WheelPlanner Privacy Policy

Table of Contents

1. Overview and Scope
2. Who Controls Your Data
3. Information We Process
4. How We Use the Information
5. Subprocessors
6. Data Retention
7. Security Measures
8. California Breach Notification
9. No Sale or Sharing of Personal Information
10. CalOPPA Disclosures
11. US-Only Service
12. Future Legal Frameworks
13. Changes to This Policy
14. Contact Us
15. SMS and Text Messaging

1. Overview and Scope

WheelPlanner is a scheduling and operations platform for behind-the-wheel (BTW) driving schools in the United States. This Privacy Policy explains how Andrew M. Sanchez (“WheelPlanner,” “we,” “our,” or “us”) collects, processes, and protects information in connection with the WheelPlanner platform at wheelplanner.com (the “Service”).

Who this policy covers. This policy applies to:

• Driving schools that create accounts and use WheelPlanner to manage their operations (“Schools”).
• Instructors whose information Schools enter into the platform.
• Students (and their parents or guardians) whose information is entered into the platform, by the School or by a parent or driver through their own account, in order to schedule and manage behind-the-wheel lessons. Students are typically minors between the ages of 15 and 17.

WheelPlanner is a business-to-business (B2B) service. We do not solicit or market to students or parents directly. Schools subscribe to WheelPlanner and decide what information about their instructors and students to enter.

Parent and driver accounts. A parent or a driver can create their own WheelPlanner account using a signup link from their School, and that account is joined to that School. At signup the parent or driver gives their own name and email address, and optionally a phone number. Through that account, the parent or driver then enters the student's legal name, preferred name, date of birth, driving experience, notes for the School, and backup phone numbers; may upload a photo of the learner's permit; books lessons; and, where the School accepts online payments, pays the School by card.

This section is being reviewed by counsel following a correction to how accounts work. California Business and Professions Code Section 22581 (minor online erasure rights) does not apply to WheelPlanner's current service model.

2. Who Controls Your Data

This section is being reviewed by counsel following a correction to how accounts work. It does not yet address information that parents and drivers enter through their own accounts (see Section 1).

Schools are the data controllers for their student and instructor records. When a School enters information about an instructor or a student into WheelPlanner, the School is the party that decided to collect that information and determined the purpose. WheelPlanner acts as a data processor (service provider / custodian) - we process that information only to operate and improve the Service on the School's behalf, not for our own independent purposes.

Practical implications:

• If a student or parent wants to know what information a School has entered about them, they should contact the School.
• If a student or parent wants information corrected or deleted, that request goes to the School; the School may then direct WheelPlanner to take action.
• WheelPlanner will assist Schools in responding to such requests as required by applicable law.
• If a School is unreachable or has ceased operations, individuals may contact WheelPlanner directly at andrew@wheelplanner.com to request that student records be deleted from our systems.

3. Information We Process

3.1 School Account Data

When a School creates an account, we collect:

• Business name, contact name, and email address of the account holder.
• Billing information (payment card details - handled directly by our payments processor Stripe; we do not store full card numbers).
• Business address (optional, for profile purposes).
• Login credentials (email and hashed password).

3.2 Instructor Data

Schools may enter the following about their instructors:

• Name and contact information (email address, phone number).
• Availability schedules and assigned lesson slots.
• Vehicle information (if entered by the School).
• Any notes or records the School adds to an instructor profile.

3.3 Student Data - Including Minors

Schools, or a parent or driver through their own account (see Section 1), may enter the following about students (who are typically minors ages 15-17):

• Full name, date of birth, and contact information (phone number, email address, or parent/guardian contact).
• Scheduled lesson dates, times, locations, and instructor assignments.
• Lesson completion records, notes, and progress information.
• Any documents uploaded by the School in connection with a student's enrollment (such as DMV forms or progress certificates).
• A photo of the student's learner's permit, if a parent or driver uploads one through their account.
• Voice recordings or transcribed notes if a School uses WheelPlanner's AI-assisted voice note feature. Voice notes are stored locally on the instructor's device using browser storage (IndexedDB) until they are synced to WheelPlanner's servers or discarded by the instructor. WheelPlanner does not control or purge local device storage; the retention terms in Section 6 apply to server-side copies only. Audio submitted for transcription is processed by our AI subprocessor (see Section 5) and is not retained by that provider beyond the processing request.

