Last updated: 6 October 2026 (version 1.1)
Who we are and our two roles
For the data a company puts into its workspace (customers, recipients, drivers, orders) we are a processor: the company decides what is collected and why, and we handle it on its instructions under the Data Processing Agreement. For account, billing, sign-in security and website data, and for independent network drivers who sign up in the driver app, we are the controller.
Privacy contact: privacy@nemiroute.com. Our Privacy Officer is the person in charge of the protection of personal information under Québec's Law 25 and can be reached at the same address.
What we collect
Account data: name, work email, phone, role, sign-in times, IP address and device for security.
Customer contacts: name, email, phone, job title, notification preferences, and the orders, addresses and invoices they handle.
Recipients and on-site contacts: name, phone and address given on an order.
Drivers: name, contact details, date of birth, licence and ID details, documents, employer records, shift and time-clock records, and location as described below. Independent network drivers also provide application documents, vehicle details and consent for background checks.
Proof of delivery: photos and signatures.
Why, and on what basis
To run the service (contract). To keep accounts secure and prevent fraud (legitimate interest). To meet tax and accounting rules (legal obligation). For SMS and marketing email, location sharing and background checks, we rely on the person's consent, which they can withdraw; withdrawing does not undo earlier processing.
Location
Drivers' position is collected only while they are on shift (clocked in), online for offers (network drivers) or carrying an order, at an interval the company sets (by default every 45 seconds while delivering and every 5 minutes while waiting). Each point carries the position, its accuracy, speed, heading and the phone's battery level, so dispatch can tell a stopped driver from a phone that lost signal. It is shown to the company's dispatchers and, on the tracking link, to the customer for that order, and it is used to confirm the driver is at the stop before a pickup or delivery is completed. History is kept 30 days for company drivers (the company can change this) and 90 days for network drivers, then deleted.
Drivers turn location sharing off by ending their shift, going offline, finishing their last delivery, or turning location off for the app in the phone's settings. On Android a notification is shown for as long as location is shared.
The NemiRoute Driver app
Device and app: an install identifier, the phone platform and app version, and a push token so we can send job and shift notifications (through Firebase Cloud Messaging on Android and the Apple Push Notification service on iPhone, via Expo). Optional Face ID or fingerprint unlock stays on the phone; we never receive biometric data.
Camera and photos: proof-of-delivery photos, odometer photos and document, ID and selfie photos are taken with the camera, or picked from the photo library only when the driver chooses a picture. Proof-of-delivery photos carry the time they were taken and the position; other photo metadata is removed. Signatures and notes the driver enters are kept with the order.
Messages the driver writes to dispatch, issues they report, and their earnings, statements and cash-on-delivery records.
Maps and navigation: maps in the app are drawn by Google Maps (Android) or Apple Maps (iPhone); navigation hands the address to the Google Maps, Waze or Apple Maps app the driver picks.
Payout bank details are entered on Stripe's own page and never reach us. Crash reports (error details, app version, a pseudonymous id) are sent to Sentry when error reporting is turned on; no screenshots or on-screen text are included.
Shared with: the courier company the driver works for (profile, documents, location, proof, messages, hours and pay), the recipient of an order (on the tracking link, as the courier company configures it: the driver's name and photo, live position and ETA while the order is on its way), and the service providers on the subprocessors page. We never sell driver data and the app shows no ads.
Deleting the account: in the app under Profile → Delete my account (also Location and privacy → Your data, and on the application screen for applicants), or as described on the account deletion page at /delete-account. Deletion runs after a 30-day grace period the driver can cancel; payout and tax records are kept 7 years and the courier company keeps proof of delivery for orders the driver completed.
Who sees it
Only the company that holds the data and our authorised staff when they support that company (every support session is recorded and shown to the company). Sensitive documents such as ID and licence images are visible only to the company's administrators or to our network reviewers, and every view is logged. We never sell personal data. The service providers we use are listed on the subprocessors page.
How long we keep it
Email and SMS logs 12 months. Routine audit entries 24 months; security-relevant entries 7 years. Driver push logs and job history 90 days. Rejected driver applications 90 days. Records you delete are kept 90 days for undo. Invoices and order financial records are kept 7 years for tax law, after which personal details on them are anonymised.
Your rights
In Canada (PIPEDA and, for Quebec, Law 25) and in US states with privacy laws, you can ask to see your data, get a copy, correct it, and ask us to delete it. Customer contacts do this from Profile in the customer portal; drivers in the driver app under Profile → Location and privacy (download) and Profile → Delete my account, or through the account deletion page; staff through a company administrator. We answer within 30 days. Deletion is scheduled with a 30-day grace period you can cancel, and is held back while you have open orders, unpaid invoices or a legal hold, which we explain to you.
Security
Data is encrypted in transit; databases and file storage are encrypted at rest by the hosting provider. Passwords are hashed, sessions can be revoked, access to sensitive documents uses short-lived links and is logged. If a breach puts people at real risk of harm we notify the company without undue delay so it can notify the people affected and the regulator.
Cookies
One session cookie per portal to keep you signed in, and your light/dark choice in local storage. No advertising or analytics cookies.
Transfers
Data is hosted in the region chosen for the deployment. Some providers process data in the United States; the subprocessors page says which, and our DPA contains the transfer terms. For people in Québec this means personal information may be stored and processed outside Québec; we assess and contractually protect those transfers as Law 25 requires.
Changes and complaints
We publish a new version with a changelog whenever this policy changes. You can complain to us first; you also have the right to complain to the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, or your state attorney general.