Privacy
policy.

When you book a ride, request a quote, or contact us, we collect:

• Contact information. Your name, email address, and phone number. Your phone number is required to send the SMS messages described in section 3.
• Ride details. Pickup and dropoff addresses, date and time, passenger count, optional flight number, and special instructions to the chauffeur.
• Payment metadata. The last four digits of your card and a payment-processor reference. We do not store full card numbers, CVV, or banking details. Card processing is handled by Stripe (stripe.com/privacy).
• Communications log. Copies of confirmation, reminder, receipt, payment-request, and review-request emails and SMS we send to you, along with delivery status returned by our messaging providers.
• Server logs. When you visit our website our hosting provider records minimal technical data (IP address, user agent, timestamp, and the URL requested) for security and abuse-prevention purposes. We do not use this data for advertising or analytics profiling.
• AI-assisted quotes and availability. When an AI assistant requests a quote or availability check, we process the requested route, pickup time, service type, passenger count and hours. Transfer addresses are sent to our mapping provider to estimate the route. We retain a private request summary, including those trip details, the result and any returned USD estimate, for a rolling 30 days to review ride inquiries and troubleshoot service. Summaries are accessible only to authorized operators; they exclude contact details, conversation text, IP addresses, payment credentials and private checkout links. Expired summaries are removed on the next admitted AI request. We also keep aggregate request counts. Quotes and availability checks do not create a reservation or authorize payment.
• Website usage. On public pages, Vercel Web Analytics measures basic page visits for U.S. visitors unless they opt out. Google Analytics, interaction events and browser-based booking-source measurement require permission. Outside the U.S., or when the region is unknown, all of these measurements require permission. This includes public page paths, referring websites, browser and device information, and Google Analytics cookie identifiers. Our analytics events exclude names, email addresses, phone numbers, trip addresses, payment details, and private reservation links. See section 8.

• To confirm, schedule, dispatch, and complete your ride.
• To send transactional SMS and email messages about your reservation (see section 3).
• To process payments, refunds, and disputes.
• To respond to questions and feedback.
• To understand public website usage and improve the booking experience.
• For required business records: bookkeeping, tax filings, and any reports required of us as a licensed ground-transportation carrier.

Phone numbers are collected on our booking form to enable the SMS messaging program described below. By checking the optional SMS opt-in box on our booking form, you consent to receive SMS messages from Black Car Service related to your reservation. This consent is not required to book a ride or use our services.

Categories of SMS messages we send:

• Booking confirmations — sent immediately after you book.
• Ride reminders — sent before pickup.
• Receipts — sent after a completed trip.
• Review requests — sent shortly after a completed trip.
• Payment requests — sent when an outstanding balance is due.
• Cancellations — sent if a reservation is cancelled or rescheduled.

Message frequency. Frequency varies based on your bookings and account activity. A single trip typically generates between two and six messages.

Opt out — reply STOP. You can cancel SMS messages at any time by replying STOP to any message we send. After you send STOP, we will send one confirmation message and then stop sending you SMS. You will continue to receive any required transactional emails for active reservations.

Help — reply HELP. For help, reply HELP to any of our messages, or contact us at bookings@blackcarservice.co or 415-622-8765.

Carrier disclosure. Message and data rates may apply. Black Car Service is not responsible for delayed or undelivered messages caused by your wireless carrier. Supported carriers include AT&T, T-Mobile, Verizon, and most U.S. carriers; carriers are not liable for delayed or undelivered messages.

We do not sell, rent, or share opt-in information or phone numbers with third parties or affiliates for marketing or promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

To run our business we share specific data with the following processors. Each is contractually required to use the data only for the purpose described:

• Stripe — payment processing.
• Twilio — sending SMS messages (confirmations, reminders, receipts, review requests, payment requests, cancellations).
• Resend — sending transactional email.
• Google Maps — address autocomplete and route distance for pricing.
• Google Calendar — operator-side scheduling of confirmed reservations.
• Supabase — application database and storage.
• Google Analytics and Vercel Web Analytics — public website usage and booking-funnel measurement, as described in section 8.

We do not sell your information, and we do not share it for advertising or marketing purposes. As stated in section 3, phone numbers and SMS opt-in information are never shared with third parties for marketing.

We keep ride records and associated communications for the period required by U.S. tax and applicable carrier-licensing rules — generally seven years from the date of the ride — after which they are deleted or anonymized. SMS opt-out records are retained as long as needed to honor your opt-out.

