Privacy Policy

1.Who we are & scope

Streetfast Inc. (“Streetfast”, “we”) operates the Streetfast platform — the rider app, captain app, store partner panel, websites and related services (the “Services”). We are the organisation responsible for personal information collected through the Services under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws.

This policy applies to everyone who uses the Services: Riders and customers who request rides, send parcels or order from stores; Captains who provide rides and deliveries; Store Partners and their staff who sell through the platform; and recipients of parcels and orders whose details a sender gives us. It does not cover Store Partners’ own handling of your information once an order is with them, or third-party websites we link to.

By using the Services you consent to the collection, use and disclosure of your information as described here. Where the law requires express consent — for example for marketing messages or precise background location — we ask for it separately in the app.

2.Information we collect

Information you give us

Account and profile

Name, email address, mobile number, date of birth, gender and pronouns (optional), profile photo, preferred language, time zone and currency, and your account password where you choose password sign-in.

Saved places and contacts

Home, work and other saved addresses with their map coordinates; emergency contacts; and, where you enter them, a receiver’s name and phone number.

Parcel and order details

Pickup and drop-off addresses, item size and description, recipient name, phone number and email, delivery instructions and order contents.

Payment information

When you add a card, the details are entered directly into our payment processor’s secure form on your device. Streetfast does not receive or store your card number. We store only a processor-issued token and transaction references; card brand and last four digits are fetched from the processor when we display them.

Captain onboarding

Driver’s licence number, class and expiry; vehicle make, model, year, colour, plate, registration and insurance policy details; uploaded identity, licence, insurance, police-check and vehicle documents; bank account details for payouts; and your Social Insurance Number for tax reporting. Bank details and SIN are encrypted at the application layer before storage — only the last four digits are held in readable form for display.

Store Partner onboarding

Business name and address, contact persons, business registration and licence details, food-safety documentation, menu and pricing content, and bank account details (encrypted) for payouts.

Communications

In-app chat messages between customers, Captains, Store Partners and support; support requests; ratings and feedback; and live location shared in chat when you choose to share it.

Family accounts

Where an adult adds a teen or senior as a managed member, the member’s profile is flagged as a dependent of the organiser’s account.

Information we collect automatically

Trip, delivery and order records

Request time, service type, vehicle type, pickup and drop-off coordinates, the route driven, timing, fare breakdown and the exact rate configuration used to quote the price, payment method and status.

Location

See section 3.

Device and technical

Device identifiers, push-notification tokens, operating system and app version, IP address and browser or app user-agent recorded on sign-in and security events, and crash reports.

Delivery evidence

Proof-of-delivery photos and recipient signature images captured by the Captain at handover.

Usage

How you interact with the app — screens viewed, features used and searches — to operate, improve and secure the Services.

Information from other sources

If you sign in with Google or Apple, we receive your name, email and a sign-in identifier from them. For Captains, we receive the outcome status of identity verification and criminal-record checks from our verification vendors (not started / pending / clear / flagged / expired), the vendor reference and completion date — the full contents of a criminal record are not copied into our systems. For Store Partners, we receive establishment inspection status from Alberta Health Services’ public food-safety inspection feed.

3.Location information

Location is essential to the Services and we treat it carefully:

• Riders and customers. We collect your device’s precise location when the app is in use to set your pickup point, show nearby Captains and track your ride or delivery. You can enter addresses manually instead, but some features will not work without location permission.
• Captains. While you are online, the captain app reports your location so we can dispatch nearby requests and show riders your progress. Real-time positions are held only in short-lived memory (expiring within about 10 minutes) and are not written to our permanent database.
• During a trip. The location trail is held in memory for 24 hours. When the trip completes it is condensed into a route line stored with the trip record, together with the pickup and drop-off coordinates. Per-Captain daily activity summaries are aggregated to map cells of roughly 5 km and retained for planning.
• Shared live location. If you choose to share live location in a chat or with a trusted contact, the shared trail is retained for 30 days with the conversation.

4.How we use information

We use personal information to:

• Provide the Services — create and manage accounts, match requests with Captains and Store Partners, navigate, communicate between parties, process payments and payouts, issue receipts, and handle cancellations, refunds and lost items.
• Price and audit — calculate fares and fees from published rate tables, record the configuration used so every price can be reproduced, and detect pricing or dispatch errors.
• Safety and security — verify Captain identity and documents, monitor for expired credentials, investigate incidents and reports, moderate content, prevent fraud and abuse, protect accounts and enforce our terms.
• Support — respond to your requests, resolve disputes and improve support quality.
• Communicate — send transactional messages (confirmations, one-time codes, receipts, safety alerts) and, with your consent, marketing and promotional messages you can opt out of at any time.
• Improve and plan — analyse usage and aggregated activity to improve reliability, coverage and service design, and to plan where to expand.
• Legal and regulatory — meet tax-reporting, licensing, insurance, accounting and law-enforcement obligations, and establish or defend legal claims.

We do not sell personal information, and we do not use it to build advertising profiles for third parties.

5.Cookies & similar technologies

Our websites and web apps use cookies and similar technologies (local storage, device identifiers) to keep you signed in, remember preferences such as language and theme, protect against fraud and understand how the sites are used.

