Your trips are yours.

Byway Technologies LLC (“Byway”, “we”, “us”) is a U.S. company building the Byway AI scenic routing app. This policy covers the Byway mobile apps, web app, and byway.llc.

We collect only what we need to make Byway work:

• Account data — name, email, password hash, billing info (handled by Stripe).
• Location data — live location while you use the app, plus saved start/destination pairs for route generation.
• Trip content — journeys, photos, voice notes, receipts, and journal entries you create.
• Usage signals — which stops you visit, skip, or save, so routes get better over time.
• Device + diagnostic data — OS version, crash logs, and anonymized performance metrics.

• Generate scenic routes, narration, and recommendations.
• Improve model quality using anonymized, aggregated data.
• Provide customer support and fulfill subscriptions.
• Detect fraud, abuse, and security threats.
• Send you transactional emails (receipts, password resets). We will never sign you up for marketing without explicit opt-in.

• Sell personal data, location data, or usage data.
• Share your journeys with advertisers, data brokers, or third-party analytics platforms.
• Feed your private content into third-party AI training sets.

Byway uses carefully-chosen vendors to operate the service. Each only sees the data strictly needed for their function.

• AWS — hosting and object storage (U.S.)
• Supabase — database and auth
• Stripe — payments and creator payouts
• Mapbox, OpenTripMap, OpenStreetMap — map + POI data
• OpenAI (TTS) — AI narration synthesis
• Resend — transactional email

You can access, correct, export, or delete your data at any time — from the app, or by emailing contact@byway.llc. We respond to requests within 30 days. Residents of the EU, UK, and California have additional rights under GDPR, UK GDPR, and CCPA — all honored the same way.

When you submit the attestation form at /investors/access, we collect and store:

• Full legal name.
• Email address.
• Firm or affiliation (if provided).
• Your self-attestation that you qualify as an accredited investor under Rule 501 of Regulation D.
• Your self-attestation that you have read and accept the disclaimers and risk factors.
• Your self-attestation that you understand the investor pages do not constitute an offer or solicitation.
• Your IP address and user-agent string.
• The timestamp at which the attestation was submitted.

We use this information as evidence of screening, to comply with the recordkeeping expectations under Rule 506 of Regulation D, to communicate with investor-prospects about the offering, and for any future accredited-investor verification required by securities counsel. We do not sell investor-prospect data, do not use it for consumer product marketing, and do not share it with advertising partners.

We retain investor-prospect records for five years from the date of submission, consistent with the recordkeeping expectations under Rule 506 of Regulation D. If you request earlier deletion, we will evaluate the request against our legal recordkeeping obligations and respond within 30 days.

Byway is not directed at children under 13. We don’t knowingly collect data from them. If you believe a child has shared data with us, write to us and we’ll remove it immediately.

If we change this policy, we’ll post the updated version here and email existing members at least 30 days before it takes effect.

Questions or requests? Email contact@byway.llc.