Depending on where you live, you may have the right to:

• Know what personal information we have about you.
• Request a copy of that information in a portable format.
• Request that we correct inaccurate personal information.
• Request that we delete it (subject to the legal records retention noted in section 5).
• Opt out of any sale or sharing of your personal information — though we do not sell or share it for advertising or marketing in the first place.
• Limit our use and disclosure of any sensitive personal information (we do not collect sensitive personal information as defined under California law).
• Opt out of our SMS program at any time by replying STOP.
• Not be discriminated against for exercising these rights.

To exercise any of these rights, email bookings@blackcarservice.co or call 415-622-8765. We will verify your identity by asking you to confirm information we already have on file (such as a recent reservation ID, the email address used to book, and the phone number used to book) before we disclose, correct, or delete records. We will acknowledge requests within 10 business days and substantively respond within 45 days, with one 45-day extension when reasonably necessary.

You may use an authorized agent to submit a request on your behalf. The agent must provide written, signed authorization, and we may still ask you to verify your own identity before we act on the request.

This section supplements the rest of this policy and applies to California residents under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (collectively, “CCPA/CPRA”). The lookback period for the disclosures below is the 12 months preceding the “Last updated” date at the top of this page.

Categories of personal information we collect. Using the categories defined in California Civil Code § 1798.140, in the past 12 months we have collected:

• Identifiers — name, postal/billing address, email address, telephone number, and an internal customer ID.
• Customer records (Cal. Civ. Code § 1798.80(e)) — name, contact information, and limited payment metadata (last four digits of card, payment-processor reference). We do not store full card numbers, CVV, or banking details.
• Commercial information — records of rides booked, cancellations, and amounts paid.
• Geolocation data — pickup and dropoff addresses you supply on the booking form. We do not collect precise (GPS-level) location from your device.
• Internet or other electronic network activity — minimal request logs (IP address, user agent) generated by our hosting provider for security and abuse-prevention purposes, plus public website usage and interactions described in sections 1 and 8.
• Inferences — none. We do not build profiles or score customers.

We do not collect the following categories: biometric information, audio/electronic/visual information, professional or employment-related information, education information (FERPA), or genetic data. We do not collect “sensitive personal information” as defined under the CPRA (such as government identifiers, financial-account login credentials, precise geolocation, race or ethnicity, religious beliefs, union membership, contents of mail/email/text not directed to us, genetic data, biometric identifiers, or health/sex-life information), and therefore the right to limit use of sensitive personal information does not have any effect on our processing.

Sources. The personal information above comes directly from you when you submit our booking form, request a quote, contact us by email or phone, or pay an invoice. Limited technical data is generated by your interaction with our website (server logs and public website analytics).

Business or commercial purposes. We process personal information to: (a) confirm, schedule, dispatch, and complete your ride; (b) process payments, refunds, and disputes; (c) send the transactional SMS and email messages described in section 3; (d) keep books, file taxes, and produce records required of a CPUC-licensed ground-transportation carrier; (e) detect and prevent fraud, abuse, and security incidents; (f) respond to your questions and feedback; and (g) understand public website usage and improve the booking experience.

Categories of recipients. In the past 12 months we have disclosed each category of personal information listed above for the business purposes described to the service providers identified in section 4 (Stripe, Twilio, Resend, Google Maps, Google Calendar, Supabase, Google Analytics, and Vercel Web Analytics). Each is bound by a written contract that prohibits using the information for any purpose other than performing the service on our behalf.

No sale or sharing of personal information. We do not sell personal information and we do not “share” personal information for cross-context behavioral advertising, in either case as those terms are defined under the CCPA/CPRA. We have not done so in the past 12 months. Because we do not sell or share, there is no “Do Not Sell or Share My Personal Information” link to follow — the answer is already no — but you may confirm this at any time by contacting us at the address in section 11. We do not knowingly sell or share personal information of consumers under 16 years of age.

No financial incentives. We do not offer financial incentives or price/service differences in exchange for personal information.

How to submit a CCPA/CPRA request. California residents can use either of two methods:

• Email bookings@blackcarservice.co with the subject line “California privacy request”; or
• Call us at 415-622-8765 and ask for the privacy contact.

We will use the verification process described in section 6 and will not discriminate against you for exercising your rights. If we deny a request in whole or in part, we will explain why.

