Effective date: August 16, 2021

This Privacy Policy describes how Pony.ai, Inc. and our subsidiaries and affiliates (collectively "Pony.ai," "we", “us” or "our") handles personal information that we collect though our website, mobile application, other digital properties that link to this Privacy Policy, or our other services (collectively, the “Service”). This Privacy Policy also governs personal information we collect in connection with our marketing activities, through our social media accounts, and through other activities described in this Privacy Policy.

1. Personal information we collect
2. How we use your personal information
3. How we share your personal information
4. Your choices
5. Other sites and services
6. Security
7. International data transfer
8. Children
9. Changes to this Privacy Policy
10. How to contact us
11. Information for California residents

Information you provide to us. Personal information you may provide to us through the Service or otherwise, includes:

1. Account data, such as your name, email address, phone number, username, user avatar, preferences (including preferred trip locations), trip data, and any other information that you add to or is associated with your account profile.
2. Communications that we exchange when you contact us with questions, feedback, for support or otherwise, which may include recordings of customer support calls where permitted by law.
3. Marketing data, such as your preferences for receiving communications about our products, services, activities and events, information you provide in response to our marketing communications, and information you provide when participating in our events or surveys.
4. Other information that we may collect which is not specifically listed here, which we will use as described in this Privacy Policy or as otherwise disclosed at the time of collection.

Third party sources. We may combine personal information we receive from you with personal information we obtain from other sources, including:

1. Account holders who order rides or deliveries for you if you do not order them yourself.
2. Data licensors, such as demographic data providers.
3. Delivery partners, such as certain retailers, restaurants, and others for whom we provide delivery services. For example, our delivery partners may share with us your name and address to facilitate our deliveries to you, and your phone number so we can contact you about your order.

Automatic data collection. We, our service providers, and our business partners may automatically log information about you, your computer or mobile device, your activity on our Service, and our vehicles such as:

1. Usage data, related to your use of our Service, such as your order details, ride pickup and drop-off locations, route, date and time the service was provided, distance traveled, your interactions with our in-vehicle interfaces, delivery information, and photographs of delivery confirmations.
2. Device location data when you authorize our mobile application to access your device’s precise location, such as your pickup and drop-off location. We collect device location data when you use the app with location services enabled.
3. Vehicle sensor data, such as the locations of our vehicles when giving rides or making deliveries and data collected from LiDARs, cameras, radar, and other sensors on our vehicles, which we may associate with your personal information.
4. Device data, such as your computer’s or mobile device’s operating system type and version, manufacturer and model, browser type, screen resolution, RAM and disk size, CPU usage, device type (e.g., phone, tablet), IP address, unique identifiers (including identifiers used for advertising purposes), language settings, mobile device carrier, radio/network information (e.g., WiFi, LTE, 3G), and general location information derived from your IP address, such as city, state or region.
5. Online activity data, such as pages or screens you viewed, how long you spent on a page or screen, the online services you visited before browsing to the Service, navigation paths between pages or screens, information about your activity on a page or screen, access dates and times, and duration of access.
6. Audio data, such as in-vehicle recordings that we make during trips, and audio we may record in our vehicles where permitted by law.

Cookies and similar technologies. Like many online services, we use the following technologies:

1. Cookies, which are text files that websites store on a visitor’s device to uniquely identify the visitor’s browser or to store information or settings in the browser for the purpose of helping you navigate between pages efficiently, remembering your preferences, enabling functionality, helping us understand user activity and patterns, and facilitating analytics and online advertising.
2. Local storage technologies, like HTML5 and Flash, that provide cookie-equivalent functionality but can store larger amounts of data, including on your device outside of your browser in connection with specific applications.
3. Web beacons, also known as pixel tags or clear GIFs, which are used to demonstrate that a webpage or email was accessed or opened, or that certain content was viewed or clicked.
4. Software development kits, or SDKs, which are used to incorporate third party computer code into our app that allows our third-party service providers or advertising partners to collect user data directly from the app for a variety of purposes, including to provide us with analytics regarding the use of the app and add features or functionality to our app.

These cookies and similar technologies may be employed for the following purposes:

1. Analytics. Help us understand how our services are performing, being used, and to provide support. These cookies may work with web beacons included in emails we send to track which emails are opened and which links are clicked by recipients.
2. Essential. Necessary to allow the technical operation of our services (e.g., remember preferences you set or information you entered on a previous page).

We use your personal information for the following purposes or as otherwise described at the time we collect it:

Service delivery. We use your personal information to:

1. provide, operate and improve the Service and our business;
2. verify your identity;
3. establish and maintain your user profile on the Service;
4. enable security features of the Service, such as by sending you security codes via email or SMS, and remembering devices from which you have previously logged in;
5. enable personalization of your Service account, such as creating quick access to recent pickup locations, destinations or retail locations for orders, or allowing users to favorite places;
6. communicate with you about the Service, including by sending ride or delivery status updates, announcements, updates, security alerts, and support and administrative messages;
7. understand your needs and interests, and personalize your experience with the Service and our communications;
8. provide support for the Service, and monitor and improve our customer support responses and processes; and
9. respond to your requests, questions, and feedback.