Who enters student information. Student information is entered by the School, or by a parent or driver through an account joined to the School (see Section 1). A driver who creates their own account may be a minor. WheelPlanner does not use student data for advertising, profiling, or any purpose beyond operating the Service for the School.

Children under 13. WheelPlanner does not knowingly collect personal information directly from children under 13. Student information is entered by the School, or by a parent or driver through an account joined to the School. Schools are responsible for ensuring they have obtained any parental consents required for students under the age of 13 before entering that student's information into WheelPlanner. (Note: WheelPlanner does not collect data directly from children under 13, and state minimum learner's permit ages (in California, for example, the minimum learner's permit age is 15½; other states set their own minimum) mean COPPA's under-13 threshold is practically inapplicable to driving-school students. However, edge cases could still trigger COPPA. The FTC's 2025 COPPA Rule amendments (effective April 22, 2026) considered a school-authorization exception and deliberately declined to codify it, leaving only the FTC's non-binding 2022 EdTech guidance. The 2025 rule also newly classifies biometric identifiers, including voiceprints, as personal information under COPPA - relevant to WheelPlanner's voice note feature.)

3.4 Technical and Usage Data

When someone accesses the WheelPlanner platform, we and our hosting and infrastructure providers automatically collect:

• IP address, browser type, and operating system.
• Pages visited within the application, timestamps, and general usage patterns.
• Error logs and diagnostic data.

This data is used to operate, secure, and improve the Service. It is not linked to individual student records for marketing or analytics purposes.

WheelPlanner uses session cookies and similar browser storage mechanisms solely to maintain authenticated login sessions. We do not use third-party advertising or tracking cookies, and we do not track users across third-party websites.

3.5 Communications Data

When Schools, instructors, or parents receive SMS text reminders or transactional emails through WheelPlanner, we process the recipient's phone number or email address and the message content. This applies only to messages initiated by the School (e.g., lesson reminders). Text messaging specifically - what we send, how often, how to stop, and our commitment not to share mobile numbers - is described in Section 15.

4. How We Use the Information

We use the information described in Section 3 solely to:

1. Operate the Service - schedule and manage BTW lessons, display calendars, send automated reminders, and generate records for the School.
2. Process payments - charge the School's subscription fee through Stripe.
3. Provide support - respond to questions, troubleshoot issues, and communicate with Schools about their accounts.
4. Maintain security and integrity - detect and prevent fraud, abuse, or unauthorized access.
5. Improve the Service - analyze aggregate usage patterns (not individual student records) to inform product decisions. We may use aggregate, de-identified statistical data (e.g., average lesson volumes, platform performance metrics) that cannot reasonably be re-linked to any individual School, instructor, or student for product improvement and industry benchmarking.
6. Comply with law - respond to lawful requests, court orders, or legal obligations, including California breach-notification requirements.

We do not use student data for advertising, behavioral profiling, sale to third parties, or any purpose unrelated to operating the Service for the School that entered that data.

5. Subprocessors

To deliver the Service, WheelPlanner relies on the following third-party subprocessors. Each receives only the data necessary to perform its specific function.

We will update this table and notify Schools by email (per Section 13) when we add or replace a subprocessor.

6. Data Retention

• School account data is retained for as long as the School's account is active. After the School's subscription ends, it is not deleted automatically: it stays stored, and the School can still view and export it. From 7 days after the subscription ends, the account may become read-only, which stops new lessons, new instructors, and new online package purchases by parents. WheelPlanner does not currently delete a closed School's data on a set schedule. To ask about deleting it, contact us at the address in Section 14.
• Student and instructor records are retained for as long as the School's account is active, and after the subscription ends on the same terms as School account data. Schools may delete individual student records at any time through the platform.
• Voice note server-side copies are retained on the same terms. Voice notes stored locally on an instructor's device (browser storage) are outside WheelPlanner's retention control; instructors may clear browser data to remove local copies.
• Technical logs are retained for up to 90 days for security and operational purposes.
• Backup copies may be retained for up to 30 days beyond the deletion of primary records.

