Privacy Policy

Effective Date: July 17, 2026

1. Introduction

This Privacy Policy describes how YPA Group Inc., doing business as Weorda ("Weorda," "we," "us," or "our"), collects, uses, shares, and protects information in connection with our website at weorda.com, our mobile applications (including the Weorda app for workers), and our cloud-based platform (collectively, the "Service"). The Weorda Parents mobile application for parents and guardians has its own privacy policy, available at weorda.com/parents-privacy.

This Privacy Policy applies to information we collect when you visit our website, register for an account, or use the Service as an authorized operator, a worker invited by an operator, a beneficiary (such as a parent or family member receiving notifications), or another permitted user.

Weorda has two roles depending on how data reaches us:

As a service provider to Operators: When Operators (organizations like school transportation providers, home care agencies, or trucking companies) upload data about their workers, students, patients, clients, or others, the Operator is the controller of that data, and Weorda processes it on the Operator's behalf under our Data Processing Addendum. For data in this category, your rights are exercised through your Operator.

As a controller of data we collect directly: When you create an account, visit our website, or interact with us directly (for example, by emailing support), Weorda is the controller of that data. This Privacy Policy describes our practices in this role.

This Privacy Policy applies in both cases, with appropriate distinctions where relevant.

Quick guide — which sections apply to you

If you're an individual user (driver, aide, dispatcher, office staff, or anyone invited by an organization): the most relevant sections for you are Section 2 (what we collect about you), Section 9 (Your Rights), Section 14 (Cookies), and Section 16 (Contact). Section 5.1 explains what your employer or organization sees.

If you're an operator (managing a paying Weorda account for your organization): all sections apply to you. Pay particular attention to Section 5 (sharing), Section 6 (student data, if applicable), and Section 7 (retention).

If you're a parent, family member, or beneficiary receiving notifications: Section 5.1 and Section 9 are most relevant to you.

If you're a parent or guardian using the Weorda Parents app: your use of the app is covered by the Weorda Parents App Privacy Policy and the Weorda Parents App Terms of Use, not by this Privacy Policy.

2. Information We Collect

2.1 Information You Provide Directly

• Individual Account Information: name (optional), email address, password (encrypted), role, phone number (optional).
• Organization Account Information (if you create or manage a Weorda organization): company name, billing contact, state of operation, industry, estimated number of users.
• Billing Information: collected and stored by our payment processor, Stripe. We do not store full payment card numbers.
• Communications: information you provide when contacting us through support, sales, or other channels.
• Operational Data You Upload: routes, schedules, worker rosters, student or client information, inspection records, photos, and other data you choose to upload as an Operator.

2.2 Information Collected Automatically

• Usage Data: actions taken in the Service, features used, time spent, error logs, performance metrics.
• Device Information: device type, operating system, browser, mobile network, unique device identifiers.
• Log Data: IP address, access times, pages viewed, referring URLs.
• Location Data: with your permission, approximate or precise location data from mobile devices used by workers, used for route check-ins, inspection geotagging, and compliance verification.
• Cookies and Similar Technologies: see Section 14 for details.

2.3 Information from Third Parties

• Authentication Providers: if you sign in using Google or another third-party authentication service, we receive basic profile information.
• Operators: if you are a worker, beneficiary, or other end user, we receive information about you from the Operator who invited you to the Service.

2.4 Information We Collect Through the Weorda Parents App

Information we collect from parents and guardians through the Weorda Parents app is described in the Weorda Parents App Privacy Policy. Information about students displayed in that app is provided by the Operator and processed by Weorda on the Operator's behalf, as described in Sections 5.1 and 6. We do not collect information from children through the Weorda Parents app.

3. How We Use Information

We use the information we collect to:

• Provide, maintain, and improve the Service.
• Process subscriptions, payments, and billing.
• Authenticate users and secure accounts.
• Communicate with you about the Service, including service announcements, security alerts, and support.
• Send marketing communications, where permitted by law and subject to your right to opt out.
• Detect, prevent, and respond to fraud, abuse, security incidents, and violations of our terms.
• Comply with legal obligations and enforce our agreements.
• Conduct analytics and research to improve the Service, including through aggregated and anonymized data.

4. Legal Bases for Processing

Where required by law, we process personal information on one or more of the following legal bases:

• Contractual necessity: to provide the Service you have requested.
• Legitimate interests: to operate, improve, secure, and market our Service, in ways that are not overridden by your rights.
• Consent: where you have given consent for specific processing, which you may withdraw at any time.
• Legal obligation: to comply with applicable laws.

5. How We Share Information

We share information in the following circumstances:

5.1 With Operators

If you are a worker, beneficiary, or other end user invited by an Operator, the Operator can see information generated by your activity within their organization. This includes:

• Your name and contact information (as you provided when accepting the invitation, or as provided by the Operator)
• Your check-in and check-out times
• Your route, schedule, and assignment activity
• Your inspection submissions, including photos and notes
• Your location data when location is enabled (during active shifts only, where applicable)
• Your communications sent through the Service for operational purposes

If you are a parent or guardian using the Weorda Parents app, what the Operator can see is described in the Weorda Parents App Privacy Policy.

