Cruise Privacy Policy

Last Revised: September 17, 2024

Click here for Additional Information Regarding California Residents

Cruise LLC and its affiliates (collectively, “Cruise”) understand the importance of privacy and of being transparent about the information we receive from you and how we use it.  We have worked tirelessly to bring safe autonomous vehicles to your neighborhoods. We have put the same thought and care into how Cruise handles your personal data.. 

We have created this Privacy Policy to explain how we collect, use, share and otherwise process personal data we obtain from individuals relating to Cruise products and services, such as our Autonomous Vehicles (“AVs”), transportation and delivery services, and any related mobile applications (“Apps”). This Privacy Policy also applies to personal data relating to your interactions with our websites (such as getcruise.com), our marketing operations, our support teams, and when you contact us - including through email or social media. For simplicity, in this Privacy Policy we refer to all of these activities as “Cruise Services.”  By interacting with Cruise Services, you consent to the practices described in this Privacy Policy.

Information We Collect or Receive

Cruise collects personal data from multiple sources in order to do things like operate and improve Cruise Services and user experiences (see “How We Use Your Information” section below for more details on our use of personal data). This section explains the sources of personal data we collect or receive.

Information You Provide Directly to Us

We collect information that you provide directly to us, such as when you create or update your account information, enter data into our Apps, use certain features of our Cruise Services, or interact with Cruise personnel. For example, creation of a Cruise account requires that you provide us with information such as your name, address, email, and telephone number. When you submit feedback on rides you take, you provide us with the content of your feedback. When you contact us, you provide information along with a means for us to reach you. And when you hail a ride, you provide us with a pickup location and destination address.

Information We Collect From Your Use of Cruise Services

We also collect personal data when you use Cruise Services, including:

• Account Related Activity. We may log actions taken on your account, such as account creation, legal document acceptance, preference changes, payment information, notifications delivered, and transaction records.

• Using Cruise Apps. Our Apps collect information about how you use the software installed on your device, such as your actions within the Apps, as well as certain device or software version identifiers, including IP address. With your permission, we collect the precise location of your mobile device. We also collect your approximate geolocation derived from the IP address of the device used to access our Apps.

• Taking a Ride. We collect and maintain routes, real-time location, and trip event timestamps (e.g., start, in-progress, end, cancellation for rides). We also capture usage data through any in-vehicle interfaces (e.g., touch screen controls), including the applications you access and the dates and times of such use. Our AVs also record audio and imagery data of their surroundings and within the cabin (see Key Takeaways, above, for more details). This data may be associated with you as an account holder for rides you’ve hailed and taken.

• Receiving Assistance. We record audio during active voice connections with our customer service and emergency response operators. 

• Website, Marketing, Advertising. When you visit Cruise websites, sign up for or interact with our marketing communications, or engage with our advertising on Cruise and third-party websites and services, we may automatically log your activity, device, and browser details through cookies, web beacons, tracking pixels, embedded scripts or other attribution and analytics tools.

For some Cruise Services, we need to collect certain personal data in order to provide the requested Cruise Services to you, such as your location while using the Apps to hail a ride, and it may not be possible to provide the Cruise Services to you without the collection of this data.

Third Party Payment Service(s)

Cruise Services may provide functionality allowing you to make payments to us using third-party payment services. When you use such a service to make a payment, your personal data will be collected by such third party, and will be subject to the third party’s privacy policy.  We have no control over, and are not responsible for, any third party’s collection, use, and disclosure of your personal data.

Social Media Integration

If you connect your social media account to your Cruise Services account, you will share certain personal data from your social media account with us. Depending on the social media product, this may include your name, email address, photo, list of social media contacts, and any other information that you make accessible to us when you connect your social media account to your Cruise Services account.

Information Received from Partners (Cruise as a Service Provider)

Cruise may function as a service provider on behalf of its partners, such as when we provide delivery services for a retailer from whom you’ve ordered. We may receive personal data about you from these partners as necessary to provide these services to you, including making sure the services operate safely and reliably. This information is shared with Cruise pursuant to any notices, consents, or terms you may have agreed to with these Partners, and we encourage you to review any such terms if you have questions regarding what information these Partners share with their service providers.

Third Party Advertising

We use third-party advertising companies to serve advertisements regarding goods and services that may be of interest to you when you access and use Cruise Services and other websites or online services.