If a law, regulation, or legal proceeding requires us to retain records for a longer period, we will do so and notify the School where feasible.

7. Security Measures

We implement reasonable administrative, technical, and physical safeguards appropriate to the sensitivity of the data we hold, including:

• Encryption of data in transit (TLS) and at rest.
• Row-level security policies that enforce strict data isolation between Schools (one School cannot access another School's records).
• Authentication requirements and access controls for all staff who access application infrastructure.
• Logging of administrative database access.
• Regular review of subprocessor security practices.

No security measure is perfect or impenetrable. We will notify affected Schools promptly if we discover a breach that may affect their data (see Section 8).

8. California Breach Notification

WheelPlanner processes personal information about California residents, including minors.

California Civil Code Section 1798.82 distinguishes two roles. Under Section 1798.82(b), WheelPlanner as the data maintainer is required to notify the data owner (the School) immediately following discovery of a breach of unencrypted personal information it maintains on the School's behalf. Under Section 1798.82(a), the School as data owner is then responsible for notifying the affected individuals. Schools whose breach affects more than 500 California residents (i.e., 501 or more) from a single breach must also electronically submit a sample copy of the breach notification to the California Attorney General under Section 1798.82(f), within 15 calendar days of notifying the affected individuals. Individual and AG notification are the School's statutory obligations, not WheelPlanner's. Note: as of January 1, 2026, California Civil Code Section 1798.82(a) (as amended by SB 446) requires Schools, as data owners, to notify affected California residents within 30 calendar days of discovering a breach; Schools should plan their response timelines accordingly.

Our commitment:

• If we discover a data security breach affecting personal information we maintain, we will notify affected Schools immediately following discovery of a breach (or when we reasonably believe a breach has occurred), consistent with our duty as data maintainer under California Civil Code Section 1798.82(b). Our operational target is within 24-48 hours of confirmed discovery, so that Schools can fulfill their notification obligations to students and parents.
• We will cooperate fully with each affected School's notification obligations and provide Schools with the information they need to fulfill their own duties to affected individuals under California law.
• Notifications will be provided by email to the School's account email address on file, or by substitute notice where required under California law.
• We will make reasonable efforts to investigate the scope and cause of any breach and to remediate the vulnerability.

Nothing in this policy limits any School's own notification obligations under applicable law.

9. No Sale or Sharing of Personal Information

WheelPlanner does not:

• Sell personal information about students, instructors, or school personnel to any third party.
• Share personal information with third parties for their own marketing or advertising purposes.
• Use student data for behavioral advertising, cross-context advertising, or data brokering.
• Disclose personal information to third parties other than the subprocessors listed in Section 5, except as required by law or with the express consent of the School.

If our practices change in the future, we will update this policy and provide advance notice as described in Section 13 before any such change takes effect.

10. CalOPPA Disclosures

The California Online Privacy Protection Act (CalOPPA) requires operators of commercial websites and online services that collect personally identifiable information from California consumers to post a conspicuous privacy policy.

Conspicuous posting. This Privacy Policy is posted in a clearly accessible location on the WheelPlanner website at wheelplanner.com/privacy. We will link to it from our signup flow and from the footer of our main website.

Categories of personally identifiable information collected. We collect the categories described in Section 3: account holder contact information, billing information, instructor information, student information (entered by Schools, or by parents and drivers through their own accounts), technical usage data (including session cookies), and communications data.

Third-party disclosure. We disclose information to the subprocessors listed in Section 5. We do not disclose personally identifiable information to third parties for their own marketing purposes.

How to request changes. Schools may update or correct their own account information by logging into the WheelPlanner platform. To request correction or deletion of other records (including student records), contact us at the address in Section 14.

Do Not Track. California law requires us to disclose how we respond to Do Not Track (DNT) signals from browsers. WheelPlanner does not currently change its data collection or use practices in response to DNT signals because we do not engage in the cross-site behavioral tracking that DNT is designed to limit. We use only first-party session cookies to maintain authenticated login sessions and do not track users across third-party websites for advertising purposes. We will revisit this position if our data practices change.

Third-party collection across websites. WheelPlanner does not permit any third party to collect personally identifiable information about individual users' online activities over time and across different websites when they use this Service. Our infrastructure and service providers listed in Section 5 receive only the data necessary to operate WheelPlanner on our behalf and are prohibited from using that data for their own advertising or cross-site tracking purposes.