The Operator decides how this information is used within their organization, how long they retain it, and who within their organization has access. Questions about your Operator's specific practices should be directed to your Operator (typically your employer or supervisor). Your relationship with your Operator is governed by your separate agreement with them.

5.2 With Service Providers (Subprocessors)

We share information with third-party service providers who perform services on our behalf, such as cloud hosting, authentication, payment processing, SMS delivery, and analytics. A current list of subprocessors is maintained at weorda.com/subprocessors. These providers are contractually required to protect information and use it only for the purposes we authorize.

5.3 For Legal Reasons

We may disclose information if we believe in good faith that disclosure is necessary to (a) comply with applicable law, legal process, or government request; (b) enforce our terms; (c) protect the rights, property, or safety of Weorda, our users, or the public; or (d) investigate or prevent fraud, abuse, or security incidents.

5.4 In Connection with Business Transfers

If Weorda is involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction, subject to standard confidentiality protections.

5.5 With Your Consent

We share information with third parties when you direct us to do so or otherwise consent.

5.6 What We Do Not Do

We do not sell personal information for monetary consideration. We do not share personal information with third-party advertisers for cross-context behavioral advertising. We do not use Customer Data to train artificial intelligence models for external customers without explicit consent.

6. Student Data (FERPA / COPPA / State Student Privacy Laws)

This Section applies when Operators upload student information to the Service, particularly in the school transportation vertical.

6.1 When an Operator (such as a school transportation provider) uploads student information, Weorda processes that information as a "school official" with a legitimate educational interest under FERPA, or as the Operator's processor under applicable state student privacy laws, including New York Education Law 2-d, the Student Online Personal Information Protection Act ("SOPIPA") where applicable, and similar laws in other states.

6.2 The Operator is responsible for obtaining all required parental, school, and regulatory consents under FERPA, COPPA, and state law before sharing student information with Weorda. Weorda does not directly collect information from children under 13.

6.3 We do not use student information for advertising or to create non-educational profiles of students. We do not sell student information.

6.4 Student information is deleted upon Operator request, at the end of the subscription term, or in accordance with the Operator's instructions.

6.5 Operators with questions about student privacy practices may contact privacy@weorda.com.

7. Data Retention

7.1 We retain personal information for as long as necessary to provide the Service and as required by applicable law.

• Active accounts: retained for the duration of the subscription, plus thirty (30) days following termination, unless deletion is requested earlier.
• Inactive accounts: may be deleted after twelve (12) months of inactivity.
• Backups: may be retained for up to ninety (90) days in encrypted backup systems.
• Legal holds: information subject to legal hold is retained until the hold is released.
• Aggregated and anonymized data: may be retained indefinitely.

8. Data Security

8.1 We implement reasonable administrative, technical, and organizational safeguards to protect personal information, including:

• Encryption in transit using Transport Layer Security.
• Encryption of data at rest in cloud storage.
• Role-based access controls.
• Multi-factor authentication for administrative accounts.
• Access logging and monitoring.
• Restricted internal access on a need-to-know basis.
• Subprocessor security obligations.

8.2 No security measure is perfect. We cannot guarantee absolute security.

8.3 In the event of a security incident affecting your personal information, we will notify affected individuals and regulators where required by law and within applicable timeframes.

9. Location Data

9.1 The Weorda mobile application may collect location data from your device for specific operational purposes, including route check-ins, inspection geotagging, attendance verification, and compliance reporting.

9.2 Location data is only collected when:

• You have granted location permission to the app through your device settings • You are actively using the app during a shift, route, or workflow that requires location • Your Operator has configured the feature for your role

9.3 We do not track your location continuously in the background or outside of active shifts. We do not use your location data for advertising or for purposes unrelated to the Service.

9.4 You can revoke location permission at any time through your device settings. Doing so may limit your ability to use certain features of the Service.

9.5 Your Operator can see location data generated during your work activity. Your Operator's policies govern how that data is used within their organization.

9.6 Weorda Parents app. Location collected from parents and guardians through the Weorda Parents app is described in the Weorda Parents App Privacy Policy. The vehicle location shown in that app is the location of the Operator's vehicle, collected from the driver's device as described in this Section, not from your child. Weorda does not collect location data from children or from any device belonging to a child.

10. Your Rights

Depending on where you live, you may have rights regarding your personal information, including:

• Access: the right to know what personal information we hold about you.
• Correction: the right to correct inaccurate or incomplete information.
• Deletion: the right to request deletion of your personal information.
• Portability: the right to obtain a copy of your information in a structured, machine-readable format.
• Opt-Out: the right to opt out of certain processing, including marketing communications.
• Restriction: the right to request that we restrict certain processing.
• Objection: the right to object to certain processing.
• Non-Discrimination: the right not to be discriminated against for exercising your rights.

To exercise your rights, contact us at privacy@weorda.com. We will respond within the timeframes required by applicable law (generally 30-45 days).

