1. Controller and Scope
Harrison Ward Technology, located in Flower Mound, Texas, United States, operates BandWagon and determines how platform personal information is processed. In privacy-law terminology, Harrison Ward Technology is generally the controller for the BandWagon platform. A participating organization may separately control information it submits, organization policies, membership decisions, and organization-specific uses.
This policy applies to BandWagon websites, progressive web applications, organization instances such as FloMoGo, support processes, and related ride-coordination services. Questions may be submitted through the Help Center or to [email protected].
2. What BandWagon Does
BandWagon is a community ride-coordination platform. It helps users voluntarily connect to request, offer, and coordinate transportation. BandWagon does not provide transportation, employ or dispatch drivers, inspect vehicles, conduct background checks unless specifically disclosed, verify insurance or licensing, supervise rides, track vehicles, or guarantee an arrangement.
3. Information Collected
- Identity and account: name, display name, email, optional mobile number, birth month/year or age classification, authentication and session records.
- Household and organization: guardian relationships, household members, organization/group memberships, roles, approvals, and policy acknowledgements.
- Ride and event: requests, offers, matches, schedules, passenger counts, transportation notes, pickup/drop-off confirmations, cancellations, no-shows, and operational history.
- Location: private addresses, event locations, approximate geographic areas, and user-drawn service areas when necessary for coordination.
- Driver eligibility: profile, availability, capacity, service area, and organization-required credentials or approval records.
- Communications: email, push, SMS/RCS preferences, consent/opt-out records, delivery status, and transactional message history.
- Calendar connections: account identifiers, selected calendars, imported event details, encrypted OAuth credentials, synchronization status, and errors.
- Security and support: IP address, browser/device details, audit events, abuse signals, support requests, security reports, and administrator support-mode activity.
- Payments: support amount, status, Stripe reference, and sponsor details. Payment-card information is entered on Stripe-hosted Checkout and is not stored by BandWagon.
4. Sources
Information comes from users, parents or guardians, household managers, participating organizations, connected Google or Microsoft accounts, service providers involved in a requested transaction, and platform-generated security or operational records. BandWagon does not purchase consumer marketing profiles or obtain data from data brokers.
5. Purposes and Legal Bases
Where applicable law requires a legal basis, BandWagon relies on the following:
| Purpose | Typical legal basis |
|---|---|
| Create accounts; coordinate rides and events; provide requested calendars, notifications, support, and privacy functions. | Performance of the requested service or steps taken at the user's request. |
| Optional SMS/RCS, push notifications, calendar connections, AI-assisted features, and optional functional browser storage. | Consent or an explicit user/organization request; consent may be withdrawn. |
| Prevent abuse, protect minors and locations, secure accounts, investigate incidents, maintain audit trails, and operate reliable infrastructure. | Legitimate interests in safety, security, fraud prevention, and service integrity, balanced against individual rights. |
| Maintain legally required records, respond to valid legal process, and enforce rights. | Legal obligation and establishment, exercise, or defense of legal claims where applicable. |
6. Location Privacy
Exact home, pickup, and drop-off addresses are private. They are not shown to the general community. General areas and user-selected service areas are used for discovery and matching whenever practical. Exact information is disclosed only to authorized participants when reasonably necessary for a confirmed ride.
BandWagon does not provide continuous GPS tracking, route monitoring, vehicle telemetry, speed monitoring, advertising geofencing, or background location collection.
7. Children, Teens, and Guardian Authority
BandWagon is designed for adults, families, and organization-managed communities; it is not an unrestricted child-directed social service. A parent or authorized household manager may create and control a managed profile for a minor. Direct sign-in for a managed student requires organization enablement, verified contact information, and active guardian consent. Organizations and guardians may require approval before a minor requests a ride.
BandWagon does not knowingly permit an independent account for a child under 13 without the notice, authorization, and verifiable parental consent required by applicable law. A parent or guardian may review, correct, export, restrict, or request deletion of a managed child's information. Concerns about an unauthorized minor account should be reported immediately through the Help Center.
8. SMS, RCS, Email, and Push
Mobile messaging is optional and limited to transactional account, ride, event, verification, safety, and service activity. Message frequency varies and message/data rates may apply. Reply STOP to opt out and HELP for assistance. Mobile information and consent records are not sold, rented, or shared with third parties or affiliates for marketing or promotional purposes.
A verified email is required for an account. Important security, privacy, account, safety, or legal notices may be sent even when optional ride notices are disabled. Browser push is requested only after the user selects the enable action and may be disabled through BandWagon or device settings.
