Privacy Policy

1. Who We Are and Scope of This Policy

This Privacy Policy explains how NET1Plus LLC, a New Hampshire limited liability company doing business as Travel More Mobile RV Services and Travel More RV ("Company," "we," "us," "our"), collects, uses, stores, shares, and protects information in connection with the Fuel Dashboard website, application, and related services (the "Service").

This Policy is incorporated into, and should be read together with, our Terms of Service. Capitalized terms not defined here have the meaning given in the Terms of Service.

We built this Policy to be a straightforward, accurate account of our actual practices — not generic boilerplate. Where our practices are more protective than industry-typical, we say so specifically, because we think you should be able to trust exactly what happens to your data, not just that it is "kept secure."

2. Information We Collect

2.1 Account Information

When you register, we collect information such as your name, email address, and authentication credentials (managed through Amazon Cognito). We do not store your password in a form we can read; Cognito handles credential storage and authentication using industry-standard hashing.

2.2 Uploaded Documents

You upload fuel-discount settlement documents from fuel discount program providers (such as Open Roads, Mudflap, and others) so the Service can extract transaction and savings data. These documents are referred to in this Policy as "Uploaded Documents."

2.3 Extracted Transaction Data

From your Uploaded Documents, our system extracts fuel-purchase transaction details relevant to calculating discounts and savings — for example, transaction dates, fuel types/gallons, unit prices, discount amounts, and site/location identifiers tied to the transaction. This becomes the data shown on your dashboard.

2.4 Payment Information

If you subscribe to a paid plan, payment is processed by our third-party payment processor (Stripe). We do not receive or store your full card number; we receive limited billing metadata (such as subscription status and a payment method reference token) needed to manage your account.

2.5 Usage and Device Data

We may automatically collect standard technical data when you use the Service, such as IP address, browser type, device identifiers, access times, and pages viewed, through server logs and infrastructure logging (e.g., AWS CloudFront and application logs).

2.6 Cookies and Similar Technologies

We use strictly necessary cookies/local storage required for authentication and session management (via Cognito) to operate the Service.

3. Personal Information Contained On Your Statements — What We Do and Do Not Do With It

This section addresses something we think deserves explicit, plain-language treatment rather than a footnote.

3.1 What's on a typical settlement statement

The fuel-discount settlement documents you upload commonly contain personal information that is not related to your fuel transactions themselves — for example, your name, mailing address, and your discount-program account number, as printed by the issuing fuel discount program provider (e.g., Open Roads, Mudflap, and others).

3.2 We do not extract, collect, store, or use that information as data

Our extraction process is scoped specifically to fuel-transaction data (Section 2.3). We do not read, parse, extract into our database, index, analyze, or otherwise use your name, address, or discount-program account number as part of our data processing, even though that information physically appears on the page. It is not copied into our transaction records, it is not associated with your account as a separate data field beyond what you provided at registration, and it is not used for any purpose.

3.3 The only place that information exists in our systems is inside the original file itself, for the limited time it is retained

For the brief period your original Uploaded Document is on our systems (see Section 3.4 and Section 8 below), that document — in its original form and format, exactly as you uploaded it — is stored as a file, encrypted at rest. The personal information on that page exists only because it exists in the source document you gave us, in the same way it would exist if you saved a copy on your own computer. We do not treat it as a separately collected or usable data point.

3.4 How long we keep the original file

We do not retain your original Uploaded Document by default. Once your document has been successfully processed and the extracted transaction data (Section 2.3) has been saved to your dashboard, the original file is automatically deleted from our systems.

The only exception is if your statement requires manual review — for example, if our automated extraction cannot confidently process it. In that case, the original file is retained temporarily, only for as long as it takes our review process to resolve the item, after which it is deleted in the same way. See Section 3.5 for more on statements in this category.

3.5 Redaction for manually reviewed statements (planned)

We are evaluating an automated redaction step for statements that require manual review, so that personal information such as name, address, and discount-program account number would be removed from those temporarily retained files before storage or human review. This capability does not exist today. Statements requiring manual review are currently retained, unredacted, in their original form for the limited period described in Section 3.4, and are deleted once review is complete. We will update this Policy if and when a redaction step is implemented.

4. How We Use Information

We use the information described above to:

• create and maintain your account and authenticate your access (via Cognito);
• extract, calculate, and display your fuel-transaction and savings data on your dashboard;
• process payments and manage subscriptions (via Stripe), once paid plans are available;
• provide customer support and respond to your requests;
• maintain, secure, and improve the Service, including diagnosing technical issues;
• comply with legal obligations and enforce our Terms of Service; and
• communicate with you about your account, service updates, and other administrative matters, and, if you opt in, product news and marketing (see Section 9.5 for the distinction and your choices).

5. AI-Assisted Data Extraction (Third-Party Processing Disclosure)

To extract transaction data from your Uploaded Documents, the Service transmits document content to Anthropic's Claude models via Amazon Bedrock, a managed AI service operated within our AWS infrastructure.

• Your Uploaded Documents are sent to this AI processing step for the sole purpose of extracting the transaction data described in Section 2.3.
• This AI processing occurs within our AWS account infrastructure; it is not a general-purpose consumer chat product, and your documents are not exposed to other Bedrock customers.
• Your data is not used to train AI models. Per Amazon Bedrock's data protection terms, neither AWS nor third-party model providers (including Anthropic) use the content you submit through Bedrock, or the outputs it returns, to train or improve their underlying models, and your content is not shared with model providers.

