Privacy Policy
Updated: February 6, 2026
TransitFare & Systems Ltd (“TransitFare”, “Company”, “we” or “us”) is committed to maintaining the accuracy, security, and privacy of Personal Information in accordance with applicable legislation.
NOTE TO COMMERCIAL CUSTOMERS: This Privacy Policy applies to individual users of our public-facing Products. If you are a municipality, transit agency, or other entity (“Commercial Customer”) that has a separate Master Services Agreement (MSA) with TransitFare, the data privacy terms in that MSA (including data ownership and processing roles) shall prevail over this policy.
DATA ROLES:
- For Infrastructure Services: For services where TransitFare provides technology infrastructure to process data solely on behalf of Commercial Customers (such as the TF Cloud backend used by agencies), TransitFare acts as a Data Processor and the Commercial Customer is the Data Controller.
- For Public Services: For public-facing services where users interact directly with TransitFare (such as the UseTransit mobile app and website), TransitFare acts as a Data Controller (or “Business” as defined under applicable U.S. state privacy laws) and processes personal information in accordance with this Privacy Policy and applicable law.
Scope & Application
This Policy applies to our website (www.transitfare.com), TF Cloud, UseTransit (www.usetransit.com), UseTransit SMS, the UseTransit iOS app, and the UseTransit Android app (collectively, the “Products”). This Policy does not extend to third-party sites linked within our Products.
International Users (Geographic Scope):
Our Products are intended for users in Canada and the United States. We do not knowingly target or market to users in the European Economic Area (EEA) or other jurisdictions. If you access our Products from outside Canada or the United States, you do so at your own risk and are responsible for compliance with local laws.
Consent & Choices
By creating an account and using our Products, you consent to the collection, use, and disclosure of your personal information as described in this Policy.
Explicit Consent for Sensitive Data:
For sensitive information (such as real-time location tracking), we will request your explicit consent through in-app prompts (e.g., native iOS or Android permissions dialogs) before collecting such data.
Marketing Communications (Opt-In):
We will only send you marketing emails or optional transit alerts if you have provided express consent (opt-in) during account creation or in your account settings. You may withdraw consent at any time by:
- Clicking “unsubscribe” in any marketing email;
- Updating your preferences in your account settings; or
- Contacting info@transitfare.com.
We will process your opt-out request within 10 business days.
Service-Related Communications:
Please note that service-related communications (such as payment receipts, critical service alerts, security notices, and technical updates) are not considered marketing. These are necessary for the operation of the Products and cannot be opted out of while your account is active.
Withdrawal of Consent:
You may withdraw your consent for other data processing at any time by:
- Location: Disabling location services for the UseTransit app in your device settings.
- Account: Deleting your account by contacting info@transitfare.com.
Please note that withdrawing consent may limit your ability to use certain features of the Products (for example, trip planning requires location access).
Information We Collect
We collect and process the following categories of information:
- Identity Information: Name, email address, and telephone number (when you create an account or sign up for alerts).
- Location Information: Real-time GPS location (for trip planning) and saved locations (e.g., “Home”, “Work”, etc) if you choose to provide them.
- Transaction Information: Fare product purchases, payment card tokens (we do not store full credit card numbers), and transaction history.
- Usage & Technical Data: IP address, device type, operating system, app usage patterns, and crash logs.
- Transit Preferences: Favorite routes, stops, travel times, transit alert preferences.
Cookies & Tracking Technologies
We use cookies, pixels, and similar tracking technologies to track the activity on our Products and hold certain information. Cookies are files with a small amount of data which may include an anonymous unique identifier.
We use these technologies for the following purposes:
- Strictly Necessary: To remember your preferences (e.g., language, session login) and optimize site performance (e.g., caching images to load pages faster).
- Analytics: To analyze website traffic and user behavior using tools such as Google Analytics and Bing Analytics. This helps us improve the user experience and the functionality of our Products.
How We Use Your Information
We use your information to:
- Provide and maintain the Products (e.g., processing fares, planning trips).
- Process payments securely via third-party PCI-compliant processors.
- Provide customer support and respond to your inquiries.
- Send you service alerts, receipts, or technical notices (via email or SMS).
- Share transit usage data with authorized Transit Operators (your local transit agency) to help them understand ridership and improve services.
- Detect and prevent fraud or security breaches.
- Comply with legal obligations.
Disclosure to Third Parties
We do not sell your Personal Information. We only share information as follows:
- Transit Operators: Your local transit agency has access to your account as well as purchase and ride history to support your travel and validate fares.
- Service Providers: We use trusted third parties for payment processing, email delivery, SMS routing, and hosting. These providers are contractually bound to protect your data.
- Legal Requirements: We may disclose information if required by law, court order, or to protect the safety of our users or the public.
- Business Transfers: In the event of a merger or acquisition, user data may be transferred as a business asset.
Automated Decision-Making
We may use automated systems to process your personal information for specific purposes, including:
- Fraud Detection: Automatically detecting and preventing fraudulent transactions or account activity (which may result in temporary account suspension).
- Fare Calculation: Automatically calculating fare capping or transfer discounts based on your transaction history.