11. US-Only Service

WheelPlanner is designed for and marketed exclusively to driving schools operating in the United States. We do not knowingly offer the Service to businesses or individuals outside the United States, and we do not intentionally transfer personal data to recipients located outside the United States, except as necessary for our US-based subprocessors to operate their own US-infrastructure services.

12. Future Legal Frameworks

CCPA / CPRA. The California Consumer Privacy Act and California Privacy Rights Act establish rights for California consumers regarding personal information held by covered businesses. At our current size and scale, WheelPlanner does not meet any of the three thresholds that define a covered “business” under Civil Code Section 1798.140(d)(1): (i) annual gross revenues above $26,625,000 (the 2025 CPI-adjusted figure, adjusted biennially by the California Privacy Protection Agency); (ii) annually buying, selling, or sharing the personal information of 100,000 or more consumers or households; or (iii) deriving 50 percent or more of annual revenues from selling or sharing consumers' personal information. We will monitor the biennial threshold adjustments, and if we grow to a scale where these laws apply, we will update this policy, implement the required rights mechanisms, and notify Schools before those changes take effect.

GDPR. The EU General Data Protection Regulation does not currently apply to WheelPlanner because we do not offer services to individuals in the European Union. If we ever expand beyond the US, we will assess GDPR applicability and update this policy accordingly.

FERPA and AB-1584. These laws apply to educational agencies and institutions - primarily public schools and districts - not to private driving schools operating under state driver-training licensure. They do not directly bind WheelPlanner at this time. If a School customer is a public program or local educational agency, the School is responsible for its own compliance with applicable education privacy laws; WheelPlanner will cooperate as a service provider upon written request.

SOPIPA. Business and Professions Code Section 22584 (SOPIPA) restricts operators of online services designed and marketed for use in K-12 schools. WheelPlanner is designed for private driving schools licensed by their state's driver-training regulator, not for K-12 educational institutions, so SOPIPA does not apply to WheelPlanner at this time.

California Age-Appropriate Design Code (AB 2273 / CAADCA). This law imposes design, disclosure, and data-use requirements on businesses that provide online services “likely to be accessed by children” (under 18). As of this writing, a Ninth Circuit preliminary injunction blocks portions of the statute, while other provisions are no longer enjoined following the Ninth Circuit's 2026 ruling in NetChoice v. Bonta. This section is being reviewed by counsel following a correction to how accounts work. WheelPlanner is a B2B platform, which may place WheelPlanner outside the statute's scope. A driver, who may be a minor, can hold a WheelPlanner account and use the platform directly (see Section 1).

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Post the updated policy at wheelplanner.com/privacy with a revised “Last Updated” date.
• Send an email notice to the account email address on file for each School at least 30 days before the changes take effect, consistent with the notice period in the WheelPlanner Terms of Service.

Your continued use of the Service after the effective date of a revised policy constitutes your acceptance of the changes. If you do not agree to the updated policy, you may cancel your subscription before the effective date.

14. Contact Us

For privacy-related questions, data requests, or breach notifications, contact:

Andrew M. Sanchez
Email: andrew@wheelplanner.com
Address: 8939 Foothill Blvd Ste 130, PMB #4003, Rancho Cucamonga, CA 91730

We will respond to privacy inquiries within 10 business days.

WheelPlanner is operated by Andrew M. Sanchez, a California sole proprietorship.

15. SMS and Text Messaging

This section applies to the text (SMS) messages Schools send through WheelPlanner to parents, guardians, drivers who hold their own account, instructors, and school staff. It is written to be read on its own, because mobile carriers and our messaging provider review it before permitting a School to send.

15.1 What We Send

Text messages sent through WheelPlanner are informational and relate to a specific lesson, waitlist request, or account. To a family they are: lesson confirmations and reminders, schedule changes and cancellations (including weather), instructor and substitute changes, waitlist openings and earlier times you asked for, permit, payment, fee and package notices, and messages your school writes to you about lessons. Instructors and school staff receive texts about their own work: new, changed and cancelled lessons, substitute (coverage) requests, and student transfers. Payment, fee and package notices state facts only, such as what is owed or how many lesson hours remain, and never offer anything for sale. Messages a School writes itself, such as a reply to a message you sent or a notice about a closure or the weather, are about your lessons and the School's schedule; each School agrees in Section 19 of our Terms to write nothing else. We do not send marketing, advertising, or promotional text messages, and we do not send text messages on behalf of anyone other than the School you enrolled with.