You may receive advertisements based on information relating to your access to and use of Cruise Services and other websites or online services on any of your devices, as well as on information received from third parties.  These companies place or recognize a unique cookie on your browser (including through the use of pixel tags).  They also use these technologies, along with information they collect about your online use, to recognize you across the devices you use, such as a mobile phone and a laptop.  If you would like more information about this practice, and to learn how to opt out of it in desktop and mobile browsers on the particular device on which you are accessing this Privacy Policy, please visit http://optout.aboutads.info/#/ and http://optout.networkadvertising.org/#/. You may download the AppChoices app at www.aboutads.info/appchoices to opt out in mobile apps.

How We Use Your Information

We may combine information from any of the sources described in the “Information We Collect or Receive” section of this Privacy Policy. We use the information we collect about you in the following ways.

Cruise Services, Development and Support

We use your information to operate, maintain, understand, and improve user experiences and Cruise Services and to develop new ones. These uses also include:

• Analyzing your usage data to assess the efficiency, quality and safety of the Cruise Services;

• Completing your transactions and processing refunds;

• Sending you related information and notifications, including changes to our terms, conditions and policies;

• Responding to your inquiries, suggestions, compliments or complaints, and fulfilling your requests when you contact us via one of our online contact forms or otherwise;

• Personalizing the Cruise Services and content delivered to you (such as using your IP address to display content relevant to your area); and

• Performing any other action described to you at the time we collected your information.

Marketing, Advertising and Promotions

We also may personalize marketing communications, recommendations, and targeted advertising that we deliver to you, whether that’s through email, in-app, or on the websites you browse. Examples of how we use your information for marketing purposes include: 

• Sending you marketing related emails with information about our services, new products, and other news about our company;

• Developing a better understanding of your interests and preferences to personalize our interactions with you and provide information and/or offers tailored to your interests; and

• Offering you the opportunity to participate in sweepstakes, contests or other promotions.

Security, Safety, Anti-Fraud, and Legal

For everyone’s benefit, we may need to use your information for security, safety, fraud prevention and response, or any other lawful or required legal purposes. This can include:

• Protecting your account from unauthorized access;

• Detecting, investigating, enforcing and preventing breaches of our Terms of Service, fraudulent transactions, cybersecurity attacks, or other illegal or malicious activities;

• Protecting the rights, safety, and property of you, Cruise, Cruise personnel, Cruise partners, other Cruise customers, and others, including responding to disputes, processing claims, investigating complaints, facilitating insurance operations, and reviewing internal and external audio and video recordings in response to emergency, safety, or remote assistance incidents and reports; 

• Performing audit, compliance, and regulatory functions (for example, regulatory reporting), and to comply with applicable law; and

• To facilitate, or as otherwise necessary to be processed in connection with, a sale or business transaction, such as a reorganization, merger, sale, joint venture, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock.

Disclosure of Your Information

The following section describes how we’ll disclose your personal data and the conditions when we may do so.

• Service Providers. Cruise relies upon external parties to perform certain services at Cruise’s direction, and shares personal data with them only as necessary to render these services. Service providers are required to operate within the bounds of this Privacy Policy, and must adhere to confidentiality and security requirements.

• Partners. When you use your Cruise account to interact with other partners’ services, we may need to disclose your personal data so that these partners can render their services to you. Other examples of partners include those with whom we share personal data as appropriate to support the security of Cruise Services and intellectual property and to investigate and prevent fraud, and those with whom we are jointly delivering services or features for promotional purposes, like sweepstakes, contests, promotions, or other advertising.

• Emergency Response Personnel. In the event of an emergency, such as an accident involving one of our AVs, we, or our emergency response service providers (e.g., OnStar), may provide personal data to emergency services as needed to respond to the incident.

• Government Authorities. We may share personal data with police and other government authorities where we reasonably believe it to be necessary to comply with law, regulation or other legal process or obligation. We may also voluntarily disclose personal data to government authorities in certain circumstances where we have a reasonable or good faith belief that harm is imminent, or to protect Cruise’s rights and interests.

• To our affiliates. Consistent with the purposes and limitations described in this Privacy Policy. 

• Other Users. When you create an account, the information you provide may be used to establish a public profile, which may be accessible to other users of Cruise services.