For individual users about your own account: You can exercise rights regarding your individual Weorda account directly with us at privacy@weorda.com. This includes your account profile, login credentials, and data we collect about you directly (such as usage analytics).

For data your Operator uploaded or generated about you: Your rights regarding work-related data (such as route assignments, schedules, inspection records, supervisor evaluations) are generally exercised through your Operator. Weorda will assist your Operator in responding to verified requests. Contact your Operator directly to make such requests.

11. California Privacy Rights (CCPA/CPRA)

This Section applies to California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act.

11.1 Categories of Information Collected

In the past twelve months, we have collected the following categories of personal information: identifiers (name, email, phone number, account ID); commercial information (subscription and billing); internet activity (usage data, log data); geolocation (with permission); professional information (role, company); inferences (analytics-derived data).

11.2 Sources of Information

We collect information directly from you, automatically through your use of the Service, and from Operators and authentication providers.

11.3 Purposes of Collection

As described in Section 3 above.

11.4 Categories Disclosed

We disclose personal information to service providers (subprocessors) as described in Section 5.2. We do not sell or share personal information for cross-context behavioral advertising.

11.5 Your California Rights

California residents have the right to know, access, delete, correct, and limit use of sensitive personal information; the right to opt out of sale or sharing (although Weorda does not sell or share); and the right to non-discrimination. To exercise these rights, contact privacy@weorda.com or use the rights request form at weorda.com/privacy-request.

11.6 Authorized Agents

California residents may designate an authorized agent to make rights requests on their behalf. We may require verification of the agent's authority.

12. Other State Privacy Rights

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MTCDPA), Tennessee (TIPA), and other states with applicable privacy laws have similar rights to those described in Sections 9 and 10. To exercise these rights, contact privacy@weorda.com.

13. International Users

The Service is intended for use in the United States. Information is processed and stored on servers located in the United States. If you access the Service from outside the United States, your information will be transferred to, processed, and stored in the United States, where data protection laws may differ from those in your jurisdiction.

If we begin processing personal information of individuals located in the European Economic Area, United Kingdom, or Switzerland, we will implement appropriate safeguards, including Standard Contractual Clauses, as required by applicable law.

14. Children's Privacy

14.1 The Service is not directed to children under 13 and we do not knowingly collect personal information directly from children under 13 for our own purposes.

14.2 Student information uploaded by Operators is processed under the FERPA framework described in Section 6, not under the consumer COPPA framework. Operators (and the schools they serve) are responsible for obtaining required parental consents. Weorda does not have direct relationships with students; those relationships are managed by the Operator and the school.

14.3 The Weorda Parents app is intended for use by adults (parents, guardians, and authorized caregivers) who are at least 18 years old. Children may not create accounts or use the app. Parents and guardians who create an account in the Weorda Parents app have a direct account relationship with Weorda for their own information, as described in the Weorda Parents App Privacy Policy; information about students shown in the app remains under the control of the Operator and the school.

14.4 If we learn that a child under 13 has provided us with personal information directly, we will promptly delete that information. Parents who believe their child has provided us with information may contact privacy@weorda.com.

15. Cookies and Tracking Technologies

15.1 We use cookies and similar technologies to operate the Service, remember preferences, authenticate users, and analyze usage.

• Strictly necessary cookies: required for the Service to function.
• Functional cookies: remember preferences and settings.
• Analytics cookies: help us understand how the Service is used.

15.2 You can control cookies through your browser settings. Blocking strictly necessary cookies may prevent the Service from functioning.

15.3 We do not currently respond to Do Not Track signals, but we honor opt-out signals where required by law (such as the Global Privacy Control).

15.4 Parent notifications by SMS and push. If your child is a student transported by an Operator that uses Weorda, you may receive SMS notifications about your child's bus or ride. These messages are sent at the direction of the Operator and contain only operational information (such as estimated arrival times). You can opt out of SMS notifications by replying STOP. Standard message and data rates may apply. Notifications sent through the Weorda Parents app are described in the Weorda Parents App Privacy Policy.

15.5 Google Analytics on our marketing website. Our public marketing website (weorda.com) uses Google Analytics 4 to understand how visitors find and use the site (for example, pages viewed, approximate location, device and browser type, and referring source). Google Analytics sets cookies and processes this information as our service provider. We use it only to measure and improve the website; we do not use it for advertising and we do not sell this data. You can opt out by adjusting your browser's cookie settings or by installing the Google Analytics Opt-out Browser Add-on at tools.google.com/dlpage/gaoptout. For details on how Google processes data, see Google's Privacy Policy at policies.google.com/privacy.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated Privacy Policy at weorda.com/privacy with a new "Last Updated" date. For material changes, we will provide additional notice (such as by email or a notice in the operator dashboard) at least 30 days before the changes take effect.

17. Contact Information

If you have questions, comments, or requests regarding this Privacy Policy:

YPA Group Inc. (d/b/a Weorda)

Privacy: privacy@weorda.com

Legal: legal@weorda.com

General: olga@weorda.com

Account or app help: support@weorda.com

For data deletion or access requests, please use the subject line "Privacy Request" and include your name, email, company (if applicable), and the nature of your request.