against you for exercising your rights. Our Service (with the exception of optional targeted features) is generally one-size-fits-all, and you will receive the same level of Service after exercising your rights as before. In some cases, exercising certain rights (like deletion or opt-out of certain processing) may affect your experience (for instance, deletion means you won’t have an account anymore, or opting out of personalization means you might not see content recommendations tailored to you), but we will explain those consequences at the time, and they are a result of your choice, not a punishment by us.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make changes, we will post the updated Policy with a new effective date at the top. If the changes are significant, we will provide a more prominent notice (such as by email to registered users or a notification on our website/app). For example, if we were to start collecting additional categories of personal data or start using data for a new purpose, we would update this Policy accordingly and notify you.

If required by applicable law (for instance, if a material change involves new uses of data collected under a prior policy), we will obtain your consent for the change. The U.S. Federal Trade Commission considers material retroactive changes to privacy practices, without consent, to be an unfair and deceptive practice, and we intend to follow that principle. That means we will not materially reduce your privacy rights without obtaining your consent.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information. The “Effective Date” at the top indicates when this Policy was last revised. By continuing to use the Service after any changes take effect, you are deemed to have accepted the updated Privacy Policy. If you do not agree with any updates or changes, you should stop using the Service and may request that we delete your data.

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal information, please do not hesitate to contact us. Our Data Protection Officer (DPO) is responsible for overseeing questions in relation to this Privacy Policy and data protection at TuneTaxi.

• Email: You can reach our DPO and privacy team at dpo@tunejacksy.com. This is the dedicated email address for all privacy-related inquiries, including exercising your rights, asking questions about our data practices, or raising concerns.
• Postal Mail: If you prefer, you may also write to us at:
  TuneTaxi Inc. – Privacy Office
  1234 Market Street, Suite 100
  Wilmington, DE 19801, USA (Please include “Attn: Data Protection Officer” in your correspondence. Note that postal inquiries may take longer for us to receive and respond.)
• EU/UK Representative: [If applicable] Because we actively offer services to EU residents, we have appointed an EU representative in accordance with GDPR Article 27. You may contact [Name of EU Rep/Company] at [contact details] if you are in the EU and wish to reach us via our representative. (Note: This line is a placeholder – if we have an EU rep, their details would be provided here.)

We will address all requests or concerns as soon as possible. If you email us, please allow us a few business days to respond (and check your spam folder if you don’t see our reply). We’re committed to resolving any issues you have. If you feel that we have not addressed your privacy-related concern satisfactorily, you may also contact your local data protection authority (for EU/UK users) or state Attorney General’s office (for U.S. users) as appropriate.

Thank you for trusting TuneTaxi with your audio journey. We value your privacy and are dedicated to safeguarding your personal information while providing you with a great service.

Last Updated: January 17, 2026

Sources:

• Delaware Online Privacy and Protection Act – requirements for privacy policy disclosures
• Delaware Personal Data Privacy Act – consumer rights (effective Jan 1, 2025)
• California Consumer Privacy Act (as amended by CPRA) – summary of consumer rights by CA DOJ
• EU GDPR Articles 13-14 – required contents of a privacy notice (purposes, legal bases, data subject rights, etc.)
• GDPR data subject rights descriptions
• Children’s Online Privacy Protection Act (COPPA) – prohibition on collecting data from children under 13 without consent
• FTC Privacy Guidance on material changes to data practices (preventing retroactive use without consent)
• FTC and state laws requiring reasonable security measures to protect personal data