Privacy policy

1. Who we are

[WeFlok's registered company name] ("WeFlok") runs the WeFlok website and app. This policy explains what personal information we collect, why, who sees it and your choices. We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws.

Our privacy officer is [name], at privacy@weflok.co.

2. What we collect

• Account: your name, email address and password (stored scrambled; we can't read it).
• Profile: your photo, bio, and if you choose, your employer and job title. Your phone number, once phone verification is available.
• Commute: the places and times you drive or need a ride, such as points near your home and work, and the route you drive.
• Drivers: your car's make, model, colour, year, seats and plate; your licence number, province, class and expiry; your insurance company, policy number and expiry; and photos of those documents if you upload them.
• Trips: seat requests, bookings, cancellations, pick-up points, prices and, once payments are live, payment records. Card details are handled by our payment provider; we never see your full card number.
• Messages, reviews, reports, blocks and problem reports you send or receive in WeFlok.
• Settings: your notification and marketing email choices, and when you gave consent.
• Technical: the cookies that keep you logged in, and basic logs (such as IP address, browser and error reports) that keep WeFlok secure and working.

3. Why we use it

• To run WeFlok: create your account, match riders and drivers going the same way, handle bookings, chat and notifications, and, later, payments.
• To keep members safe: check driver documents, filter messages, handle reports and problems with trips, and suspend members who break the rules.
• To improve WeFlok and fix problems.
• To send marketing emails, only if you said yes. You can stop them at any time.
• To follow the law and respond to lawful requests.

We don't sell your personal information, and we don't use it for advertising by others.

4. What other members see

• Anyone using WeFlok: your first name, photo, bio, rating, reviews, badges (such as email verified and trips completed), late cancellations, and your employer and job title only if you chose to show them.
• Riders looking for a ride: a driver's general route, times, price, car make, model and colour, and trip preferences.
• People you book with: the pick-up and drop-off points for your trip, and your messages with them.
• Never shown to other members: your email, phone number, full home or work address, licence and insurance details, or car plate. [Confirm whether the plate should be shown to booked riders, as some carpool apps do for safety.]
• Share my trip: if you share a trip link, anyone with the link sees the driver's first name, car, the towns of your pick-up and drop-off, the time and a map, until the link expires 12 hours after the trip or you stop sharing.

5. When WeFlok staff look at your information

Only a small number of WeFlok staff can see member information, and only when needed. Your private messages aren't read as a matter of routine. When a member reports someone or a problem with a trip, staff may read the reported messages and the recent messages between the people involved to decide what to do.

6. Service providers

We use trusted companies to run WeFlok. They only use your information to provide their service to us:

• Supabase: database, login and file storage.
• Vercel: hosting the website.
• Mapbox: maps, place search and routes.
• Resend: emails. Twilio: text messages and phone verification. Stripe: payments. Sentry: error reports. [Added as these features go live.]

Some of these companies store information outside Canada, including in the United States, where it may be accessed by authorities under local law. [Confirm the Supabase region; a Canadian region keeps the database in Canada.]

7. Other times we share information

We may share information if the law requires it, to respond to a valid request from police or a court, to protect someone's safety in an emergency, or if WeFlok is sold or merged (the new owner would have to follow this policy).

8. How long we keep it

We keep your information while your account is open. When you close your account, we delete or anonymize it within [90 days], except what we need to keep longer for safety, disputes, fraud prevention, tax or legal reasons, such as payment records [7 years] and reports about serious safety issues [length to confirm].

Reviews you left may stay on other members' profiles without your name. [Confirm with the lawyer.]

9. Keeping it safe

Your information is encrypted when it travels to and from WeFlok. Database access is locked down so members can only reach their own information, and driver documents are kept in private storage. No system is perfectly secure; if a breach puts you at real risk, we'll tell you and the Privacy Commissioner as the law requires.

10. Your choices and rights

• See and change most of your information on your Profile page.
• Ask us for a copy of the personal information we hold about you, or to correct it.
• Turn notifications and marketing emails on or off in your settings.
• Close your account and ask us to delete your information by emailing privacy@weflok.co.
• Withdraw consent. Some things, like matching you with drivers, need your information to work, so we'll explain what changes.

We answer requests within 30 days. If you're not happy with our answer, you can complain to the Office of the Privacy Commissioner of Canada.

11. Cookies

We only use the cookies WeFlok needs to keep you logged in and secure. We don't use advertising cookies. [Update if analytics such as Vercel Analytics are added.]

12. Children

WeFlok is only for people 18 and over. We don't knowingly collect information from anyone younger. If you think a child has an account, tell us and we'll remove it.

13. Changes to this policy

We'll update this policy when WeFlok changes, and tell you about important changes before they take effect.

14. Contact

Questions or requests: privacy@weflok.co, or write to our privacy officer at [WeFlok's registered company name], [address].