Privacy Policy
Reserve A.R.C. LLC (Wyoming, United States)
Effective Date: August 1, 2026 Version: 2.0 Supersedes: All previously published Reserve A.R.C. Privacy Policies
1. Introduction
This Privacy Policy explains how Reserve A.R.C. LLC, a limited liability company organized under the laws of the State of Wyoming, United States ("Reserve A.R.C.," "we," "us," or "our"), collects, uses, shares, and protects personal information in connection with the Reserve A.R.C. platform, our mobile applications, our website, and our services (collectively, the "Platform").
This Policy forms part of, and should be read alongside, our Terms and Conditions.
We handle information about people who move through complex environments. We treat that information as operationally sensitive, not merely as a compliance obligation. We collect what we need to deliver and coordinate secure movement, and no more.
2. Who Controls Your Information
2.1 Controller. Reserve A.R.C. LLC is the controller (in Mexico, the responsable) of personal information collected through the Platform.
2.2 Operators. The independent, locally licensed operators who deliver services to you are separate controllers of the information they hold in connection with performing those services, and are responsible for their own compliance. We require operators to maintain data protection standards no lower than those set out in this Policy.
2.3 Contact. Reserve A.R.C. LLC 30n Gould St Sheridan WY 82801 Privacy contact: ops@reservearc.com
3. Scope
This Policy applies to:
(a) clients, members, and prospective members; (b) principals and named passengers on a booking; (c) authorized representatives of corporate clients and family offices; (d) visitors to our website; (e) business contacts, partners, and applicants.
It does not apply to the independent websites, applications, or services of third parties, including operators, payment providers, and app store platforms, each of which maintains its own privacy practices.
4. Information We Collect
4.1 Information you provide
Category
Examples
Account and identity
Name, email address, telephone number, nationality, country of residence, preferred language
Verification
Government-issued identification document, date of birth, photograph where required for identity verification
Corporate
Company name, role, billing entity, authorized signatory details
Booking
Pickup and drop-off locations, dates and times, number and identity of principals, vehicle and service level requested, itinerary details
Operational risk
Information you disclose about known threats, prior incidents, disputes, media exposure, or other circumstances materially affecting risk
Health
Where you choose to provide it, medical information about a principal relevant to protective planning, including allergies, conditions, medications, and emergency contacts
Preferences
Vehicle preferences, language requirements, accessibility needs, standing instructions
Communications
Messages, support requests, feedback, and correspondence with us
4.2 Information generated through use
Category
Examples
Movement data
Booking history, routes taken, timings, duration, waypoints, incident records
Location
Real-time vehicle and detail location during an active movement; pickup and drop-off coordinates
Device and technical
Device model, operating system, application version, IP address, language settings, crash logs, diagnostic data
Usage
Features accessed, screens viewed, session duration, interaction with intelligence content
Recordings
In-vehicle video and audio recordings, and recordings of operational voice communications, where deployed and where lawful
4.3 Information from third parties
Source
Information
Payment processor (Stripe)
Transaction status, last four digits of card, card brand, expiry, billing country. We do not receive or store full card numbers.
Identity and screening providers
Identity verification results, sanctions list matches, politically exposed person status, adverse media findings
Operators
Movement completion records, incident reports, waiting time, damage reports
Referrers
Where you are introduced by an existing member, partner, or corporate account, the details they provide
Public and open sources
Information used to compile intelligence content, which relates to locations and conditions rather than to you
4.4 What we do not collect
We do not collect full payment card numbers, biometric templates, or information about your political opinions, religious beliefs, trade union membership, sexual orientation, or genetic data. We do not require you to provide health information; you may book without it, subject to your acceptance that protective planning will proceed without that context.
5. Sensitive Information
Three categories warrant specific mention.
5.1 Health information. Where you provide medical information about a principal, we treat it as sensitive personal data. In Mexico, processing sensitive personal data requires your express consent, which we obtain at the point of collection. We share it only with the operator and personnel assigned to the relevant movement, and only to the extent needed for medical preparedness and emergency response.
