SHIP-IT PRIVACY POLICY

Effective Date: April 4, 2026

Ship-It Technologies Inc. ("Ship-It", "we", "our", or "us") operates the Ship-It mobile application. This Privacy Policy explains how we collect, use, and protect your personal information under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's Anti-Spam Legislation (CASL), and Ontario's Consumer Protection Act, 2002.

1. WHO WE ARE
Ship-It Technologies Inc., Ontario, Canada
Privacy Officer: privacy@ship-it.ca

2. INFORMATION WE COLLECT

• Name and email address (via account registration)
• Pickup and dropoff addresses, package details
• Precise GPS location (drivers only, during active deliveries)
• Payment card details (tokenized via Stripe — raw card numbers are never stored by us)
• Proof-of-delivery photos and GPS confirmation
• In-app messages between senders and drivers
• Star ratings and written reviews
• Push notification token and device information

3. HOW WE USE YOUR INFORMATION

• To match senders with drivers and coordinate deliveries
• To display real-time driver location to the sender during a delivery
• To process payments and driver payouts
• To send delivery status notifications (push and email)
• To resolve disputes and provide customer support
• To comply with Canadian federal and Ontario provincial law

4. WHO WE SHARE YOUR INFORMATION WITH
We do not sell your personal information. We share it only as follows:

• Between users: pickup/dropoff addresses with the assigned driver; driver name, rating, and live location with the sender
• Stripe Inc. — payment processing (PCI-DSS Level 1 certified)
• Expo — push notification delivery
• Replit Inc. — authentication and cloud hosting
• OpenStreetMap/Nominatim — address geocoding (no personal data retained)
• Law enforcement or courts when required by law

5. DATA RETENTION

• Account data: retained while your account is active
• Delivery records: 7 years (Ontario Limitations Act, 2002)
• Driver GPS history: 90 days, then deleted
• Proof-of-delivery photos: 12 months, then deleted
• In-app messages: 12 months, then deleted
• Deleted accounts: personal identifiers removed within 30 days

6. YOUR RIGHTS (PIPEDA)
You have the right to access, correct, delete, or receive a copy of your personal information, and to withdraw consent at any time. Contact: privacy@ship-it.ca. We respond within 30 days.

7. SECURITY
All data is encrypted in transit (TLS 1.2+). Payment data is tokenized by Stripe. Driver location is only transmitted during active deliveries. In the event of a breach posing real risk of harm, we will notify affected individuals and the Office of the Privacy Commissioner as required by PIPEDA.

8. ELECTRONIC COMMUNICATIONS (CASL)
By creating an account you consent to transactional messages (delivery updates, receipts). Marketing messages require separate consent. Unsubscribe at any time via the link in any marketing email or by emailing privacy@ship-it.ca.

9. CHILDREN'S PRIVACY
Ship-It is for users 18 and older. We do not knowingly collect information from minors.

10. CROSS-BORDER TRANSFERS
Your data may be processed in the United States by Stripe and Replit. We require these providers to maintain equivalent privacy protections.

11. COMPLAINTS
Office of the Privacy Commissioner of Canada: priv.gc.ca | 1-800-282-1376
Information and Privacy Commissioner of Ontario: ipc.on.ca | 1-800-387-0073

12. CONTACT
Terence@ship-it.ca
Ship-It Technologies Inc., Ontario, Canada