Research and development. We may use your personal information for research and development purposes, including to analyze and improve the Service and our business. This helps us to improve and enhance the safety and security the Service and develop new features and products. As part of these activities, we may create aggregated, de-identified or other anonymous data from personal information we collect. We make personal information into anonymous data by removing information that makes the data personally identifiable to you. We may use this anonymous data and share it with third parties for our lawful business purposes, including to analyze and improve the Service and promote our business.

Marketing. We may send you Pony.ai-related or other direct marketing communications as permitted by law. You may opt-out of our marketing communications as described in the Opt-out of marketing section below.

Compliance and protection. We may use your personal information to:

1. comply with applicable laws, lawful requests, and legal process, such as to respond to subpoenas or requests from government entities;
2. protect our, your or others’ rights, privacy, safety or property (including by making and defending legal claims);
3. audit our internal processes for compliance with legal and contractual requirements and internal policies;
4. enforce the terms and conditions that govern the Service; and
5. prevent, identify, investigate and deter fraudulent, harmful, unauthorized, unethical or illegal activity, including cyberattacks, identity theft, and vehicle accidents.

Retention. We generally retain personal information to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements, to establish or defend legal claims, or for fraud prevention purposes. To determine the appropriate retention period for personal information, we may consider factors such as the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements.

When we no longer require the personal information we have collected about you, we may either delete it, anonymize it, or isolate it from further processing.

We may share your personal information with the following parties and as otherwise described in this Privacy Policy or at the time of collection:

Affiliates. Our corporate parent, subsidiaries, and affiliates, to help us provide our services or process data on are behalf in a manner consistent with this Privacy Policy.

Delivery partners. Retailers, restaurants, and others for whom we provide delivery services, with whom we may share details about deliveries, such as status and confirmation of deliveries (including photographs of delivery confirmations) or about communications with you about your order.

Account holders. A Service account holder that orders a ride or delivery for you will be able to access order or trip information, including real-time precise location data.

Other people at the user’s request. We may share your ETA and location with a friend when requested by you.

Service providers. Companies and individuals that provide services on our behalf or help us operate the Service or our business (such as information technology, information security, payment processing, hosting and cloud storage, customer relationship management and support, print and mail fulfillment, email delivery, advertising, marketing, data analytics, consumer research, identity verification, and vehicle technology and operations).

Professional advisors. Professional advisors, such as lawyers, auditors, bankers, and insurers, where necessary in the course of the professional services that they render to us.

Authorities and others. Law enforcement, government authorities, and private parties, as we believe in good faith to be necessary or appropriate for the compliance and protection purposes described above.

Business transferees. Acquiring and other relevant parties to business transactions (or potential transactions) involving a corporate divestiture, merger, consolidation, acquisition, reorganization, sale or other disposition of all or any portion of the business or assets of, or equity interests in, Pony.ai or our affiliates (including, in connection with a bankruptcy or similar proceedings).

Business partners. Our research partners and other business partners.

You have the following choices with respect to your personal information.

Access or update your information. If you have registered for an account with us, you may review and update certain account information by logging into the account.

Opt-out of marketing communications. You may opt out of marketing-related emails by following the opt-out or unsubscribe instructions at the bottom of the email, or by contacting us. You may continue to receive service-related and other non-marketing emails. If you receive text messages from us, you may opt out of receiving further marketing text messages from us by replying STOP to the message.

Cookies. Most browsers let you remove and/or stop accepting cookies from the websites you visit. To do this, follow the instructions in your browser’s settings. Many browsers accept cookies by default until you change your settings. If you do not accept cookies, however, you may not be able to use all functionality of the Service may not work properly. For more information about cookies, including how to see what cookies have been set on your browser and how to manage and delete them, visit www.allaboutcookies.org.

Mobile location data. Users of our App can disable our access to their device’s precise geolocation in their mobile device settings.

Do Not Track. Some Internet browsers may be configured to send “Do Not Track” signals to the online services that you visit. We currently do not respond to “Do Not Track” or similar signals. To find out more about “Do Not Track,” please visit http://www.allaboutdnt.com.

Delete your account. You can request to delete your account by contacting us or selecting Settings – Delete Account in the PonyPilot App. When you contact us, we will respond as required by law. In processing deletion requests, we may retain certain information associated with your account, including for the compliance and protection purposes described above or our legitimate business purposes.