15.2 How You Opt In

You opt in to text messages only by ticking the separate, unchecked text-message box shown next to your own mobile number, during signup or in your account settings. The box is never ticked for you, and entering a mobile number does not, by itself, opt it in. A number that School staff enter for you, or that someone else lists as an additional contact, is not opted in; WheelPlanner reaches those people by email instead. We keep a record of your consent: the exact wording shown next to the box (which identifies its version), your phone number, the account that ticked it, and the date and time. Opting out stops the texts; it does not erase that record. Consent to receive text messages is not a condition of purchasing lessons or any other service - you may leave the box unchecked and still be scheduled, and the School will reach you by email.

Parents first. As a matter of policy, texts about a student under 18 go to the parent's or guardian's own number first. A student's own phone is texted only after the parent or guardian has opted in and the student confirms by replying YES from that phone. A driver who is 18 or older and holds their own account opts in their own number with the box. We do not knowingly collect information from children under 13.

Each School's text messages come from its own dedicated number, and every message names the School. Your consent is to messages from the School you are enrolled with, and to nobody else. If your School stops using WheelPlanner, or you leave the School, we stop sending its texts to you; we never use your consent to text you for another school or for ourselves, and we do not act on it again unless you opt in afresh.

15.3 Message Frequency

Message frequency varies. It depends on how often lessons are scheduled: a student taking two lessons a week might receive roughly 24 to 30 messages a month, and a student who is not currently scheduled may receive none.

15.4 Message and Data Rates

Message and data rates may apply. WheelPlanner and the School do not charge you for text messages, but your mobile carrier may charge you for messages received or sent under your plan.

15.5 How to Stop Messages, and How to Get Help

Reply STOP to any message to stop receiving text messages. STOP, END, CANCEL, QUIT, UNSUBSCRIBE and REVOKE all work, and so do plain words such as "stop texting me". A reply of STOP also gets one final confirmation that you have been unsubscribed. You can also opt out by unticking the text-message box in your account settings, or by asking your School by phone, email or in person, and the School can turn texts off for your family in WheelPlanner. Each of these opt-outs is recorded against your number and that School, and no further texts are sent to it once it is recorded. Removing a mobile number from your account also stops texts to that number. We honor every opt-out within ten business days at the latest, and usually at once. A STOP sent to one School's number stops texts from that number. To stop texts from every School on WheelPlanner, email andrew@wheelplanner.com and we will stop them all. Reply START or UNSTOP to resume texts from that School's number. Reply HELP for help, or contact the School directly, or contact us at the address in Section 14.

Carriers are not liable for delayed or undelivered messages.

15.6 We Do Not Share Mobile Numbers

We do not sell, rent, or share mobile phone numbers or SMS consent with third parties for their own marketing, advertising, or any other purpose. No mobile originator opt-in data is shared with any third party for marketing.

The categories of recipients we disclose personal information to are the subprocessors listed in Section 5, as limited by Section 9. All the above categories exclude text messaging originator opt-in data and consent; this information won't be shared with any third parties.

One clarification, because it is the only place a mobile number leaves our systems: to deliver a text message we must hand the recipient number and the message content to our messaging provider, Twilio, which is listed as a subprocessor in Section 5. Twilio acts only as our service provider under contract, processes the number solely to deliver the message we asked it to deliver, and is not permitted to use it for its own purposes. A service provider acting on our instructions is not a "third party" for the purposes of the paragraph above, and nothing else in our stack receives mobile numbers for messaging.

15.7 Privacy of Your Mobile Number

Mobile numbers are stored under the same protections as the rest of your account data (Section 7), are retained on the schedule in Section 6, and are covered by the no-sale and no-sharing commitments in Section 9. Message content sent and received is logged so the School has a record of what was sent about a lesson.

See also our Terms of Service.