Privacy Policy

QikRout Privacy Policy Effective Date: April 6, 2025 | Last Updated: April 6, 2025 QikRout ('we', 'us', 'our') is committed to protecting your privacy. This Policy governs how we collect, use, store, and disclose personal information when you use the QikRout application ('App'). By using the App, you consent to the practices described herein. This Policy complies with: Quebec Law 25 (Act Respecting the Protection of Personal Information in the Private Sector, as amended); Canada's Personal Information Protection and Electronic Documents Act (PIPEDA); the EU/UK General Data Protection Regulation (GDPR); the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA); and other applicable international privacy legislation. 1. Privacy Officer As required by Quebec Law 25, we have designated a Privacy Officer responsible for overseeing compliance with this Policy. Privacy Officer: Chris Ilio Email: privacy@qikrout.com Mailing: QikRout, Montreal, Quebec, Canada You may contact our Privacy Officer to exercise any rights described in this Policy or to report a privacy concern. 2. Information We Collect 2.1 Information You Provide Directly • Route data: stop names, addresses, cities, postal codes, delivery notes, and customer names you manually enter • Account information: email address, name, and payment method when you subscribe to a paid plan • Proof-of-delivery photos: images captured within the App and stored locally on your device 2.2 Information Processed by AI When you use AI features (route optimization, AI Find, Schedule Builder, voice parsing, OCR scanning), your stop data and queries are transmitted to Anthropic's Claude API for processing. This transmission is encrypted. Anthropic's privacy policy (anthropic.com/privacy) governs their handling of API inputs. We do not permit Anthropic to use your data to train AI models without your explicit consent. 2.3 Information Collected Automatically • Device identifiers and app version for crash diagnostics • Aggregate, anonymized usage statistics (features used, session duration) — no personally identifiable information is included • No precise location data is collected or stored by QikRout. Navigation is handled entirely by third-party apps (Apple Maps, Google Maps, Waze) at your direction. 2.4 Information We Do NOT Collect We do not collect: biometric data, financial account numbers beyond payment processing, health information, government-issued ID numbers, or real-time GPS location. 3. How We Use Your Information We use your personal information solely for the following purposes: • To provide, operate, and improve the App and its features • To process route optimization and AI-generated suggestions • To process subscription payments and manage your account • To send transactional communications (receipts, service updates, security alerts) — you cannot opt out of these essential communications • To respond to your support requests • To comply with legal obligations • To detect fraud and ensure platform security We do NOT use your personal information for: advertising, behavioral profiling, sale to third parties, or any purpose beyond those listed above. AI-Assisted Decisions: Route optimization, ETA calculations, and schedule suggestions are generated by AI. These are recommendations only. You retain full control and final decision-making over your route. You have the right to understand and contest any AI-generated output that materially affects you, as required by Quebec Law 25 and GDPR Article 22. 4. Legal Basis for Processing Depending on your jurisdiction, we process your personal information based on: • Contract performance: processing necessary to provide the App service you have agreed to use • Legitimate interests: improving the App, preventing fraud, ensuring security • Legal obligation: complying with applicable law • Consent: for any optional data collection or marketing communications (you may withdraw consent at any time) For Quebec residents: collection, use, and disclosure of your personal information is governed by Quebec Law 25. We collect only the minimum information necessary (data minimization principle) and retain it only as long as required for its stated purpose or by law. For EU/UK users: our legal bases under GDPR are Article 6(1)(b) (contract), Article 6(1)(c) (legal obligation), and Article 6(1)(f) (legitimate interests). No special category data under Article 9 is processed. For California residents: we do not sell your personal information (as defined under CCPA/CPRA) and do not share it for cross-context behavioral advertising. 5. Data Storage & Security 5.1 Local Storage All route data, saved routes, schedules, and delivery photos are stored exclusively on your device using browser localStorage. This data never leaves your device unless you explicitly share it or use AI features (see Section 2.2). 5.2 Account & Subscription Data Account and payment information is processed and stored by our payment processor (Stripe or Apple/Google Play), which maintains PCI-DSS Level 1 compliance. We store only a minimal account record (email, subscription tier, subscription status) on secured servers. 5.3 Security Measures We implement industry-standard security measures including: TLS 1.3 encryption for all data in transit; HTTPS-only API communications; no storage of plaintext passwords; regular security reviews. 