Privacy Policy

Introduction

Turnstone is a Software-as-a-Service ("SaaS") company that deploys a Curb Insights Platform ("the Platform") to cities across North America. Its Platform provides comprehensive curb occupancy data that seamlessly integrates with existing parking management programs to improve efficiency. By consolidating disparate data sources and predicting unpaid parking with its proprietary modeling engine, the Platform provides a complete, easily accessible view of the curb without requiring additional hardware investment.

The purpose of this document is to explain how Turnstone collects, uses, shares, and protects personal data, ensuring transparency and compliance with privacy laws. It informs users of their rights and the organization's commitment to safeguarding their information, fostering trust and accountability.

Information Collection

Types of Information Collected

Turnstone collects a limited amount of Personally Identifiable Information ("PII") to provide and improve the service.

PII that is collected by the Platform is limited to:

• Name. First and last name are collected from City users of the Platform.
• Email Address. Email addresses serve as unique identifiers to authenticate active users and grant them access to their accounts.
• Usage Data. Turnstone may additionally collect usage data on the Platform.
• IP Addresses. Turnstone collects IP addresses in order to provide user sessions.

In the course of business, Turnstone also receives data from other sources (e.g., parking payment and permit systems). These data sources may have weaker privacy protections, resulting in the transmission of information such as license plate data. Turnstone takes extreme caution with all externally provided data, reviewing and redacting all PII upon receipt. Only relevant (anonymous) characteristics are ever stored.

Methods of Collection

Name and email address are collected directly from users via electronic or verbal communication with Turnstone team members or through direct user input (e.g., form submission).

Use of Information

Name and email address data are collected to identify users, authenticate and authorize access to their accounts, notify them of policy updates (such as this privacy policy), and provide customer support. Name and email address information is collected only from users who login directly to Turnstone.

Usage data is collected to help Turnstone better understand how users use the Platform, ensure our infrastructure is prepared to meet user demand, and improve the product and its features.

IP addresses are collected to identify unique users and allow sessions to persist for those users.

Data Sharing and Disclosure

Except for usage data, Turnstone never shares user data with third parties. Usage data is only shared for analysis or understanding. PII, such as Name and Email are never shared with third parties outside the Platform.

The only exception to the above is when requested by legal authorities in accordance with due process. In such cases, Turnstone will notify affected users in advance so they may have time to prepare a legal defense if one is available.

Third-party providers that may have access to user data include:

• Amazon Web Services
• Google Analytics (usage data only, no PII)

Data Security

Turnstone takes data security seriously. We log all data access and limit access to only those team members who need it to work on the Platform. We regularly rotate passwords and security keys and require multi-factor authentication wherever reasonable. We have processes for removing accounts when team members leave the project. We use encryption in transit and at rest, and report any incidents as soon as we become aware of them.

International Data Transfers

Turnstone is based in the United States; consequently, all our data centers are located there. The platform operates in the cloud and is accessible via the Internet. Since the Internet is highly interconnected, using any online tool can allow data to traverse infrastructure outside the United States. However, all data remains stored exclusively within the United States.

Cookies and Tracking Technologies

Turnstone does not use cookies or other technologies designed to track user behavior across the Internet. We use local storage to open and maintain a user's session throughout their work.

Data Retention

User and usage data are retained as long as a user is active on the Platform. If a user account remains inactive for more than one year, all user data, including PII, is deleted.

Users may, at any time, request that Turnstone delete their account information using the contact information found at the end of this document. Requested deletions will be processed within 30 days, and residual data (backups & log entries) will expire no later than 30 days after deletion.

Changes to This Privacy Policy

This policy may be updated from time to time. Turnstone users will be notified of any changes using the email associated with their accounts.

Contact Information

Questions about this policy or requests for deletion can be directed to Turnstone's privacy team by emailing privacy@turnstonedata.com.