• With your consent. For example, if you’ve requested that we provide your information to another party (e.g., through social sharing features of our app, information you choose to make public on your profile), or have otherwise provided consent for us to make the disclosure.

Security and Retention

We use reasonable organizational, technical, and administrative measures to protect personal data within our organization. Unfortunately, no data transmission or storage system can be guaranteed to be 100% secure. If you have reason to believe that your interaction with us is no longer secure, please immediately notify us in accordance with the “Contacting Us” section below.

We retain personal data for as long as it may be necessary for us to satisfy the purposes outlined in this policy, including compliance with legal obligations, resolution of disputes, and enforcement of agreements. Where required by applicable law, we delete your information when the information is no longer necessary or where requested to do so.

Your Choices and Rights

We give you choices regarding our use and disclosure of your personal data for marketing purposes.

You may opt out from:  

• Receiving marketing-related emails from us.  If you no longer want to receive marketing related emails from us on a going-forward basis, you may opt out by following the “Unsubscribe” instructions within these emails.

• Receiving text/sms messages from us. If you no longer want to receive text message notifications anymore, you may opt out by texting the word “STOP” to +1 (415) 949-2261.

We will comply with your opt-out requests as soon as reasonably practicable. Please note that if you opt out of receiving marketing related emails from us, we may still send you important administrative messages, of which you cannot opt out unless you delete your Cruise account.

Contacting Us

For questions about our Privacy Policy or the way Cruise processes personal data, or for help with how you can review or update the personal data you’ve provided to Cruise, please contact us at privacy@getcruise.com, or call us at 1-888-914-9661 [PIN: 159159]. You may also contact us by mail at 333 Brannan St., San Francisco, CA 94107, Attn: Cruise Legal - Privacy.

Changes to this Policy

We may make changes to this Privacy Policy from time to time.  We will communicate any changes and updates to this Privacy Policy by posting the updated policy on this page with a new “Last Updated” date , but we may notify you directly when these changes materially affect the way we process your personal data.  Use of Cruise Services after an update constitutes consent to the changes to the extent permitted by law.

Additional Information Regarding California Residents  

Pursuant to the California Consumer Privacy Act as amended by the California Privacy Rights Act of 2020 (“CCPA”), this Privacy Policy provides California residents with a description of our online and offline practices regarding the collection, use, sale, sharing, and disclosure of their personal data.  Under the CCPA, “personal data” is information that identifies, relates to, describes, or could reasonably be associated or linked with a particular California resident or household.  

This section supplements our Privacy Policy.  In the event of a conflict between this section and our Privacy Policy, this section will take priority for California residents, while the Privacy Policy will apply to non-California residents.

This Privacy Policy does not apply to our employees or job applicants where the personal data we collect about those individuals relates to their employment or job applicant role with us.

Summary by CCPA Categories and Disclosures

The CCPA requires us to describe our data practices using a specific list of categories.  The table below serves to organize the information contained in this Privacy Policy by reference to those predefined categories.  It provides information about which categories we collect, which categories we disclose to other parties for our business purposes, and which categories we “share” for purposes of cross-context behavioral advertising, including within the 12 months preceding the date this Privacy Policy was last updated.

Sensitive Personal Data

Cruise may collect and use the following categories of sensitive personal data for the following business purposes:  

• Account credentials in combination with your password.  We use this information to ensure the security and integrity of Cruise Services, such as to protect your account from unauthorized access and for security, fraud prevention, legal, and safety purposes.

• Precise geolocation information (consistent with the permissions you grant). If you give us permission to access your precise geolocation, we use this information to perform services on behalf of Cruise, such as to operate Cruise Services (e.g., designate pick up locations, determine routes) and for internal research purposes. 

• Racial and ethnic origin. We may ask customers or research participants to provide certain demographic information for internal research purposes, for example, so we can ensure our customer research is representative.

• Health-related information. We may ask customers or research participants for certain health-related information (such as physical impairments) for internal research and to improve the quality and safety of our services, for example, so that we can provide better accessibility options.

Cruise does not use sensitive personal data for purposes beyond those described in this Privacy Policy. Cruise does not sell or share sensitive personal data for cross-context behavioral advertising.  Because we use sensitive personal data in accordance with limitations described in the CCPA, we do not offer the right to limit the use of your sensitive data.