We do not use third-party advertising cookies. Where we use a consent banner on our websites, your choice is stored so we do not ask again for 12 months.

6.How we share information

With other users, to provide the service

• Riders → Captains: your first name, photo, rating, pickup and drop-off locations and any notes you add. Phone calls are routed through masked numbers so your real number is not shown.
• Captains → Riders: your first name, photo, rating, vehicle make, model, colour and plate, and your live location during the trip.
• Store orders: the Store Partner receives your first name, order contents, delivery address and any instructions; the delivering Captain receives the pickup store and your delivery details.
• Parcels: the recipient sees the sender’s name and live tracking; the Captain sees both parties’ names, phone numbers (masked where supported) and addresses.
• Family accounts: the organiser sees the managed member’s trips, live location during rides and receipts.

With service providers

We use carefully selected providers who process information on our behalf under contracts that restrict their use of it:

Other disclosures

• Insurers and claims. Trip records, route and timing may be shared with our insurers, a Captain’s insurer or their adjusters to investigate and settle a claim arising from a trip.
• Regulators and law enforcement. Where required by law, court order or a lawful request, to protect the safety of any person, or to enforce our terms.
• Business transfers. In connection with a merger, financing, acquisition or sale of assets, subject to confidentiality and this policy.
• With your direction. Where you ask us to share — for example sending a trip status link to a trusted contact.

7.Where information is stored

Our production systems and database are hosted in Canada (AWS Canada Central, Montréal, and MongoDB Atlas in a Canadian region). However, several of the providers listed above are headquartered in the United States and may access or process personal information from outside Canada under their own data-processing terms. While your information is outside Canada it may be subject to the laws of that jurisdiction, including lawful access by courts and authorities there.

If we launch in markets outside Canada, information about users in those markets is stored in the same Canadian infrastructure and processed by the same providers. We will provide additional notices required by local law (for example under Nigeria’s Data Protection Act) to users in those markets.

8.How long we keep it

We keep personal information only as long as needed for the purposes above, then delete or anonymise it. Current retention rules include:

When you delete your account, your identifying profile fields are removed and the account is closed. Records we must keep by law are retained for the required period in a restricted form, then deleted.

9.How we protect it

We use administrative, technical and physical safeguards appropriate to the sensitivity of the information, including: encryption in transit (TLS) and at rest; application-layer AES-256 envelope encryption for bank details and SIN; record-level access control so each user, Captain and Store Partner can reach only their own records; role-based administrative access with an append-only audit log of administrative actions; restricted-access storage for uploaded documents and delivery photos; signature verification of all payment-processor notifications; and masked phone numbers between users. No system is perfectly secure; if we become aware of a breach that creates a real risk of significant harm to you, we will notify you and the Privacy Commissioner as the law requires.

10.Your rights & choices

• Access and export. Request a machine-readable copy of your data in Account → Privacy → Export my data.
• Correction. Update your profile, saved places and payment methods in the app, or ask us to correct anything you cannot edit.
• Deletion. Delete your account in Account → Privacy → Delete account. We confirm by SMS and complete the deletion subject to section 8.
• Location. Control location permission in your device settings. Captains must keep location on while online.
• Notifications and marketing. Manage per-category notification consents in Account → Notifications. Transactional messages remain on while your account is active; marketing can be switched off at any time.
• Cookies and analytics. See section 5.
• Withdrawing consent. You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice; this may mean we can no longer provide some or all of the Services.

To exercise a right you cannot complete in the app, contact our Privacy Officer (section 14). We will verify your identity and respond within 30 days. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada or your provincial privacy regulator.

11.Children & family accounts

The Services are not directed at children under 13 and we do not knowingly collect their information. Teens aged 13–17 may use the Services only as a managed member of a Family account created by a parent or guardian, who consents on their behalf and can see the member’s trips, live ride location and receipts. Seniors may likewise be added as managed members by an authorised family member with their consent. If you believe we have collected information from a child without appropriate consent, contact us and we will delete it.

12.Automated decisions

Streetfast does not use artificial intelligence or machine learning for dispatch or pricing. Dispatch is a rules-based process: nearby available Captains are found in expanding radii, filtered for eligibility, ranked by proximity and offered the request. Pricing is a deterministic calculation from administrator-configured rate tables.

Some rule-based actions do occur automatically, without manual review: suspension of a Captain when a mandatory document expires (after reminders); suspension of a Store Partner reported as closed by a public-health feed; calculation and charging of published cancellation fees; exclusion from cash trips when a cash balance owed exceeds a threshold; eligibility for premium trip categories and tier upgrades based on rating, vehicle and trip-volume thresholds; and updates to document status from verification vendors. Rating-based suspensions, account suspensions, fraud determinations and content-moderation decisions are made by our team and recorded. You can ask us to review any automated decision that affects you by contacting support.

13.Changes to this policy

We may update this policy from time to time. We will post the new version here with a new effective date and, for material changes, notify you in the app or by email before they take effect. Continued use of the Services after that date means you accept the updated policy.

14.Contact us

Our Privacy Officer is responsible for this policy and for handling requests and complaints: