Privacy Policy
Intended audience: Customers, passengers, website/app users, and corporate travelers
Legal entity: Elevate Mobility Group LLC d/b/a XVIA USA
Principal business address: 411 Theodore Fremd Ave, Ste 206, Rye, NY
Proposed effective date: August 8, 2026
1. Scope and Categories of Information
XVIA may collect account/profile information, contact information, authentication data, saved addresses, accommodation requests voluntarily provided, corporate affiliation, trip/reservation information, precise or approximate location where permitted, payment and transaction information, device/application information, support communications, photographs/documents voluntarily submitted, and other information reasonably necessary to operate the platform.
XVIA should not request access to a customer's full device contact list, microphone, government identification, advertising identifiers, or other sensitive device permissions unless a launched feature genuinely requires that data and the required notice/permission has been implemented.
2. Location and Trip Information
Location information may be used to identify pickup/destination locations, calculate routes, distance, time and estimated fares, coordinate passenger/provider pickup, provide trip status, support safety, prevent fraud, investigate disputes, and improve service.
Trip records may include requested and actual pickup/drop-off times, route, distance, duration, provider/vehicle information, passenger information, flight information, stops, waiting time, tolls, airport/facility information, fare/payment data, cancellation/no-show status, special instructions, trip communications, and support records.
3. Payments
Payment data may be processed by authorized third-party payment processors. XVIA may receive tokens and limited card information such as brand, expiration information, and last four digits without directly storing full card numbers or card security codes, depending on implementation.
Potential payment providers identified by XVIA include Stripe and Square; the final Privacy Policy must identify only providers actually implemented and accurately describe the data flows.
4. Device, Analytics, Diagnostics and Advertising
XVIA and authorized providers may collect device type, operating system, app version, IP address, language, time zone, network information, session/activity information, errors, crashes, and performance data needed to operate, secure, troubleshoot, and improve the platform.
Analytics, crash reporting, advertising/attribution, and related providers are currently TBD. The production Privacy Policy should not claim use of a provider or tracking category until the feature is actually implemented and counsel/developers confirm the disclosure and consent requirements.
5. Mapping, Communications, Cloud and Support Providers
XVIA may use mapping/routing providers such as Google Maps Platform and Apple Maps, plus communications, push notification, cloud hosting, customer-support, fraud-prevention, and security providers. Specific providers remain TBD unless actually selected.
Where possible, XVIA should minimize identifying information sent to a mapping provider when only geographic coordinates are needed.
6. Drivers and Screening
Driver applicants and providers may be subject to a separate Driver Privacy Notice covering identity, licensing, insurance, vehicle, regulatory, background-screening, driving-record, payment, tax, location, and platform-activity information. Background/screening providers are currently TBD.
7. Service Providers Authorized to Process Information
XVIA may authorize service providers, contractors, processors, technology vendors, payment processors, mapping/location providers, communications providers, cloud providers, analytics providers, support providers, fraud-prevention providers, screening providers, professional advisers, and other vendors to access, receive, store, transmit, use, disclose, or otherwise process information on XVIA's behalf to the extent reasonably necessary to perform contracted services, support operations, protect users, process transactions, provide requested functionality, or comply with legal obligations.
Such authorization does not grant ownership of XVIA customer information or unrestricted authority to use information for unrelated purposes. Contractual and legal restrictions should be implemented appropriate to each vendor relationship.
8. Disclosures for Safety, Legal Process and Corporate Travel
XVIA may disclose information to a provider as reasonably necessary to perform an assigned trip; to a corporate customer or authorized administrator for eligible corporate travel and billing; to insurers/claims administrators in connection with incidents; and to law enforcement, courts, regulators, or governmental authorities when legally required or otherwise permitted by law.
XVIA may preserve relevant records when reasonably necessary for safety, fraud prevention, dispute resolution, litigation holds, insurance matters, regulatory compliance, or enforcement of agreements.
9. Retention, Security and User Rights
XVIA should retain personal information only for periods reasonably necessary for the purposes described, legal/accounting requirements, safety, fraud prevention, disputes, and legitimate business needs. The final retention schedule must be aligned with actual systems and applicable law.
XVIA should use reasonable administrative, technical, and physical safeguards appropriate to the nature of the information. No security system can guarantee absolute security.
The final policy must include the privacy rights, request methods, appeal rights, authorized-agent rules, and state-specific notices required by laws applicable to XVIA's actual users and processing practices.
10. Contact
Privacy requests and questions should be directed to a dedicated privacy channel before launch. Until XVIA designates one, counsel should decide whether [email protected] or [email protected] will receive privacy requests.
Legal notice address: 411 Theodore Fremd Ave, Ste 206, Rye, NY.