This Privacy Policy explains how ElevateCode LLC ("we", "us", "RideDesk") collects, uses, and protects information when you use the RideDesk web application at ridedesk.taxi-webdesign.com and the RideDesk Chrome extension (together, the "Service"). This page is maintained by ElevateCode LLC to answer common privacy questions about RideDesk.
1. Information we collect
- Account data — email, password (hashed by our auth provider), company name, and role (Operator Admin, Dispatcher, or Driver).
- Operational data you enter — bookings, vehicles, drivers, and customer records (name, phone, pickup/dropoff, fares).
- Passenger booking requests submitted through your public booking widget (name, phone, email, trip details).
- Chrome extension data — your authenticated session token, stored locally in
chrome.storage.localon your device so you stay signed in. No browsing history, tabs, or content from other sites is read. - Technical logs — request timestamps, IP address, and error diagnostics used to secure and operate the Service.
2. How we use information
- To authenticate you and keep your workspace isolated from other operators.
- To display, dispatch, and manage the bookings you or your customers create.
- To send transactional email (sign-up confirmation, password reset, billing).
- To detect abuse, prevent fraud, and comply with legal obligations.
3. What we do not do
- We do not sell your data or your passengers' data.
- We do not use your data or the contents of your workspace to train AI models.
- We do not share data with advertisers.
- The Chrome extension does not collect browsing history, keystrokes, or personal information from unrelated websites.
4. Chrome extension permissions disclosure
The RideDesk Chrome extension is single-purpose: manage your fleet's bookings from your browser. It requests only the minimum permissions needed, and each is used solely for the purpose stated below. It does not read tabs, page content, browsing history, cookies, or data from any origin other than the RideDesk backend and GitHub Releases.
Permission-by-permission justification
- storage — used to keep you signed in and remember lightweight UI state (driver-mode toggle, seen-booking IDs used to deduplicate notifications, cached extension version metadata). Data written to
chrome.storage.local:session: your Supabase access + refresh tokens and expiry. Retained until you sign out or clear extension data; refreshed automatically before expiry.profile: your user ID, tenant ID, role, driver ID (if any), tenant name, plan, and trial end date. Refreshed on each sign-in; cleared on sign-out.driverMode: boolean toggle for driver view. Cleared on sign-out.seenBookings: a small set of booking IDs already shown, so we don't renotify. Cleared on sign-out.lastUpdateCheck,latestVersion,latestUrl: cached results of the extension update check.
chrome.storage.localis transmitted anywhere except your session token, which is sent only to the RideDesk backend on your own API requests. - alarms — used to run a background poll (every 2 minutes) that checks your workspace for new bookings and status changes. Only booking IDs and statuses are read; no other browser or system data is accessed.
- notifications — used to surface a Chrome notification when a new booking arrives or an existing booking's status changes. Notification text is limited to booking pickup time, passenger name, and status.
- host_permissions — limited to:
- the RideDesk Supabase backend (authenticated API requests for your own workspace, protected by row-level security),
ridedesk.taxi-webdesign.com(the RideDesk web app, used only for the Google sign-in hand-off), andapi.github.com(read-only calls to GitHub Releases to check whether a newer extension version is available).
What we do not do in the extension
- No
tabs,activeTab, or content-script permissions are requested. - We do not inject scripts into web pages or read the DOM of pages you visit.
- We do not sell, share, or use extension data for advertising or AI training.
5. Data sharing and subprocessors
We rely on the following subprocessors to run the Service:
- Cloud hosting and database — infrastructure provider used to host the app, database, and authentication.
- Email delivery — provider used for transactional email.
Each subprocessor is contractually bound to handle data only as needed to provide the Service.
6. Data retention
We retain your workspace data for as long as your account is active. On account deletion, workspace data is removed within 30 days, except where retention is required by law (e.g. tax and billing records).
7. Your rights
You may request access, correction, export, or deletion of your personal data by emailing info@taxi-webdesign.com. If you are in the EU, UK, or California, you have additional rights under GDPR and CCPA, including the right to lodge a complaint with a supervisory authority.
8. Security
Traffic is encrypted in transit (HTTPS/TLS). Passwords are hashed. Workspace data is isolated per tenant using row-level security. You are responsible for keeping your login credentials confidential.
9. Children
The Service is not directed to children under 16 and we do not knowingly collect their data.
10. Changes to this policy
We may update this policy from time to time. Material changes will be posted here with an updated date.
11. Contact
ElevateCode LLC · info@taxi-webdesign.com