Your trips are yours.

Byway Technologies LLC (“Byway”, “we”, “us”) is a U.S. company building the Byway AI scenic routing app. This policy covers the Byway mobile apps, web app, and www.byway.world.

We collect only what we need to make Byway work:

• Account data — name, email, password hash, billing info (handled by Stripe).
• Location data — live location while you use the app, plus saved start/destination pairs for route generation.
• Trip content — journeys, photos, voice notes, receipts, and journal entries you create.
• Usage signals — which stops you visit, skip, or save, so routes get better over time.
• Device + diagnostic data — OS version, crash logs, anonymized performance metrics, and the country inferred from the request IP solely to select the analytics rule.

• Generate scenic routes, narration, and recommendations.
• Improve model quality using anonymized, aggregated data.
• Provide customer support and fulfill subscriptions.
• Detect fraud, abuse, and security threats.
• Send you transactional emails (receipts, password resets). We will never sign you up for marketing without explicit opt-in.

• Sell personal data, location data, or usage data.
• Share private journeys or gated content with advertisers, data brokers, or third-party analytics platforms.
• Feed your private content into third-party AI training sets.

We don’t use advertising or cross-site tracking cookies. For requests from the United States, Amplitude product analytics may run by default on public pages; session recordings stay off until you choose “Allow analytics & recordings.” Everywhere else, Amplitude stays off until you make that choice. If we can’t determine the country, we ask first. A stored refusal always wins, and Global Privacy Control keeps optional analytics off. Change your choice any time via “Cookie settings” in the footer. What we use:

• Strictly-necessary cookies — your signed-in session, the investor-access gate, and a marker recording that you asked to join the private beta so the door doesn't ask you again. They're required to log in, to reach gated pages, and to show you your own status; the site can't work without them.
• Functional browser storage — small preferences kept on your own device (your light/dark theme, and in-app choices like trip time and route style). They stay in your browser, carry no identifier, and are never shared.
• Referral marker — if you arrive from an AI assistant, we keep a short note of that on your device for 30 days. If you then save a drive, that note is stored with it, so we can tell how travellers find Byway. It records the kind of source only — never which assistant, which account, or anything about you.
• Privacy-friendly analytics — we count page views with a cookieless analytics service: it stores nothing on your device and never tracks you across other sites.
• Product analytics — Amplitude uses first-party identifiers and records page, session, attribution, click, download, frustration, and performance events on public pages so we can see what is worth improving; its automatic form-interaction and network-request capture is off. For U.S. requests, these analytics may run by default; otherwise they require permission. Session recordings are never enabled from location alone. After you choose “Allow analytics & recordings,” they may reconstruct all eligible public-page sessions, including clicks and scrolling; conservative masking hides page text and inputs. Turning analytics off stops Amplitude immediately and prevents it from loading on the next page lifecycle. Never used for ads or cross-site tracking.
• Analytics storage — Byway’s privacy-choice cookie and Amplitude identifier cookies expire after 182 days unless you clear them sooner. Session recordings use memory-only browser storage while the page is open and do not persist replay events in browser storage between page loads. Provider-side analytics and recordings are retained only as long as needed to evaluate and improve the public site, respond to privacy requests, and meet legal obligations; the exact production retention schedule must be approved before general availability.

Interactive maps and location features connect to third-party mapping providers (see Sub-processors) to draw the basemap and find places. Like any web request, those share your IP address with the provider to return the data, but they set no cookies and aren’t used to track you.

Byway relies on a small set of service providers to run the app, each seeing only the data its function requires. We describe them by the function they perform; we name a provider only where it’s standard practice to, such as payments.

• Cloud hosting, database & file storage — encrypted, U.S.-based infrastructure
• Authentication — sign-in and session management
• Payments — Stripe (we never see your full card number)
• Mapping & places-data providers — basemap tiles and point-of-interest data
• AI routing provider — scenic route generation
• Voice synthesis — narration audio
• Transactional email — receipts and account messages
• Cookieless analytics — aggregate page-view counts
• Product analytics (Amplitude) — default-on for eligible U.S. requests, opt-in elsewhere; session replay always opt-in

You can request access, correction, export, or deletion by emailing legal@byway.world; requests are subject to identity verification and applicable legal exceptions. We aim to respond within the period required by applicable law. You can turn product analytics off at any time through “Cookie settings,” and we honor Global Privacy Control by disabling optional analytics. Depending on where you live and which laws apply, you may also have rights to restrict or object to processing, opt out of sale or sharing, targeted advertising, or qualifying profiling, and appeal a denied request. We do not sell personal data or use it for targeted advertising.

When you submit the attestation form at /investors/access, we collect and store:

• Full legal name.
• Email address.
• Firm or affiliation (if provided).
• Your self-attestation that you qualify as an accredited investor under Rule 501 of Regulation D.
• Your self-attestation that you have read and accept the disclaimers and risk factors.
• Your self-attestation that you understand the investor pages do not constitute an offer or solicitation.
• Your IP address and user-agent string.
• The timestamp at which the attestation was submitted.

We use this information as evidence of screening, to comply with the recordkeeping expectations under Rule 506 of Regulation D, to communicate with investor-prospects about the offering, and for any future accredited-investor verification required by securities counsel. We do not sell investor-prospect data, do not use it for consumer product marketing, and do not share it with advertising partners.

We retain investor-prospect records for five years from the date of submission, consistent with the recordkeeping expectations under Rule 506 of Regulation D. If you request earlier deletion, we will evaluate the request against our legal recordkeeping obligations and respond within 30 days.

Byway is not directed at children under 13. We don’t knowingly collect data from them. If you believe a child has shared data with us, write to us so we can investigate and take the steps required by applicable law.

If we change this policy, we’ll post the updated version here and email existing members at least 30 days before it takes effect.

Questions or requests? Email legal@byway.world.