Privacy Policy

Effective June 2026  ·  PIPEDA-compliant  ·  privacy@haulor.ai

1. Data We Collect

Identity: Full name, date of birth, and government-issued ID. Identity documents are processed by Bluink eID-Me — Haulor does not store raw ID images.

Business: Company name, CVOR number, NSC number, operating authority number, and insurance certificates.

Financial: Payment information is managed by Stripe — Haulor does not store card numbers or banking credentials. We retain Stripe transaction IDs and payout records for accounting purposes.

Operational: Load postings, bids, delivery records, and GPS location data (carriers only; collected with explicit per-load consent).

Technical: IP address, browser and device information, and session logs for security and fraud prevention.

2. Why We Collect It

• Identity and business data — carrier verification and compliance with Transport Canada regulations
• Financial data — processing payments and carrier payouts via Stripe Connect
• GPS location — real-time shipment tracking (explicit per-load consent required; see Section 5)
• Technical data — security monitoring, fraud prevention, and platform improvement

3. Canadian Data Residency

All personal data is stored in AWS ca-central-1 (Montréal, Québec). No personal data is transferred outside Canada except to our service providers listed in Section 4, each of whom is bound by appropriate data protection agreements.

4. Third Parties

• Stripe Inc. — payment processing. Governed by Stripe’s Privacy Policy.
• Bluink Ltd. — identity verification. Canadian company; governed by Bluink’s Privacy Policy.
• Amazon Web Services — cloud infrastructure. Data stored exclusively in ca-central-1.

We do not sell, rent, or trade your personal data to any third party.

5. GPS and Location Tracking

GPS tracking is only activated for carriers who provide explicit per-load consent through the Haulor app. You may withdraw consent at any time; tracking stops immediately. Location data is retained for 90 days after load completion, then permanently deleted.

6. Data Retention

• Financial records — 7 years (CRA compliance)
• Load and operational records — 3 years
• Account data — duration of active account, plus 2 years after closure
• GPS/location data — 90 days after load delivery
• Security logs — 12 months

7. Your Rights Under PIPEDA

You have the right to:

• Access — request a copy of the personal data we hold about you
• Correction — request correction of inaccurate or incomplete data
• Withdrawal of consent — for non-essential processing (GPS tracking, marketing communications)
• Deletion — request deletion of your data, subject to legal retention obligations
• Complaint — file a complaint with the Office of the Privacy Commissioner of Canada

To exercise any of these rights, email privacy@haulor.ai with the subject line “Privacy Request”. We will respond within 30 days.

8. The Ten PIPEDA Principles

Haulor adheres to all 10 fair information principles under PIPEDA: Accountability, Identifying Purposes, Consent, Limiting Collection, Limiting Use, Disclosure and Retention, Accuracy, Safeguards, Openness, Individual Access, and Challenging Compliance.

9. Security

All data is encrypted at rest (AES-256) and in transit (TLS 1.2+). Encryption keys are managed by AWS KMS in ca-central-1. Access to personal data is restricted to authorised personnel and is subject to audit logging.

10. Changes to This Policy

We will notify you by email at least 14 days before any material changes take effect. Continued use of the platform after the effective date constitutes acceptance.

11. Contact

Privacy Officer: privacy@haulor.ai
Haulor Technologies Inc., Canada