PRIVACY POLICY

Introduction

Turnstone is a Software-as-a-Service (SaaS) company that deploys a Predictive Modeling Platform to cities across North America. Its platform provides comprehensive curb occupancy data that seamlessly integrates with existing parking management programs to improve efficiency. By consolidating all disparate data sources and predicting unpaid parking using its proprietary modeling engine, the platform offers a complete and easily accessible view of the curb without requiring additional hardware investment.

The purpose of this document is to explain how Turnstone collects, uses, shares, and protects personal data, ensuring transparency and compliance with privacy laws. It informs users of their rights and the organization's commitment to safeguarding their information, fostering trust and accountability.

Information Collection

Types of Information Collected

Turnstone collects a limited amount of Personally Identifiable Information ("PII") to provide and improve the service.

PII that is collected by the platform is limited to:

• Name. First and last name are collected from City users of the Turnstone platform.
• Email Address. Email addresses are used as unique identifiers to authenticate active users and allow them access to their accounts.
• Usage Data. Turnstone may additionally collect usage data on the platform.
• IP Addresses. Turnstone collects IP addresses in order to provide user sessions.

In the course of business, Turnstone is also provided with data from other sources (e.g., parking payment systems and permit systems). These data sources may have weaker privacy protections, producing information such as transmitted license plates. Turnstone takes extreme caution with all externally provided data, reviewing and stripping it of any and all PII upon receipt. Only relevant (anonymous) characteristics are ever stored.

Methods of Collection (directly from users, cookies, etc.)

Name and email address are collected directly from users through electronic or verbal communication with Turnstone team members or through direct user input (e.g., form-fill).

Use of Information

Name and email address data are collected to identify users, authenticate and provide authorization to access their accounts, notify them of updates to policies (such as this privacy policy), and provide customer support. Name and email address information is only collected for users that directly login to Turnstone.

Usage data is collected to help Turnstone better understand how users use the platform, ensure our infrastructure is prepared to meet user demand and improve the product and its features.

IP addresses are collected to identify unique users and allow sessions to persist for those users.

Data Sharing and Disclosure

Except for usage data, Turnstone never shares user data with third parties. Usage data is only shared for analysis or understanding. PII such as Name and Email are never shared with third parties outside the platform.

The only exception to the above is when requested by legal authorities following due process. In such cases, Turnstone will notify affected users in advance so they may have time to prepare a legal defense if one is available.

Third-party providers that may have access to user data include:

• Amazon Web Services
• Google Analytics (usage data only, no PII)

Data Security

Turnstone takes data security seriously. We log all access to data and limit access to only those team members who need it to work on the platform. We regularly rotate passwords and security keys and require multi-factor authentication wherever reasonable. We have processes for removing accounts when team members leave the project. We use encryption in transit and at rest and report any incidents as soon as we become aware of them.

International Data Transfers

Turnstone is based in the United States, and consequently, all our data centers are also situated there. Our platform operates on a cloud basis and is accessible via the Internet. Since the Internet is highly interconnected, utilizing any online tool can lead to the potential for data to traverse through infrastructure located outside the United States. However, all data remains stored exclusively within the United States.

Cookies and Tracking Technologies

Turnstone does not use cookies or other technologies designed to track user behavior across the Internet. We use local storage to open and maintain a user's individual session for the duration of their work.

Data Retention

User and usage data is retained as long as a user is active on the Turnstone platform. If a user account becomes inactive and remains inactive for more than one year, all user data, including PII, is deleted.

Users may, at any time, request that Turnstone delete their account information using the contact information found at the end of this document. Requested deletions will be processed within a maximum of 30 days, with residual data (backups & log entries) expiring no more than 30 days thereafter.

Changes to This Privacy Policy

This policy may be updated from time to time. Turnstone users will be notified of any changes using the email associated with their accounts.

Contact Information

Questions about this policy or requests for deletion can be directed to Turnstone's privacy team by emailing privacy@turnstonedata.com.