California “Shine the Light” (Cal. Civ. Code § 1798.83). California residents may request, once per calendar year, information about personal information we disclosed during the prior calendar year to third parties for those third parties’ own direct marketing purposes. We do not disclose personal information to any third party for that purpose, so the response to a Shine-the-Light request is “none.”

Notice of right to opt out of automated decision-making. We do not use personal information to make solely automated decisions that produce legal or similarly significant effects about you.

Customer data is stored in encrypted databases. We use HTTPS for all traffic between your browser and our servers. Access to operator tools is restricted to authorized personnel. No system is perfectly secure; if we discover a breach affecting your data, we will notify you in line with applicable law.

You can browse, request a quote, book and pay without allowing optional analytics. For U.S. visitors, basic Vercel page-view statistics are on by default without analytics cookies. You can turn them off through “Privacy choices” by selecting “Decline optional.” Google Analytics, interaction and performance events, and browser-based booking-source measurement stay off until you select “Allow analytics.” Outside the U.S., or if we cannot determine the region, all analytics stays off until you allow it. Declining has no effect on your price or service. We do not use third-party advertising trackers.

Select “Privacy choices” on a public page to change your decision at any time. Withdrawing permission stops future optional measurement and removes accessible Google Analytics cookies and our booking-source browser records. It does not erase information already received; use the privacy-request contact below to request deletion. Global Privacy Control and Do Not Track signals turn optional analytics off, even if you previously allowed it. We honor saved declines, including choices made before this update, for the lifetime of the preference cookie. Closing the choices panel does not grant permission or change your saved choice.

Our hosting provider supplies an approximate country from the request to choose the default. This check returns only whether U.S. basic page counts are available; we do not store the country in your browser or use precise device location. A privacy signal or saved decline overrides the regional default.

• Your choice — bcs_privacy_v1. A first-party cookie remembers allow or decline, the notice version and the time of your choice for up to 180 days. It contains no visitor ID or contact details. This preference cookie is used only to honor your choice and is not optional analytics.
• Booking and security storage. Browser session storage keeps booking drafts and retry keys so you can complete your request without accidental duplicate submissions. Authentication cookies support operator sign-in. Payment providers may use storage required to process payments and prevent fraud. These functions remain available when analytics is declined.
• Google Analytics — _ga and _ga_*. If you allow analytics, Google receives public page paths, referring website information, browser/device information and interaction events. Its first-party cookies distinguish browsers and sessions. We configure a maximum cookie lifetime of 180 days without automatic renewal. Browser restrictions can shorten this. Google advertising personalization and Google signals are disabled in our tag. Learn about Google’s processing of information.
• Vercel Web Analytics. Basic measurement receives public page visits, referring websites, approximate location, and browser/device information. It does not use analytics cookies. Vercel derives a temporary visitor hash from incoming requests and discards its visitor session after 24 hours; this does not mean aggregate reports are deleted after 24 hours. Interaction and performance events are sent only if you allow analytics. See Vercel’s Web Analytics privacy information.
• Booking-source storage. With permission, bcs:listing-attribution:v1 and bcs:booking-source:v1 in session storage remember a fixed source label and a 30-minute inactivity expiry within the browser tab. Labels can indicate a Google Business Profile link, search or other referral, or direct/unknown. Closing the tab clears these records. We do not store raw URLs, search terms, campaign parameters or contact details in them.

When you submit a reservation with browser-source measurement enabled, we may attach the source category to that reservation for source and booking-outcome reporting. It is retained with the reservation under section 5. An explicit AI booking handoff can also identify its booking channel independently of browser analytics. Source labels are not proof of a person’s identity or their original discovery of our service.

Our analytics events exclude names, email addresses, phone numbers, trip addresses, payment details and private reservation links. We strip query parameters from measured page addresses and exclude private trip, invoice, quote, payment and operator pages. Automatic form and outbound-link measurement is off. Cookie expiry is separate from retention of information already received by an analytics provider. You can also manage cookies and browser storage in your browser settings. Blocking storage will not require you to enable analytics to book.

Our service is for adults booking rides. Children may ride as passengers in accordance with applicable car-seat laws. We do not knowingly collect personal information directly from children under 13.

If we make a material change to this policy, we will update the “Last updated” date and, where appropriate, notify customers with active reservations by email.

Black Car Service LLC
1401 21st St STE R, Sacramento, CA 95811, US
Privacy requests: bookings@blackcarservice.co
Customer service: 415-622-8765 · bookings@blackcarservice.co