Sale and Sharing of Personal Data

We do not “sell” and have not “sold”personal data, including the personal data of minors under 16 years of age. We may “share” personal data, as defined by the CCPA, with certain third parties for cross-context behavioral advertising purposes, as described in the table above. We do not knowingly share the personal data of minors under 16 years of age.

To make a Request to Opt Out of Sharing of your personal data for purposes of cross-context behavioral advertising, click here. In addition, if you have a legally-recognized browser-based opt out preference signal to opt out of such sharing, such as the Global Privacy Control, we recognize such signals in accordance with the CCPA. 

Please note, if you use different browsers or devices you will need to make your elections separately for each browser or device (and renew your choices any time you clear your cache or browsing history on a device). You may be presented with a form to complete, in which we ask for certain contact information so we may add it to an appropriate suppression list.

Your Rights

• Request to Access: You have the right to request that we inform you of the personal data we hold about you and obtain a copy of it, including: 

  • The categories of personal data we collected about you in the 12 months preceding your request and the categories of sources from which we collected such personal data;

  • The categories of personal data about you that we “shared” for purposes of cross-context behavioral advertising in the 12 months preceding your request and the categories of third parties with whom we “shared” such personal data; 

  • The business or commercial purpose for collecting or sharing personal data about you in the 12 months preceding your request; and

  • The categories of personal data about you that we otherwise disclosed, and the categories of third parties to whom we disclosed such personal data in the 12 months preceding your request.

• Request to Correct: You have the right to request the correction of  inaccurate personal data that we have about you. 

• Request to Delete: You have the right to request that we delete the personal data we have collected from you in some circumstances as defined by law. Following your request for deletion, please be aware that certain information that we collect about you may still be retained for legal, accounting, security, business continuity (backup), anti-fraud, and community reasons.

• Request to Opt Out of Sharing: As described above, you have the right to request to opt out of our “sharing” of your personal data for cross-context behavioral advertising.

In some cases, your choices to provide, change, or delete information may affect our ability to deliver Cruise Services, or your user experience.  We may decline to process requests which are not otherwise required by applicable law.  You have the right not to be unlawfully discriminated against because you have exercised these rights.  To make a Request to Access, Correct, or Delete, please visit our Privacy Requests page, or contact Customer Service toll-free at 1-888-914-9661 [PIN: 159159].

After you submit a request, we will verify and respond to your request consistent with applicable law, taking into account the type and sensitivity of the personal data subject to the request.  We may need to request additional personal data from you, such as details of your account, devices, payment methods or past transactions, in order to verify your identity and protect against fraudulent requests.  If you maintain a password-protected account with us, we may verify your identity through our existing authentication practices for your account and require you to re-authenticate yourself before disclosing or deleting your personal data.  If you make a request to delete, we may ask you to verify your request before we delete your personal data.. We reserve the right to deny your requests if we cannot verify your identity.

To request removal of your personal data from our blog or any of our social media publications, please contact us as described in the Contact Us section below.

In addition, you may also be able to access, correct, or delete some information through your Account Settings page.

Authorized Agents

For an authorized agent of a California resident to make a request as permitted by applicable law, the agent may visit our Privacy Requests page, or contact Customer Service toll-free at 1-888-914-9661 [PIN: 159159]. As part of our verification process, we may request that the agent provide, as applicable, proof concerning his or her status as an authorized agent. In addition, we may require that you verify your identity as described in the section entitled “Your Rights” or confirm that you provided the agent permission to submit the request.

Retention 

As discussed in the Privacy Policy, we retain personal data, including sensitive personal data, for as long as it may be necessary for us to satisfy the purposes outlined in this Privacy Policy, including compliance with legal obligations and resolution of disputes. The criteria used to determine our retention periods include:

• The type and sensitivity of the data at issue;

• Whether we have an ongoing relationship with you and provide services to you (for example, we may keep data for as long as you have an account with us or keep using our services) and the period of time thereafter during which we may have a legitimate need to reference your personal data to address issues that may arise;

• Whether we are subject to any legal obligation to retain data (for example, certain laws may require us to keep transaction records for a certain period of time); and 

• Whether it is advisable to retain data to protect our legal interests (such as in regard to applicable statutes of limitations, litigation, or regulatory investigations).