6. How We Store and Protect Your Data

We think you should know specifically what protects your data, not just that "security is a priority." As implemented:

• Encryption at rest. Your data in our databases (Amazon DynamoDB) and stored files (Amazon S3) is encrypted using customer-managed AWS KMS encryption keys, not default provider-managed keys.
• Encryption in transit. All communication between your device and our Service is encrypted via TLS/HTTPS, served through Amazon CloudFront over our custom domains.
• Per-user data isolation. Your data is logically isolated from other users' data at the application layer, keyed to your unique authenticated identity (Cognito "sub" identifier). Application logic scopes every data query to your identity.
• Authentication. Account login and session management is handled by Amazon Cognito (Managed Login), which follows AWS's security and compliance practices for credential storage and session tokens.
• File integrity protections. Our storage buckets use versioning and deletion-protection safeguards to reduce the risk of accidental or unauthorized data loss.
• Upload validation. Files you upload pass through multiple layers of validation (client-side, transport-level, and server-side content verification) before processing, to reduce the risk of malicious or malformed files entering our systems.
• Infrastructure-as-code. Our infrastructure is defined and deployed through version-controlled infrastructure code (AWS CDK), which supports consistent, auditable configuration of the security controls above.

7. Who We Share Information With

• Service providers/subprocessors who process data on our behalf under contractual confidentiality and data-protection obligations, currently including:
  • Amazon Web Services (AWS) — hosting, storage, database, authentication, and content delivery infrastructure.
  • Amazon Simple Email Service (Amazon SES) — delivery of administrative/transactional and, if you opt in, marketing email (see Section 9.5).
  • Anthropic (via Amazon Bedrock) — AI-based document data extraction (Section 5).
  • Stripe — payment processing, once paid subscriptions are available.
• Legal and safety disclosures — if required by law, subpoena, or legal process, or if necessary to protect the rights, property, or safety of the Company, our users, or others.
• Business transfers — if we are involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, subject to this Policy or a policy at least as protective.
• With your direction — if you affirmatively direct us to share specific information with a third party (e.g., a fleet employer).

We do not share your data with data brokers, advertisers, or ad-tech networks.

8. Data Retention

• Account data is retained for as long as your account is active.
• Uploaded Documents: not retained by default. Original files are automatically deleted once transaction data has been successfully extracted (Section 3.4). The only exception is statements flagged for manual review, which are retained temporarily until review is resolved, then deleted.
• Extracted transaction data is retained for as long as your account is active, so your dashboard history remains available to you.
• Upon account deletion, we will delete or de-identify your personal information and Uploaded Documents within 7 days of your verified deletion request, except where retention is required to comply with legal obligations, resolve disputes, enforce our agreements, or as reflected in encrypted backups that are purged on our standard backup-rotation schedule (typically within 30 days of deletion from primary storage).
• We may retain minimal records (e.g., that an account existed and was deleted) as necessary for legal, accounting, or fraud-prevention purposes.

9. Your Choices and Rights

9.1 Access and Correction

You can access and review your account information and dashboard data at any time by logging into the Service. Contact us at support@travelmorerv.com to request corrections we cannot facilitate directly through the app.

9.2 Deletion

You may request deletion of your account and associated data at any time via account settings or support@travelmorerv.com. See Section 8 for timing.

9.3 State Privacy Law Rights

Depending on your state of residence, you may have additional rights under state privacy laws (such as the California Consumer Privacy Act, as amended) to know, access, delete, or correct your personal information, and to not be discriminated against for exercising these rights. We do not sell or "share" personal information as those terms are defined under applicable state law.

9.4 How to Exercise Rights

Submit requests to support@travelmorerv.com. We may need to verify your identity before completing certain requests.

9.5 Email and Communication Preferences

We send two categories of email communications:

• Administrative and transactional communications, which relate to your account and your use of the Service. Examples include confirmations that a document has been uploaded or processed, notices that a statement or its underlying data has been deleted or purged, account status or closure confirmations, security alerts, and notices of material changes to this Policy or our Terms of Service. These communications are necessary to operate the Service; you cannot opt out of them while you maintain an active account.
• Marketing communications, such as newsletters, product announcements, and promotional offers unrelated to your specific account activity. We send these only if you affirmatively opt in, such as during account creation or in your account settings. You may opt out at any time using the unsubscribe link in any marketing email or through your account settings. Opting out of marketing communications does not affect your receipt of administrative and transactional communications, and does not affect your ability to use the Service.

10. Children's Privacy

The Service is not directed to, and we do not knowingly collect personal information from, children under 18. If we learn we have collected personal information from a child in violation of this Policy, we will delete it.

11. International Users

The Service is designed for and hosted in the United States, and is intended for use by U.S.-based users. If you access the Service from outside the U.S. (for example, while traveling), your information will be transferred to and processed in the United States.

12. Data Breach Notification

In the event of a security incident involving unauthorized access to your personal information, we will notify affected users without unreasonable delay, and in any event no later than 30 days after we discover the incident, except where a shorter or longer period is required by applicable law, in which case we will follow the legally required timeline. We will also notify applicable regulators as required by applicable law, including applicable state breach-notification statutes.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice (such as by email or in-app notification) before the changes take effect. The "Last Updated" date at the top reflects the most recent revision.

14. Contact Us

Questions about this Privacy Policy or our data practices can be directed to:

NET1Plus LLC (d/b/a Travel More Mobile RV Services / Travel More RV)

24 Braemar Road, Windham, NH 03087

support@travelmorerv.com

NET1Plus LLC