Privacy Policy

Bus Down is a student-run trip organization. We coordinate group transportation to college football games by hiring DOT-licensed charter bus operators who own and operate the vehicles. Bus Down is not a transportation carrier and does not hold FMCSA broker authority. Bus Down does not own, operate, maintain, or employ the drivers of any bus. The actual transportation service is provided solely by the licensed operator hired for your trip.

Bus Down is a small student-founded business based in New York, NY. Questions about this policy: support@gobusdown.com

When you reserve a seat on Bus Down, we collect:

• Identity & contact info — full name, email address, and phone number for you and any additional passengers you book.
• Payment transaction metadata — see the dedicated section below. Bus Down does not collect card data.
• Booking details — the trip you booked, the number of seats, the booking code, and any notes you provide.
• Basic usage data — IP address, browser type, and pages visited, collected automatically by our hosting provider (Vercel) for security and performance.

Bus Down does not collect, process, store, transmit, or have access to your payment card information. This is by design, not just by policy.

All payments are processed through Stripe, a PCI-DSS Level 1 certified payment processor — the highest level of payment security certification available. When you click “Pay,” you are submitting your card details directly and exclusively to Stripe’s servers. Your card number, expiration date, and CVC never pass through Bus Down’s systems.

After a successful charge, Stripe notifies Bus Down that a payment occurred. The notification contains only:

• Confirmation that the charge succeeded
• The amount charged and currency
• The email address you provided to Stripe (used to send your booking confirmation)

Bus Down has no ability to retrieve, view, or store your full card number or any sensitive card data at any point in this process. For Stripe’s own data practices, see stripe.com/privacy.

• To process your booking and send your confirmation.
• To contact you with trip-specific updates: pickup time, pickup location, reminders, and schedule changes.
• To check you in on the day of departure (the driver uses the passenger list we supply to the operator).
• To process refunds or respond to support requests.
• To prevent fraud and comply with legal obligations (e.g., tax reporting, dispute response).

We do not use your data for advertising. We do not sell, rent, or trade your information to anyone.

We share information only with the third parties required to operate the service:

• Stripe — payment processing. Your email is shared with Stripe solely to complete the transaction and issue a receipt.
• DOT-licensed charter bus operators — we provide the passenger manifest (names and seat count) to the operator running your trip so they can board passengers. We do not share your payment or contact details with the operator.
• Email provider (Resend) — used to send booking confirmations and trip updates.
• Vercel — our website hosting provider. Usage logs are subject to Vercel’s Privacy Policy.
• Law enforcement or courts — if required by valid legal process (subpoena, court order, or applicable law).

We do not sell, license, or share your personal information with any marketing or advertising platforms.

• All payment processing is handled by Stripe (PCI-DSS Level 1). Bus Down has zero access to card data at any point.
• Our site is served exclusively over HTTPS with TLS encryption.
• Access to booking records is restricted to the operating team and is protected by authentication controls.
• We store booking records in a secured database with access logging.

No method of transmission over the internet is 100% secure. We take commercially reasonable measures to protect your data, but we cannot guarantee absolute security.

We retain your personal information only as long as necessary for the purposes outlined in this policy:

• Active booking records — kept for 3 years after the trip date to support disputes, refunds, and tax obligations.
• Financial transaction metadata (amount, currency, Stripe confirmation) — kept for 7 years to satisfy IRS record-keeping requirements applicable to the business.
• Support correspondence — kept for 2 years after resolution.
• Usage/server logs — retained by Vercel per their own retention policy; we do not independently store them.

After the applicable retention period, records are deleted or anonymized. You may request earlier deletion — see Your Rights below.

You can email us at any time to:

• Request a copy of the personal data we hold about you.
• Correct inaccurate or incomplete information.
• Request deletion of your data (subject to records we are legally required to retain).
• Opt out of non-essential communications.

California residents (CCPA) — you have the right to know what personal information we have collected about you, the right to request deletion, and the right to opt out of the sale of your personal information. Bus Down does not sell personal information. To exercise any CCPA right, email us at the address below.

EU/UK residents — Bus Down does not affirmatively market to users in the European Union or United Kingdom. If you are located in the EU or UK and interact with our service, you may have rights under GDPR or UK GDPR including access, rectification, erasure, and objection to processing. Contact us to exercise those rights.

Send all privacy requests to support@gobusdown.com and we will respond within 30 days.

We use only the minimum cookies required to make the site function (session state, security). We do not use third-party advertising cookies, behavioral tracking pixels, or cross-site tracking of any kind.

Bus Down is intended for passengers 18 years of age or older. We do not knowingly collect personal information from anyone under 13. Passengers between 13 and 17 years old must have a parent or legal guardian complete the booking on their behalf. If you believe a child under 13 has submitted personal information through our site, contact us at support@gobusdown.com and we will delete it promptly.

We will update the “Last updated” date at the top of this page whenever we make changes. If we make a material change to how we collect or use your personal information, we will notify you by email if you have an active or recent booking on file. For all other visitors, the updated date on this page constitutes notice. Continued use of the service after the updated date constitutes acceptance.

Questions about this policy or your data? support@gobusdown.com