Greyhound: Buy Bus Tickets

"Depending on the Greyhound Services that you use, and your app settings or device permissions, we may collect your approximate, and sometimes precise, location information as determined through data such as GPS, IP address and Wi-Fi... For example, for Targeted Advertising purposes, we may disclose geolocation data and other PI (e.g., web usage data tied to your device) to provide customized content promotions to you based on your location."

Greyhound collects precise GPS location data and discloses it to third-party digital businesses for targeted advertising, going well beyond what's needed for a bus transportation service.

"Our partners may collect information directly from your device, such as your IP address, device ID, and information about your browser or operating system; may combine personal and non-personal information about you with information from other sources; and may place or recognize a unique cookie on your browser. This activity enables them to identify you to facilitate the delivery of marketing on our behalf."

Greyhound allows extensive third-party data collection directly from user devices via SDKs, cookies, and tracking pixels, enabling partners to build profiles and deliver targeted marketing.

"Device Recognition Technologies. Technologies, including application of statistical probability to data sets, as well as linking a common unique identifier to different device use (e.g., Facebook ID), which attempt to recognize or make assumptions about users and devices (e.g., that a user of multiple devices is the same user or household) ('Cross-device Data')."

Greyhound uses device recognition technologies and cross-device data linking to track users across multiple devices and build unified profiles, including probabilistic matching techniques.

"Device and Activity Monitoring. Technologies that monitor and may record certain of your interactions with the Service, including without limitation, keystrokes, and/or collect and analyze information from your device, such as, without limitation, your operating system, plug-ins, system fonts, and other data... Session Replay Technologies. We may use session replay tools to collect real-time information about your use of the Service, such as pages visited, links clicked, non-sensitive information entered, and mouse movements."

Greyhound monitors keystrokes, uses session replay tools (Hotjar) to record user interactions in real-time, and collects device fingerprinting data like system fonts and plugins—far beyond what a bus ticket service requires.

"Greyhound may retain certain Personal Data, including transaction, location, usage and other Personal Data for approximately 10 years, or as otherwise allowed or required under the applicable law, in connection with regulatory, tax, insurance or other requirements and for other legitimate business purposes in the places in which it operates."

A 10-year retention period for location and usage data is exceptionally long for a transportation service, and the broad 'legitimate business purposes' justification leaves retention essentially open-ended.

"Our data practices may differ between updates, however, if materially different from this Notice, we will provide supplemental pre-collection notice of the current practices, which may include references to other privacy policies, notices, or statements. Otherwise, this Notice serves as our notice at collection... If we change this Health Privacy Policy, we will post the revised version here and change the last updated date."

Greyhound can change its data practices between policy updates and merely posts revised versions online, with no requirement for affirmative user consent to material changes.

"Except to the extent we have a basis for retention under applicable law, you may request that we delete your PI. Our retention rights include, without limitation: to complete transactions and services you have requested; for security purposes; for legitimate internal Business Purposes (e.g., maintaining business records); to comply with law and to cooperate with law enforcement; and to exercise or defend legal claims."

Deletion rights are heavily qualified with broad retention exceptions including 'legitimate internal Business Purposes,' and the process requires submitting requests through specific forms with multi-step identity verification.