Biometric Information Notice

This notice applies only when CommuterCart offers a feature that creates or uses legally regulated biometric information. An ordinary ID photograph or selfie is not necessarily biometric information. Before regulated biometric processing begins, CommuterCart presents this notice and obtains any written consent or release required by applicable law.

Depending on the enabled feature, a qualified provider may process facial geometry, a fingerprint template, a voiceprint, or another regulated biometric identifier to verify identity, authenticate an account or device, prevent impersonation or fraud, or protect a transaction. Biometric information is not used for advertising, unrelated profiling, or unrelated model training.

CommuterCart may disclose biometric information to a contracted identity or security provider that processes it only for the disclosed purpose under confidentiality, security, deletion, and legal-compliance restrictions. We do not sell, lease, trade, or otherwise profit from biometric information. We disclose it to another recipient only with required consent or when disclosure is required by law, legal process, or a valid warrant or subpoena.

We use safeguards appropriate to sensitive information, including access restrictions, encryption where appropriate, provider review, logging, and incident-response procedures. Complete biometric templates are not displayed to Drivers, Senders, merchants, or other delivery participants.

Biometric information is retained only until the initial purpose has been satisfied or for the period needed to provide the enabled authentication or fraud-prevention feature. Unless a shorter period is required, it is permanently destroyed no later than three years after the person’s last interaction with CommuterCart. A legal hold may delay destruction only to the extent permitted by law.

A person may decline or withdraw consent through the Privacy Request form. Withdrawal applies prospectively and may disable the biometric feature. CommuterCart offers a reasonable non-biometric verification method where legally required. Withdrawing consent does not require deletion of records lawfully retained to document prior consent or compliance.

Submit a biometric question, consent withdrawal, access request, or deletion request through in-app support or /privacy-request, or mail a written request to CommuterCart, 186 Main Street, Farmington, ME 04938, United States. Do not send biometric samples or identity documents through ordinary mail or messages.