5.2 Screening results. Sanctions, politically exposed person, and adverse media screening may generate information relating to alleged or actual criminal conduct. We process this only where necessary to comply with legal obligations and to manage legal and regulatory risk, we restrict access to authorized compliance personnel, and we do not use it for any other purpose.
5.3 Precise location. Real-time location linked to an identified individual is capable of revealing patterns of life. We treat it as sensitive regardless of legal classification, restrict access to operational personnel with an active need, and retain it only for the periods stated in Section 10.
6. Why We Use Your Information, and Our Legal Basis
Where the UK or EU General Data Protection Regulation applies, we rely on the legal bases set out below. Where Mexican law applies, we rely on your consent, on the necessity of processing for the contractual relationship, and on the legitimate exceptions to consent provided by law.
Purpose
Legal basis (UK/EU GDPR)
Creating and administering your account
Performance of a contract
Coordinating and delivering bookings
Performance of a contract
Processing payments, refunds, and disputed charges
Performance of a contract; legal obligation
Real-time monitoring of active movements
Performance of a contract; legitimate interests (safety of clients and personnel); vital interests in an emergency
Incident investigation and response
Legitimate interests (safety, evidence preservation, insurance and legal claims); vital interests where life is at risk
Identity verification, sanctions, PEP, and AML screening
Legal obligation; legitimate interests (prevention of financial crime and management of legal risk)
Producing and improving intelligence content
Legitimate interests (service quality and client safety)
Service communications and operational alerts
Performance of a contract
Marketing communications
Consent, withdrawable at any time
Platform security, fraud prevention, and abuse detection
Legitimate interests (protecting the Platform and its users)
Product analytics and improvement
Legitimate interests (improving the service), using aggregated or pseudonymized data where practicable
Defending or bringing legal claims, and regulatory cooperation
Legal obligation; legitimate interests (establishment, exercise, or defense of legal claims)
Where we rely on legitimate interests, we have assessed that our interest is not overridden by your rights and freedoms. You may request details of that assessment.
7. Location Data and Operational Monitoring
7.1 When we collect location. Precise location is collected in two circumstances: from your device where you enable location services in the application, in order to set a pickup point and display nearby availability; and from operator vehicles and personnel during an active movement.
7.2 Why. Real-time tracking during a movement supports route management, emergency response, arrival estimation, incident reconstruction, and the safety of both clients and personnel. This is a core operational function, not a marketing one.
7.3 Your control. You can disable device location permissions at any time through your operating system settings. Doing so will limit certain features, including automatic pickup detection. Vehicle and personnel tracking during an active movement cannot be disabled, because it is a safety control applied to our operators rather than to you.
7.4 We do not track you outside a movement. We do not collect background location from your device when you are not making or on a booking.
8. Recording
8.1 In-vehicle recording. Operator vehicles may be fitted with forward-facing and cabin recording equipment. Where cabin recording is in use, notice is given in the vehicle, and recording is conducted in accordance with the law of the jurisdiction concerned.
8.2 Communications recording. Operational voice and text communications between personnel may be recorded for safety, evidential, and training purposes.
8.3 Access. Recordings are stored securely and accessed only for incident investigation, insurance or legal claims, regulatory requirement, or quality assurance. They are not routinely reviewed and are not used for marketing.
8.4 Objection. If you object to cabin recording, tell us before the booking is confirmed. We will tell you whether the movement can be delivered without it. In some markets and risk profiles it cannot.
9. Sharing Your Information
We do not sell personal information. We do not share personal information for cross-context behavioral advertising.
We share information in the following circumstances:
9.1 Operators. We share the information necessary to deliver your booking, including principal names, contact details, itinerary, and any risk or medical context you have provided. Operators receive what they need for the movement in question and are contractually bound to confidentiality and data protection obligations.
9.2 Service providers. We use third parties who process information on our behalf under contract, including:
Function
Provider
Payment processing
Stripe
Cloud hosting and storage
Amazon Web Services
Identity verification and screening
Global Protect
Communications and notifications
Twillo
Error monitoring and analytics
Variable
Customer support tooling
Variable
These providers are permitted to process information only on our instructions and for the purposes we specify.
9.3 Professional advisers and insurers. Lawyers, accountants, auditors, and insurers, where necessary for legal advice, claims, or corporate purposes.
9.4 Law enforcement and regulators. Where required by valid legal process, or where we reasonably believe disclosure is necessary to prevent serious harm, protect life, or investigate a crime. Where we are legally permitted to notify you of such a request, we will.
9.5 Emergency disclosure. In a medical or security emergency, we may disclose relevant information to emergency services, medical providers, embassies, or nominated emergency contacts.
9.6 Corporate transactions. In connection with a merger, acquisition, financing, or sale of assets, subject to the recipient being bound to protections no less protective than this Policy.
9.7 Corporate account holders. Where a booking is made and paid for by a company or family office, that account holder may receive booking and movement records relating to the principals it has authorized.
10. Retention
We retain personal information only for as long as necessary for the purpose for which it was collected, or as required by law.
Category
Retention period
Account and profile data
Duration of membership, then 24 months
Identity verification and screening records
6 years from account closure, to meet anti-money laundering record-keeping expectations
Booking and movement records
To meet tax, accounting, and limitation period requirements
Precise location data from a movement
90 days, unless required for an incident, claim, or legal obligation
In-vehicle and communications recordings
30 days, unless required for an incident, claim, or legal obligation
Incident reports
Duration of applicable limitation period
Payment records
As required by tax and financial regulation
Marketing consents and preferences
Until withdrawn, plus a record of withdrawal
Support correspondence
24 months
Where information is subject to a legal hold, an active claim, or a regulatory investigation, retention is extended until the matter concludes.
11. International Transfers
11.1 Where information goes. Reserve A.R.C. LLC is established in the United States. Operators are established in the markets where services are delivered, currently including Mexico, with additional markets added over time. Information you provide will therefore be transferred internationally, including from Mexico, the United Kingdom, and the European Economic Area to the United States.
11.2 Basis for transfer from Mexico. Transfers of personal data from Mexico to Reserve A.R.C. LLC and to service providers are made on the basis of your consent given through this Policy, and because the transfer is necessary for the performance of the contract between you and us. Recipients are bound to observe the same obligations set out in this Policy.
11.3 Basis for transfer from the United Kingdom and European Economic Area. Where the UK or EU GDPR applies, transfers are made on the basis of the European Commission Standard Contractual Clauses together with the UK International Data Transfer Addendum, or on another lawful transfer mechanism, supported by a transfer risk assessment. A copy of the relevant safeguards is available on request.
11.4 Acknowledgment. Data protection law in recipient countries may differ from that in your own. We apply the protections described in this Policy regardless of where information is processed.
12. Security
12.1 Measures. We apply technical and organizational measures appropriate to the sensitivity of the information, including encryption in transit and at rest, role-based access control, multi-factor authentication for internal systems, network segmentation, access logging and audit trails, restricted device access, and vendor security assessment.
12.2 Access discipline. Access to movement, location, and principal data is limited to personnel with an active operational or compliance need, and is logged.
12.3 No absolute guarantee. No system is entirely secure. We cannot guarantee absolute security, but we commit to notifying affected individuals and the relevant supervisory authority of a personal data breach where required by applicable law, and within the timescales that law prescribes.
12.4 Your responsibility. You are responsible for safeguarding your account credentials and device, and for notifying us promptly at ops@reservearc.com if you suspect unauthorized access.
13. Your Rights
13.1 Rights available generally
Subject to applicable law, you may:
(a) request access to the personal information we hold about you; (b) request correction of inaccurate or incomplete information; (c) request deletion of your information; (d) object to processing based on legitimate interests; (e) request restriction of processing; (f) request a copy of your information in a portable format; (g) withdraw consent where processing is based on consent, without affecting the lawfulness of prior processing.
