Privacy Policy

Last updated: [DATE]

This policy explains how [LEGAL NAME OF BUSINESS] ("DriveDash", "we", "us") collects, uses, discloses and protects personal information when you use the DriveDash website and app (the "Service"). We follow the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws.

1. Who is responsible

Our Privacy Officer is accountable for how we handle personal information. Contact: [PRIVACY OFFICER NAME], [PRIVACY CONTACT EMAIL], [MAILING ADDRESS].

2. What we collect

• Account information: your name, email address and password (stored only as a secure hash), and optionally your phone number and profile photo.
• Information you enter: income records (amounts, dates, hours, trips, tips, platform fees), expenses and the receipts you upload, vehicle details (make, model, year, licence plate, VIN), mileage records (odometer readings, trip locations and purposes), maintenance records and tax settings.
• Billing information: if you subscribe, payments are processed by Stripe. We store your Stripe customer and subscription identifiers and subscription status. We never see or store your full card number.
• Waitlist and contact messages: your email address and any message you send us.
• Technical information: IP address, browser type and request logs created when you use the Service, used for security and troubleshooting.

3. Why we use it

• To provide the Service: store your records, calculate summaries and show your dashboards.
• To manage your account, trial and subscription, and to process payments.
• To communicate with you about your account, service changes and, if you joined the waitlist, the product launch.
• To keep the Service secure, prevent abuse and fix problems.
• To meet legal obligations.

We do not sell your personal information, and we do not use it for third-party advertising.

4. Consent

By creating an account or joining the waitlist, you consent to the collection and use described here. You can withdraw consent at any time by deleting your account or asking us to remove you from the waitlist; some features may then no longer be available to you.

5. Where your information is stored and who we share it with

Your account data and uploaded files are stored on servers operated by Oracle Cloud Infrastructure in Ashburn, Virginia, United States. Encrypted backups are stored in Canada. We use the following service providers, which process information on our behalf under contract:

• Stripe (payment processing), which may process information in the United States and other countries.
• Cloudflare (website delivery and security), which may process information in the United States and other countries.
• Brevo (account and service emails), which processes information in the European Union.
• Oracle Cloud Infrastructure (hosting of the app and its database), in the United States.
• [BACKUP STORAGE PROVIDER] (encrypted backups), in Canada.

Information processed outside Canada is subject to the laws of those countries and may be accessible to their courts, law enforcement and national security authorities. We may also disclose information when required by law.

6. How long we keep it

We keep your information while your account is open. When you delete your account, we delete your records and uploaded files from the live system immediately. Copies in encrypted backups are deleted within 30 days. Stripe keeps payment records as required by law. Waitlist entries are kept until launch or until you ask us to remove them.

DriveDash is not a substitute for your own records: the Canada Revenue Agency generally requires you to keep business records for six years, so download your data before deleting your account.

7. Your rights

• Access and portability: download all your data at any time from Profile → Privacy & Data → Download my data.
• Correction: edit your information directly in the app, or contact us.
• Deletion: delete your account from Profile → Privacy & Data → Delete my account.
• Complaints: contact our Privacy Officer first. You may also complain to the Office of the Privacy Commissioner of Canada.

8. How we protect it

We use encrypted connections (HTTPS), hashed passwords, access controls that limit each user to their own records, and encrypted backups. No system is perfectly secure; if a breach creates a real risk of significant harm, we will notify you and the Privacy Commissioner as required by law.

9. Cookies and local storage

We use your browser's local storage to keep you signed in and to remember preferences such as light or dark mode. We do not use advertising or cross-site tracking cookies. [UPDATE IF YOU ADD ANALYTICS]

10. Children

The Service is intended for adults who drive for work. We do not knowingly collect information from anyone under 18.

11. Changes to this policy

We will post any changes on this page and update the date above. If changes are significant, we will notify you by email or in the app.

12. Contact us

[PRIVACY CONTACT EMAIL] · [MAILING ADDRESS]