5.4 Data Retention Route data: stored locally on your device until you delete it or clear app data. Account data: retained for the duration of your account plus 12 months, or as required by tax and accounting law (typically 7 years in Canada). AI API logs: Anthropic retains API logs per their retention policy; we do not retain logs of AI queries on our servers. 5.5 Data Breach Notification In the event of a data breach posing a risk of serious injury, we will notify the Commission d'accès à l'information du Québec (CAI) and affected individuals as soon as reasonably possible, as required by Quebec Law 25 and PIPEDA. Notification will include the nature of the breach, data involved, remediation steps taken, and contact information for our Privacy Officer. 6. Sharing of Information We do not sell, rent, or trade your personal information. We may share limited information with: • Anthropic, Inc. (USA): for AI processing of stop data when you use AI features. Governed by a Data Processing Agreement compliant with applicable law. • Payment processors (Stripe/Apple/Google): for subscription billing. They are independent data controllers subject to their own privacy policies. • Cloud infrastructure providers: for hosting account data, under strict confidentiality and security obligations. • Legal authorities: when required by a valid court order, subpoena, warrant, or applicable law. We will notify you of such requests unless prohibited by law. • Business transfers: if QikRout is acquired or merges, your data may be transferred to the successor entity subject to equivalent privacy protections. You will be notified in advance. Cross-Border Data Transfers: AI processing by Anthropic involves transfer of stop data to servers in the United States. For Quebec residents, we have conducted a Privacy Impact Assessment (PIA) as required by Law 25 for cross-border transfers. For EU/UK users, transfers are conducted under Standard Contractual Clauses (SCCs) compliant with GDPR Chapter V. 7. Your Privacy Rights Depending on your jurisdiction, you have the following rights. To exercise any right, contact privacy@qikrout.com. We will respond within 30 days (as required by Quebec Law 25 and GDPR). ✓ Right to access: obtain a copy of your personal information ✓ Right to rectification: correct inaccurate personal information ✓ Right to erasure / right to be forgotten: request deletion of your personal information ✓ Right to data portability (Quebec Law 25, GDPR): receive your data in a structured, machine-readable format (effective September 22, 2024 under Law 25) ✓ Right to withdraw consent: withdraw any consent previously given, without affecting prior lawful processing ✓ Right to de-indexation (Quebec Law 25): request that certain information be de-indexed from search results where applicable ✓ Right to object to automated decision-making: request human review of AI-generated routing decisions that materially affect you ✓ Right to lodge a complaint: with the CAI (Quebec), OPC (Canada), your national data protection authority (EU/UK), or the California Privacy Protection Agency (CPPA) Quebec residents have an additional private right of action under Law 25 for intentional violations or gross negligence, with minimum damages of CAD $1,000. Californiа residents: We do not discriminate against users who exercise their CCPA/CPRA rights. Minors: We do not knowingly collect data from children under 14 (Quebec Law 25) or under 13 (USA, COPPA). If you believe a minor has provided data to us, contact privacy@qikrout.com immediately. 8. Cookies & Tracking QikRout is a mobile application and does not use browser cookies. We do not use tracking pixels, cross-site tracking, or behavioral advertising technologies. Anonymized, aggregate analytics (crash reports, feature usage) use no personally identifiable information and cannot be used to identify you. As required by Quebec Law 25, we do not activate any technology that could identify, locate, or profile you without your explicit prior consent. 9. Third-Party Services The App integrates with third-party navigation apps (Apple Maps, Google Maps, Waze, etc.) when you tap Navigate. QikRout passes only the destination address to your chosen navigation app. Each navigation provider's privacy policy governs their data use. The App loads weather data from Open-Meteo (open-meteo.com), an open-source, privacy-respecting weather API. No personal information is transmitted in weather requests — only approximate geographic coordinates derived from your manually entered home base city. This Privacy Policy does not govern third-party services. We encourage you to review their policies. 10. Policy Updates We may update this Policy from time to time. Material changes will be communicated through an in-app notice at least 30 days before taking effect. Continued use of the App after the effective date constitutes acceptance of the updated Policy. The current version of this Policy is always accessible within the App under Settings → Privacy Policy. 11. Contact & Complaints Privacy Officer: privacy@qikrout.com General Support: support@qikrout.com Quebec / Canada: Commission d'accès à l'information du Québec — www.cai.gouv.qc.ca EU/UK: Your national data protection authority (list at edpb.europa.eu) California: California Privacy Protection Agency — cppa.ca.gov QikRout — Montreal, Quebec, Canada