Data — Drivers, Mas Crews & Customers

What is collected: the driver's name and contact details, vehicle description and plate, license and insurance status as recorded by the organizer, and the GPS location of an active transport booking — only while that booking is in progress.

Why: to show the organizer and the assigned passengers where the bus is, manage pickups and keep a record of completed trips. GPS tracking is limited to the active window of a booking: it starts when the trip begins and stops when it is marked completed or cancelled.

Who sees it: the organizer and that organizer's workspace staff, and the passengers assigned to the corresponding booking (pickup point and live status only). Drivers are never profiled across different organizers.

Your controls: a driver can ask the organizer to correct their data or remove their vehicle from the list. A driver who objects to live location sharing must raise it with the organizer; without location sharing, that booking's status updates fall back to manual entry logs. Tracking history is kept for 90 days to resolve disputes and then deleted.

What is collected: name, contact details, section or role in the mas crew, and the costume-share balance account — amounts owed, amounts paid, method and date of each payment and any note the organizer records.

Why: to keep a fair, visible picture of the money for everyone — who has paid, who owes and the running total the organizer reports.

Who sees it: the organizer and the staff roles the organizer authorizes. Members can learn their own balance through their organizer.

Your controls: members can request their own record from the organizer, ask for corrections to payment entries and request deletion at the close of the season. Organizers can export the full account (CSV) at any time; CarnivalOS does not use mas crew data for any other purpose and does not contact members directly.

What is collected: name, email and phone given at purchase, order and ticket details (type, quantity, amount, payment status), the ticket's unique QR code, and the timestamp and entry agent recorded at the gate.

Why: to deliver the ticket, validate entry at the gate, prevent duplicate or fraudulent scans and give the organizer the sales picture. Codes are generated without ambiguous characters so gate scanning is reliable.

Who sees it: the organizer and their authorized gate agents. CarnivalOS itself does not email, market or advertise to your customers.

Your controls: customers should contact the organizer they bought from for refunds, corrections or deletion; the organizer can export or anonymize records from the platform. CarnivalOS keeps orders and gate records only while the organizer's subscription is active plus the 30-day export window, without prejudice to legal retention obligations.

Every API input is validated against schemas, every endpoint is rate-limited, transport is encrypted with TLS, database access is parameterized to block injection and all writes are idempotent so a repeated offline sync cannot duplicate a payment or a ticket.

Security headers (strict CSP, anti-clickjacking, no-sniff) are applied to every response, and our staff's production access is limited to what is needed to operate and support the Service.

If you are a driver, mas crew member or customer: contact the organizer you dealt with — they control your data and can export, correct or delete it. If you cannot reach them, write to legal email — to be published shortly and we will forward your request to the organizer and support its completion.

Organizers can delete people, vehicles or orders from their workspace at any time; local device caches can be cleared from Settings. After deletion, standard backups are purged within 30 days.

If a personal data breach affects any of these groups, we will notify affected organizers without undue delay (goal: within 72 hours of confirmation) with the information they need to meet their own notification duties, and we will alert the authorities where the law requires us to.