- Trip Recommendations: Personalizing route suggestions based on your location and preferences.
Right to Human Review: If an automated decision significantly affects you (for example, if your account is blocked due to suspected fraud), you have the right to request a human review of that decision. You may contact us at info@transitfare.com to submit a request for review.
Data Storage & Cross-Border Transfers
Primary Data Storage (Data Residency):
- For Canadian Users: Data associated with Canadian Transit Agencies is hosted on servers located within Canada.
- For US Users: Data associated with United States Transit Agencies is hosted on servers located within the United States.
Data Retention
We retain personal information only as long as necessary to fulfill the identified purposes, to comply with legal obligations, and to meet regulatory, accounting, and audit requirements:
- Account Information: Retained while your account is active, plus 7 years after account closure (for financial and legal compliance).
- Transaction History: Retained for 7 years (for financial auditing and tax compliance).
- Location Data: Retained for 90 days (for trip planning and service improvement), then anonymized or deleted.
- Usage & Technical Data: Retained for 2 years (for analytics and product improvement), then anonymized.
- Crash Logs: Retained for 1 year (for debugging), then deleted.
You may request deletion of your account and associated data at any time by contacting info@transitfare.com. We will delete your data within 30 days of your request, except where retention is required by law or where data is retained in secure backup systems for a limited period until overwritten.
Your Rights & Choices
Regardless of where you live, we are committed to providing you with control over your personal information. Subject to certain legal exemptions, you have the following rights:
- Right to Access / Know: You may request access to the personal data we hold about you to verify its accuracy. For residents of California and other US states with applicable laws, this includes the right to know the categories of personal information we collected, the sources, and the commercial purposes for collecting it.
- Right to Correction: You may request that we correct any inaccurate or incomplete personal information we hold about you.
- Right to Deletion: You may request the deletion of your account and associated data. We will honor this unless we are required to retain the data for legal, security, or billing reasons (e.g., tax audits).
- Right to Limit Sensitive Information: You may limit our use of sensitive data (such as real-time GPS location) at any time by disabling location services in your device settings.
- Right to Non-Discrimination: We will not discriminate against you (e.g., by denying service or charging higher rates) for exercising any of your privacy rights.
- Opt-Out of Sale/Sharing: We do not “sell” your personal information. We also do not “share” your personal information for cross-context behavioral advertising (as defined under US state laws like the CCPA). We disclose data to Transit Agencies strictly to provide the Services. Because this disclosure is necessary for the Products to function, you cannot opt-out of this specific operational sharing without deleting your account.
- Right to Appeal: If we deny your privacy request, US residents may appeal our decision by contacting us at info@transitfare.com. If you are unsatisfied with the result of your appeal, you may contact your state’s Attorney General.
- “Shine the Light” Law: California Civil Code Section 1798.83 permits California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. We do not share personal information with third parties for their direct marketing purposes.
- Verification: Before processing sensitive requests, we will verify your identity using reasonable methods appropriate to the sensitivity of the information requested (e.g., by emailing your account address).
- Authorized Agents: You may designate an authorized agent to submit a request on your behalf. We may require proof of authorization and verification of your identity directly from you before processing such requests.
Security
We use industry-standard physical, technical, and administrative safeguards to protect your data (including encryption in transit and at rest). However, no digital transmission is 100% secure. You are responsible for keeping your account password confidential.
Security Breach Notification
In the event of a security breach that compromises your personal information, we will:
- Notify the Office of the Privacy Commissioner of Canada (if required by PIPEDA) and any other applicable regulatory bodies;
- Notify affected individuals (if the breach poses a real risk of significant harm); and
- Provide information about the breach, steps we are taking, and steps you can take to protect yourself.
We will provide such notification as soon as feasible and in accordance with applicable law.
Children’s Privacy
Our Products are strictly intended for users 13 years of age and older. We do not knowingly collect, use, or disclose personal information from children under 13.
In Canada: We do not knowingly collect personal information from minors without appropriate parental or guardian consent, consistent with applicable law.
If you are a parent or guardian and believe we have inadvertently collected personal information from your child, please contact us immediately at info@transitfare.com.
Parental Rights:
Upon receipt of a verifiable request from a parent or guardian, we will:
- Provide the parent with an opportunity to review the personal information collected from their child;
- Delete the child’s personal information from our active databases (subject to standard backup overwrites); and
- Cease any further collection or use of that child’s information.
We will verify your identity as the parent/guardian to the best of our ability before processing these requests.
Changes to this Policy
We may update this Policy periodically. Material changes will be notified via the Products or our website. Your continued use of the Products constitutes acceptance of the changes.
Contact Us & Privacy Officer
If you have questions, comments, or complaints about this Policy, please contact our Privacy Officer:
TransitFare Privacy Officer
760 Birchmount Road, Unit 42
Toronto, ON M1K 5H8
Email: info@transitfare.com
Phone: 1-888-477-1103
If you are not satisfied with our response, you have the right to contact the Office of the Privacy Commissioner of Canada, your local data protection authority, or your state Attorney General.