Privacy Policy

Effective date: July 14, 2026

Data controller: Grandlink LLC · New York

Privacy contact: han8andy@gmail.com · +1 347-957-6888

This policy explains what Grandlink collects, why, who receives it, how long we keep it, and what rights you have.

First, understand our role. Grandlink is a booking, matching and referral platform. The transportation itself is performed by independent, licensed Partner Fleets (see Section 1 of the Terms of Service). Some of your trip information therefore has to be passed to the Partner Fleet performing your trip — without that step, no car can reach you.

1. What we collect

1.1 What you give us (at booking)

⚠️ Addresses are precise, street-level location data with coordinates attached. They are the core data of this service — without them we cannot quote or dispatch.

1.2 Payment data

• Payments are processed by Stripe.
• Your card number, CVV and expiry never pass through and are never stored on Grandlink's servers.
• We store only what Stripe returns: transaction identifiers, amount, currency, payment status and payment time.

1.3 Location data (important)

• Driver location. The Partner Fleet driver performing your trip uses the Grandlink driver app (a mobile web app). Only while your order is "in progress", the app reports latitude, longitude, accuracy, speed and heading roughly every 30 seconds. When an order is not in progress, the system rejects all location reports.
• What you can see. You receive a trip tracking link. While the trip is in progress it shows you your driver's live location, the vehicle details, and the driver's name and phone number.
• The tracking link stops working the moment the trip is completed or cancelled — no further location is returned.
• The link is secured by a randomly generated 64-character hexadecimal token that contains no order number and cannot be guessed or enumerated. Do not share it publicly.
• We do not collect GPS location from passengers' phones. Passenger location comes only from the addresses you enter.

1.4 What our systems record automatically

• Order action logs (booking, payment, dispatch, status changes — with timestamps and actor)
• Email delivery logs (recipient, template, delivery status)
• Server access and security logs (IP, time, request path) for fraud prevention and troubleshooting
• The timestamp and IP address on which you accepted the Terms of Service and the Cancellation & Refund Policy (required as evidence in a dispute)
• Session cookies for the admin console and the driver app

1.5 Partner Fleet and driver data

For Partner Fleets and their drivers: company name, contact person, licence and insurance details, driver name, phone, vehicle type, plate number, driver's licence details, approval status, trip and settlement records, and location traces while a trip is in progress.

2. Cookies and local storage

We serve no third-party advertising cookies and we do not run cross-site behavioural tracking.

3. How we use the data

1. To quote, create orders, take payment, and issue receipts and invoices;
2. To refer and dispatch your trip to a Partner Fleet, and to give the driver performing it the information needed to collect you;
3. To email you confirmations, receipts, driver-assigned / driver-accepted / driver-arriving and trip-completed notices, and your tracking link;
4. For live tracking and dispatch during the trip;
5. To handle cancellations, reschedules, refunds and disputes — including submitting evidence to Stripe and card issuers in a chargeback;
6. To prevent fraud and abuse;
7. To meet tax, accounting and legal obligations.

We do not sell your personal information, and we do not use it for third-party ad targeting.

4. Who we share it with

We require Partner Fleets to use your information solely to perform that trip, and not to retain it, resell it, or use it for any other purpose.

Third parties handle data under their own privacy policies. We do not control Google's or Stripe's data practices.

5. Security

• Card data never lands on our servers (handled by Stripe, PCI-compliant).
• Tracking links use high-entropy random tokens and expire when the trip ends.
• The admin console and driver app require authentication and enforce role-based access; a driver can see the customer details of their own trip only.
• The location endpoint verifies "this is my order and it is in progress" before accepting any report, and rejects everything else.

No system is perfectly secure. If a breach occurs and notification is required by law (including the New York SHIELD Act), we will notify affected users and regulators as required.

6. Your rights

Wherever you live, you may ask us to:

• Access the personal information we hold about you;
• Correct anything inaccurate;
• Delete your personal information (subject to legal and tax retention duties — financial records of completed transactions must be kept);
• Receive a portable copy;
• Not have it sold (we do not sell it in any case).

California residents (CCPA/CPRA) additionally have the rights to know, delete, correct, opt out of sale or sharing, and not to be discriminated against for exercising those rights. We will not refuse service or raise your price because you exercised a right.

To exercise a right, email han8andy@gmail.com. We respond within 45 days of receiving the request. To protect your data we may first verify your identity, normally through the email address and order number used to book.

7. Retention

8. Children's data

Grandlink operates school transfer routes, so a passenger may be a minor student.

• This website is not directed to children under 13, and we do not knowingly collect personal information directly from children under 13 (COPPA).
• School-route bookings must be made by an adult — a parent, legal guardian, or authorized school staff — who is responsible for the information provided.
• A minor passenger's name may appear on the order as the "passenger name", used solely so the driver can identify the passenger, and for no other purpose.
• We do not collect a passenger's age, school records, grades, or any information about a minor unrelated to the transportation.
• If you believe we have inadvertently collected information from a child under 13, contact han8andy@gmail.com and we will delete it immediately.

9. Users outside the United States

The service and its data are hosted in the United States. By using the service you consent to your information being transferred to and processed in the United States.

10. Changes to this policy

We may update this policy. We will change the effective date and post the update on the website. Material changes will be announced by email or on-site notice.

11. Contact

Grandlink LLC · New York

Privacy email: han8andy@gmail.com · Phone: +1 347-957-6888