9. Sharing and Disclosure
BandWagon limits disclosure to what is reasonably needed:
- Authorized ride participants receive information needed to evaluate or complete a ride, with exact locations withheld until appropriate.
- Parents, guardians, household managers, and organization administrators receive information permitted by their verified role.
- Service providers process limited information necessary for hosting, storage, email, messaging, maps, calendars, bot protection, payment, monitoring, and security.
- Information may be disclosed when required by valid legal process, to protect a person from serious harm, to investigate abuse or fraud, or in a business reorganization subject to continued privacy protections.
BandWagon does not sell personal information. It does not share personal information for cross-context behavioral advertising and does not use personal information for targeted advertising.
10. Service Providers
Current provider categories include IONOS and Coolify-managed infrastructure, PostgreSQL and private object storage, Cloudflare security/Turnstile, Twilio SMS/RCS, email delivery providers, Google Maps/Routes and Google Calendar, Microsoft Graph Calendar, Stripe-hosted Checkout, and platform monitoring services. The current list, with what each provider receives and when, is on the Subprocessors page. A provider receives only the information necessary for its function and is subject to applicable contractual, confidentiality, security, and data-protection requirements.
11. Cookies and Similar Technology
BandWagon uses essential cookies for authentication, security, temporary support mode, and remembering privacy choices. Optional functional storage for the offline PWA shell remains off until allowed. BandWagon does not currently use advertising cookies, cross-site tracking, session replay, or behavioral analytics. Exact names, durations, providers, and controls appear in the Cookie and Similar Technologies Policy.
12. Retention and Deletion
BandWagon retains information only as long as reasonably necessary for the stated purpose, organization configuration, safety, security, legal obligations, disputes, and service integrity:
- Exact completed/cancelled ride locations default to deletion after 30 days; organizations may configure 1–365 days.
- Driver credential documents default to 90 days after expiration, rejection, or replacement; organization settings may vary within platform limits.
- Authentication challenges, expired sessions, and related artifacts are regularly expired, revoked, redacted, or removed by privacy maintenance.
- Account-deletion requests normally include a seven-day safety grace period before eligible direct personal information is removed.
- Minimum de-identified or restricted safety, consent, security, billing, audit, and ride-integrity records may remain when reasonably necessary.
- Backups expire under the infrastructure backup-retention schedule; deleted data may remain inaccessible in encrypted backups until rotation.
13. Individual Rights and Requests
Depending on location and applicable law, a person may have rights to know/access, correct, delete, obtain a portable copy, restrict processing, object to certain processing, withdraw consent, opt out of sale/targeted advertising/profiling, use an authorized agent, appeal a denied request, and complain to a regulator. BandWagon does not discriminate against users for exercising privacy rights.
Signed-in users can export data and schedule/cancel account deletion from Privacy & Data. Other requests may use the Help Center's Privacy Request topic. BandWagon may verify identity and authority before fulfilling a request. Where GDPR applies, users may complain to the data-protection authority in their country. Texas residents may submit applicable complaints to the Texas Attorney General after using BandWagon's request process.
14. International Processing
BandWagon is operated from the United States and is designed to use United States production hosting. Some providers may process support, routing, messaging, calendar, security, or resilience data from other locations. Where a restricted international transfer is subject to applicable law, BandWagon uses an approved transfer mechanism and supplementary safeguards where required.
15. Security
Safeguards include encryption in transit and at rest, field-level protection for selected sensitive data, tenant isolation, role-based access, guardian authority checks, short-lived verification codes, secure session controls, audit logging, rate limiting, restricted support mode, secret management, bot protection, monitoring, retention automation, and incident handling. No internet-connected service can guarantee absolute security.
16. Automated Processing and AI
BandWagon does not make solely automated decisions that produce legal or similarly significant effects. Optional AI-assisted intake or document extraction is controlled by organization opt-in and runtime configuration; it does not replace required human organization review. BandWagon does not use submitted content to build advertising profiles.
17. Changes and Re-consent
Material policy changes may require renewed acknowledgement or consent. A new optional cookie/storage category, materially different purpose, or new tracking provider will not be authorized by an old functional-storage choice; BandWagon will update the policy version and ask again before activation where consent is required.
18. Contact and Complaints
Controller: Harrison Ward Technology, Flower Mound, Texas, United States
Privacy: [email protected] or the Help Center
Security: [email protected] or the Security Report process
Support: [email protected]