Privacy Policy

Last updated: March 21, 2026

🇨🇦 UPSO Technologies Inc. is committed to protecting your privacy in compliance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Ontario's privacy regulations.

1. Who We Are

UPSO Technologies Inc. ("UPSO", "we", "us") is a technology platform headquartered in Kingston, Ontario, Canada. We operate a multi-service marketplace connecting customers with restaurants, delivery providers, home service professionals, and peer-to-peer sellers. For privacy inquiries, contact our Privacy Officer at [email protected].

2. Information We Collect

2.1 Information You Provide

Account: Name, email address, phone number, password (hashed)
Profile: Photo, bio, languages spoken
Provider onboarding: Date of birth, emergency contact info, SIN/business number (encrypted), vehicle details, driver's licence number
Vendor onboarding: Business name, menu photos, kitchen photos
Payment: Processed by Stripe. We do not store your credit card number
Identity documents: Government ID, licences, certifications, insurance (uploaded)

2.2 Information Collected Automatically

Location data: Providers: GPS coordinates while on an active order, with consent
Location data: Customers: Your device location when you choose to share it, to fill in your address, show what is available near you, and set pickup and drop-off points. Collected only while you are using the app, never in the background.
Device info: Browser type, OS, screen resolution (device fingerprint for security)
Session data: Login timestamps, IP address, session tokens
Usage data: Pages visited, features used, order history

3. How We Use Your Information

Provide services: Process orders, match with providers, calculate delivery routes
Account security: Verify identity, detect fraud, prevent unauthorized access
Communications: Send order updates, verification codes (OTP), receipts, and platform notifications
Compliance: Meet CRA tax reporting obligations (T4A/T5018 for Providers)
Improve the platform: Analytics to understand usage patterns and enhance features
Safety: Background checks, GPS tracking for active orders, emergency contact access

4. GPS & Location Tracking

⚠️ Providers: GPS location is tracked only while you are on an active order. We do not track your location when you are offline or between orders.

📍 Customers: We ask for your device location so the app can fill in your address, show vendors and Pros that actually serve your area, and set pickup and drop-off points. It is read only while the app is open and only when you allow it- there is no background tracking, and we never follow you between orders. You can decline and type your address instead; everything still works.

Location data is used for:

Real-time dispatch and routing
Customer delivery tracking
Safety and incident investigation
Delivery time estimation

You may revoke GPS consent at any time, but this will prevent you from accepting orders.

5. Cookies & Session Management

UPSO uses:

Session cookies (upso_session): HttpOnly, encrypted, used for authentication. Expires after 7 days.
Local storage: Cart data, location preferences, theme settings
Session storage: Temporary form data (e.g., registration progress)

We do not sell your personal information. Some pages carry Google AdSense advertising, and Google may set its own cookies, you can control that in your Google Ads settings.

6. Data Sharing & Third Parties

We share personal information only as necessary:

Stripe: Payment processing and Provider payouts (Stripe Connected Accounts)
Resend: Transactional email delivery (verification codes, receipts)
Supabase: Secure cloud database hosting
Law enforcement: When required by law, court order, or to protect safety
Customers ↔ Providers: Limited sharing (first name, approximate location, order details) to facilitate service delivery

We never sell your personal information.

7. Data Retention

Active accounts: Data retained while your account is active
Closed accounts: Core data deleted within 90 days of account closure
Financial records: Retained for 7 years as required by CRA
Legal documents: Retained for the duration required by Ontario law
Location data: Retained for 30 days, then anonymized

8. Data Security

We implement industry-standard security:

Passwords hashed with bcrypt
SIN numbers encrypted at rest
HTTPS/TLS for all data in transit
HttpOnly, Secure session cookies
Rate limiting on authentication endpoints
Device fingerprinting for anomaly detection

No system is 100% secure. If a data breach occurs, we will notify affected users and the Office of the Privacy Commissioner of Canada as required by PIPEDA's breach notification requirements.

9. Your Rights Under PIPEDA

As a Canadian user, you have the right to:

Access: Request a copy of your personal information
Correction: Request correction of inaccurate data
Withdrawal of consent: Withdraw consent for data collection (may affect service availability)
Deletion: Request deletion of your personal information
Complaint: File a complaint with the Office of the Privacy Commissioner of Canada

To exercise these rights, contact [email protected]. We will respond within 30 days.

10. Children's Privacy

UPSO is not intended for users under 18 years of age. We do not knowingly collect personal information from children. If we learn that we have collected information from a child under 18, we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification at least 30 days before taking effect. Your continued use of UPSO after changes constitutes acceptance.

12. Contact Us

UPSO Technologies Inc., Privacy Officer

Kingston, Ontario, Canada

Email: [email protected]

Office of the Privacy Commissioner of Canada: priv.gc.ca