Local storage. You may be able to limit use of HTML5 cookies in your browser settings. Unlike other cookies, Flash-based local storage cannot be removed or rejected via your browser settings, but you can adjust the settings of your Flash player to block it. Blocking Flash storage may impede the functionality of Flash applications, including those employed by the Service. For more information on Flash local storage visit https://helpx.adobe.com/flash-player/kb/disable-local-shared-objects-flash.html.

The Service may contain links to websites, mobile applications, and other online services operated by third parties. These links are not an endorsement of, or representation that we are affiliated with, any third party. In addition, our content may be included on web pages or in mobile applications or other online services that are not associated with us. We do not control websites, mobile applications or online services operated by third parties, and we are not responsible for their actions.

We employ a number of technical, organizational and physical safeguards designed to protect the personal information we collect. However, security risk is inherent in all internet and information technologies and we cannot guarantee the security of your personal information.

We have offices in the United States and China. We and our service providers may process your personal information in these countries or other locations where privacy laws may not be as protective as those in your state, province, or country.

The Service is not intended for use by anyone under 18 years of age. If we learn that we have collected personal information through the Service from someone under 18 years of age without the consent of the child’s parent or guardian as required by law, we will delete it.

We reserve the right to modify this Privacy Policy at any time. If we make changes to this Privacy Policy, we will notify you by updating the date of this Privacy Policy and posting it on the Service. If required by law we will also provide notification of changes in another way that we believe is reasonably likely to reach you, such as via email or another manner through the Service. Any modifications to this Privacy Policy will be effective upon our posting the modified version (or as otherwise indicated at the time of posting). In all cases, your continued use of the Service after the effective date of any modified Privacy Policy indicates your acceptance of the modified Privacy Policy.

Email: privacy@pony.ai

Scope. This section applies only to California residents. It describes how we collect, use, and share the Personal Information of California residents in our capacity as a “business” under the California Consumer Privacy Act (“CCPA”) and their rights with respect to their Personal Information. For purposes of this section, “Personal Information” has the meaning given in the CCPA but does not include information exempted from the scope of the CCPA. This section does not apply to information we collect from anyone in the course of communicating with them in their capacity as an employee, controlling owner, director, officer or contractor of an organization (i.e., company, partnership, sole proprietorship, non-profit or government agency) in the context of performing due diligence on, or providing or receiving products or services to or from, that organization. In some cases, we may provide a different privacy notice to certain categories of California residents, such as job applicants, in which case that notice will apply instead of this section.

Your California privacy rights. As a California resident, you have the rights listed below. However, these rights are not absolute, and in certain cases we may decline your request as permitted by law.

1. Information. You can request the following information about how we have collected and used your Personal Information during the past 12 months:
1. The categories of Personal Information that we have collected.
2. The categories of sources from which we collected the Personal Information.
3. The categories of third parties with whom we share the Personal Information.
4. The categories of Personal Information that we sold or disclosed for a business purpose.
5. The categories of third parties to whom the Personal Information was sold or disclosed for a business purpose.
6. The business or commercial purpose for collecting and/or selling Personal Information.
2. Access. You can request a copy of the Personal Information that we have collected about you during the past 12 months.
3. Deletion. You can ask us to delete the Personal Information that we have collected from you.
4. Nondiscrimination. You are entitled to exercise the rights described above free from discrimination as prohibited by the CCPA.

How to exercise your rights. You may submit requests to exercise your California privacy rights described above as follows:

1. Right to information, access, and deletion. You may submit requests to exercise your right to information, access, or deletion by:
1. emailing: privacy@pony.ai
2. calling: (844) 769-6995

We will need to verify your identity to process your information, access and deletion requests and reserve the right to confirm your California residency. Authentication into your Pony.ai account (if applicable), government identification or other information may be required. Your authorized agent may make a request on your behalf upon our verification of the agent’s identity and our receipt of a copy of valid power of attorney given to your authorized agent pursuant to California Probate Code Sections 4000-4465. If you have not provided your agent with such a power of attorney, you must provide your agent with written and signed permission to exercise your CCPA rights on your behalf, provide the information we request to verify your identity, and provide us with written confirmation that you have given the authorized agent permission to submit the request.

We cannot process your request if you do not provide us with sufficient detail to allow us to understand and respond to it.

Personal information that we collect, use, and disclose. The chart below describes the Personal Information we collected and disclosed during the 12 months preceding the effective date of this Privacy Policy by reference to the categories of Personal Information specified in the CCPA (California Civil Code § 1798.140). Information you voluntarily provide to us, such as in free form webforms, may contain other categories of personal information not described below.

Purposes. We describe the business and commercial purposes for which we collect this Personal Information in the section above entitled How we use your personal information.

Disclosure. We disclosed this Personal Information to the categories of third parties described in the section above entitled How we share your personal information.

Sale of Personal Information. We have not sold your personal information in the preceding 12 months.