13.2 Mexico: ARCO rights
If you are in Mexico, you hold ARCO rights: Acceso, Rectificación, Cancelación, y Oposición. You may also revoke consent to the processing of your personal data, and limit its use or disclosure.
To exercise these rights, submit a request to ops@reservearc.com including your name, a means of contacting you, proof of identity or of authority to act, a clear description of the data concerned, and any document supporting your request. We will respond within the periods prescribed by the Federal Law on the Protection of Personal Data Held by Private Parties.
If you are not satisfied with our response, you may bring the matter before the Secretaría de Anticorrupción y Buen Gobierno, which assumed responsibility for private sector data protection oversight following the dissolution of INAI in March 2025.
13.3 United Kingdom and European Economic Area
If the UK or EU GDPR applies to you, you hold the rights listed in Section 13.1 and the right to lodge a complaint with a supervisory authority, including the UK Information Commissioner's Office or the supervisory authority in your country of residence.
13.4 United States
Where applicable state privacy law grants them, residents of certain United States states hold rights to know, access, correct, delete, and opt out of the sale or sharing of personal information, and the right not to be discriminated against for exercising those rights. We do not sell personal information and do not share it for cross-context behavioral advertising.
13.5 How to exercise your rights
Submit requests to ops@reservearc.com. We will verify your identity before acting, and will respond within the period required by applicable law. There is no charge for a reasonable request. We may decline or limit a request where we are legally required to retain information, where it would compromise the safety of another person, where it would reveal operational security methodology, or where an exemption applies.
14. Automated Decision-Making
14.1 Screening. Sanctions and PEP screening involves automated matching against lists. A positive match does not result in an automated decision. All adverse membership decisions are reviewed by a person before they take effect.
14.2 Pricing. Prices vary according to demand, risk level, market conditions, and cost of delivery. Pricing logic is algorithmic but does not produce legal or similarly significant effects concerning you, and does not profile you as an individual.
14.3 Intelligence content. Automated processing is used to aggregate and rank open-source information about locations and conditions. It assesses environments, not individuals. It does not make decisions about you.
14.4 Your right. Where a decision producing legal or similarly significant effects would otherwise be made solely by automated means, you have the right to obtain human intervention, to express your point of view, and to contest the decision.
15. Cookies and Similar Technologies
Our website uses cookies and similar technologies that are strictly necessary for it to function, and, with your consent, analytics cookies that help us understand how it is used. You can manage preferences through the consent banner or your browser settings. Our mobile applications use device identifiers and software development kits for authentication, crash reporting, and push notification delivery.
16. Marketing
We send service and operational messages relating to your bookings, which you cannot opt out of while you hold an account, because they are necessary to deliver the service. Marketing communications are sent only with your consent, and you may withdraw that consent at any time using the unsubscribe link or by contacting ops@reservearc.com.
17. Children
The Platform is not directed at, and may not be used by, anyone under 18. We do not knowingly collect information from children. Where a minor is a principal on a movement, information about that minor is provided by a parent, guardian, or authorized adult, who is responsible for the lawfulness of that disclosure. If you believe we hold information about a child collected otherwise, contact ops@reservearc.com and we will delete it.
18. App Store Platforms
Where you obtain our application through the Apple App Store or Google Play, those platforms collect information about your download and use of the application under their own privacy policies, over which we have no control. Our declared data practices on those platforms are intended to reflect this Policy. If you identify a discrepancy, tell us and we will correct it.
19. Changes to This Policy
We may update this Policy from time to time. Material changes will be notified through the Platform or by email at least thirty (30) days before they take effect, unless a change is required immediately by law. The version number and effective date at the top of this Policy indicate when it was last revised. Continued use of the Platform after a change takes effect constitutes acknowledgment of the revised Policy, subject to any consent we are separately required to obtain.
20. Contact and Complaints
Questions, requests, and complaints:
Reserve A.R.C. LLC Email: ops@reservearc.com 30n Gould St Sheridan WY 82801
We would prefer to resolve a concern directly. You retain the right to complain to your local supervisory authority regardless of whether you contact us first.
Last updated: August 1 2026