Privacy Policy

1. Who We Are

NotifyOwner ("we," "our," or "us") is a global technology service that provides anonymous vehicle contact services. While we operate with a foundation in Canadian federal privacy law (PIPEDA), we are committed to protecting your personal information in accordance with international standards, including GDPR and CCPA.

2. What Personal Information We Collect

We collect personal information only to the extent necessary for the services we provide. This may include:

• Identity & Contact: Username, email address, phone number
• Vehicle Information: Vehicle make, model, color, and license plate (you provide)
• Emergency Contact: Name and phone number of an emergency contact (optional, voluntarily provided)
• Payment Information: Billing details processed by Stripe, Inc. We do not store card numbers — only subscription status
• Communication Records: Logs of when your QR code was scanned and messages relayed through our platform (content of messages from senders is not stored)
• Technical Data: IP address, browser type, device type, and timestamps collected automatically when you access the platform
• Visitor Logs: Approximate location (city-level), browser info, and scan timestamps from people who scan your QR code

We do not collect sensitive personal information such as health, financial, or biometric data.

3. Why We Collect It (Purposes)

Under PIPEDA Principle 4.2, we identify the purposes for which personal information is collected at or before the time of collection:

• To create and maintain your account
• To generate and link a unique QR code to your vehicle
• To relay anonymous communications from QR scanners to you via SMS, voice call, email, or WhatsApp
• To process payments for premium services
• To send service-related notifications and subscription alerts
• To comply with legal obligations
• To prevent fraud and abuse of the platform
• To improve our services through aggregated, anonymized analytics

4. How We Use Your Information

Your personal information is used exclusively for the purposes listed above. Specifically:

• Your phone number and email are used only to forward alerts when someone scans your QR code. They are never shared with the person scanning.
• Your vehicle information is associated with your QR code and stored on our servers to identify the correct contact person.
• Emergency contact information is used only if you initiate an emergency call through the platform.
• We do not sell, trade, or rent your personal information to third parties.
• We do not use your data for targeted advertising.

5. Consent

We obtain your consent at the time of account registration. By creating an account and checking the "I agree" checkbox, you expressly consent to the collection, use, and disclosure of your personal information as described in this policy.

You may withdraw your consent at any time by contacting us at privacy@notifyowner.ca. Note that withdrawal of consent may prevent us from providing certain services to you. Your account will be deactivated and your data deleted upon request, subject to legal retention requirements.

Implied consent is used for data that is clearly necessary for the service (e.g., storing your phone number to forward SMS alerts).

6. Third-Party Sharing & Disclosure

We share your personal information only with service providers who assist us in delivering our services, under contractual obligations to protect your data:

• Twilio Inc. — SMS messaging and voice call relay. Your phone number is transmitted to Twilio to forward communications. Twilio is SOC 2 Type II certified.
• Stripe Inc. — Payment processing. Your billing information is handled directly by Stripe under PCI DSS Level 1 standards. We never receive full card numbers.
• Google LLC — reCAPTCHA fraud prevention. IP address and behavioral signals are sent to Google during registration.

We may disclose personal information without consent only in limited circumstances, such as when required by law (e.g., a court order, lawful warrant, or government investigation under applicable legislation in your jurisdiction or Canada).

We do not sell personal information to data brokers, advertisers, or any third parties for commercial purposes.

7. Data Retention

We retain personal information only as long as necessary to fulfill the purposes for which it was collected, or as required by law:

• Account data: Retained for the duration of your account and up to 1 year after account deletion (for legal and dispute purposes)
• Billing records: Retained for 7 years as required by the Income Tax Act (Canada)
• Communication logs (scan events): Retained for 90 days, then purged
• Technical/security logs: Retained for 30 days

When data is no longer required, it is securely deleted or anonymized.

8. Security Safeguards

We implement security measures appropriate to the sensitivity of your personal information (PIPEDA Principle 4.7):

• Passwords are hashed using bcrypt — we never store plain-text passwords
• All data in transit is protected by TLS 1.2+ (HTTPS)
• Payment data is handled by PCI-compliant third parties (Stripe)
• Access to user data within our organization is limited on a need-to-know basis
• Visitor IP blocking is implemented to prevent repeated abusive access

In the event of a material privacy breach that poses a real risk of significant harm, we will notify affected individuals and applicable regulatory authorities (including the Office of the Privacy Commissioner of Canada (OPC) and relevant international bodies) as required by law.

9. Your Rights

Under PIPEDA, you have the right to:

• Access: Request a copy of the personal information we hold about you
• Correction: Request that inaccurate or incomplete personal information be corrected
• Withdrawal of consent: Opt out of non-essential data uses at any time
• Deletion: Request deletion of your account and personal data (subject to legal retention obligations)
• Accountability: File a complaint about how we handle your data

To exercise any of these rights, contact our Privacy Officer at privacy@notifyowner.ca. We will respond within 30 days as required by PIPEDA.

10. Cookies & Tracking

We use session cookies (PHP sessions) strictly for authentication purposes — to keep you logged in. We do not use tracking cookies, advertising cookies, or third-party analytics cookies.

Google reCAPTCHA may use cookies as part of its fraud detection process. This is disclosed in Google's Privacy Policy.

No persistent tracking identifiers are stored beyond what is necessary for service delivery.

11. Cross-Border Transfers

Some of our service providers (Twilio, Stripe, Google) are located in the United States. When your personal information is transferred to the U.S., it may be subject to U.S. laws, including laws that may allow access by U.S. government agencies. We have contractual data processing agreements with these providers to ensure appropriate safeguards are in place.

We disclose this cross-border transfer as required by PIPEDA and the OPC's accountability framework.

12. Children's Privacy

Our service is intended for individuals who are 18 years of age or older. We do not knowingly collect personal information from individuals under 18. If we become aware that we have collected such information, we will delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. For material changes, we will notify registered users by email at least 30 days before the change takes effect. Continued use of the service after the effective date constitutes acceptance of the updated policy.

15. California Privacy Rights (CCPA/CPRA)

If you are a resident of California, you have specific rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: You can request disclosure of the categories and specific pieces of personal information we have collected.
• Right to Delete: You can request the deletion of personal information we have collected from you.
• Right to Correct: You can request the correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: We do not sell or share your personal information for cross-context behavioral advertising.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

16. EEA, UK, & Switzerland Rights (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) and equivalent laws apply. Our legal bases for processing include:

• Contractual Necessity: To provide the NotifyOwner service you signed up for.
• Legitimate Interests: For security, fraud prevention, and service improvement.
• Consent: Where you have explicitly opted in (e.g., using optional paid services).

In addition to standard rights, you have the Right to Data Portability and the Right to Object to processing based on legitimate interests. When we transfer data out of the EEA/UK, we use Standard Contractual Clauses (SCCs) approved by the European Commission to ensure a high level of protection.

14. Contact Us & Complaints

Our designated Privacy Officer can be reached at:

If you are not satisfied with our response, you have the right to file a complaint with your local data protection authority or the Office of the Privacy Commissioner of Canada: