Privacy Policy

Who we are and what this policy covers

This Privacy Policy explains how Rydze (“we”, “us”) collects, uses, discloses, and retains personal information when you use the Rydze mobile application and the rydze.co website (together, the “Service”). It applies to every Member, whether you use Rydze as a Driver, a Passenger, or both.

Rydze is based in Quebec, Canada. This policy is written to meet the Act respecting the protection of personal information in the private sector (Quebec, as amended by Law 25) and the Personal Information Protection and Electronic Documents Act (Canada).

Definitions

“Personal information” means any information about an identifiable individual, including information that can identify you when combined with other information.

“Member”, “Driver”, “Passenger”, “Trip” and “Booking” have the meanings given in our Terms of Service.

“Trip route” means the sequence of GPS points recorded from the Driver’s device while a Trip is in progress. It is attached to the Trip, not to any one Member, and forms the shared record of that Trip for every Member who took part in it.

“Position pings” means the raw, timestamped GPS positions your device sends to Rydze while you have location sharing enabled. They are attached to your account.

“Service provider” means a third party that processes personal information on our behalf and under our instructions, such as our payment processor or identity verification provider.

Information we collect

Account information you provide: first and last name, email address, phone number, username, password (stored only as a one-way hash), and optionally your address, city, province, postal code, date of birth, sex, and profile photo.

Driver verification information: a photo of a government-issued identity document and a live selfie, processed by our identity verification provider; your driver’s licence number and expiry date; and photos of your vehicle registration and proof of insurance, with their expiry dates. These are reviewed by Rydze staff.

Payment information: card details are collected in the app by our payment processor, Stripe, and never reach Rydze’s servers. Rydze stores a payment customer identifier, the amounts authorized and charged for each Booking, and, for Drivers, the identifier of the connected payout account.

Location information: precise device location while the app is in use and, when you enable it, in the background during an active Trip. See “Location data” below.

Trip and activity information: Trips you post or book, pickup confirmations, ratings you give and receive, safety reports you file or that are filed about you, and support requests.

Device information: a push notification token so we can send you Trip notifications, and technical logs (device type, app version, IP address, timestamps) used to operate and secure the Service.

How we use your information

To operate the Service: create and secure your account, match Drivers and Passengers, confirm pickups with the pickup PIN, process authorizations and charges, pay Drivers, and send Trip notifications.

To verify Drivers: confirm the identity document and selfie match, and check that licence, registration, and insurance documents were submitted and are not expired.

For safety and fraud prevention: investigate safety reports, detect abuse of the Service, handle payment disputes, and comply with law.

To communicate with you about your account, Trips, and changes to the Service or to this policy.

To improve the Service using aggregated usage data. We do not sell personal information, and we do not use it for third-party advertising.

Location data

While the app is in use, we collect precise location to show nearby Trips, guide pickup, and record the route of a Trip in progress. If you enable background location, the app continues to send your position during an active Trip when the app is not on screen, so that the other Members on that Trip can see progress and so that the Trip route is complete.

Position pings attached to your account are deleted automatically seven (7) days after they are recorded, whether or not your account is still active.

The Trip route recorded during a Trip is kept as part of the Trip record. It is shared with the Members who took part in that Trip and is not deleted when one participant deletes their account, because it is the record of every rider on that Trip.

You can turn location permissions off at any time in your device settings.

How we share your information

With other Members: when a Booking is confirmed, the Driver and Passenger see each other’s name as displayed in the app, profile photo, and rating, and share the Trip route and progress. We do not disclose your phone number, email address, or home address to other Members.

With service providers: Stripe (payments and Driver payouts), our identity verification provider (document and selfie matching for Drivers), Amazon Web Services (hosting), and the Apple and Google push notification services. Each provider is bound to use your information only to provide its service to us.

For legal reasons: to comply with a law, court order, or lawful request from a public authority; to enforce our Terms; or to protect the safety of Members or the public.

In a business transfer: if Rydze is involved in a merger, acquisition, or sale of assets, personal information may be transferred to the successor, who will remain bound by this policy.

Cross-border transfers

Rydze’s servers and database are hosted with Amazon Web Services in the Canada (Central) region, in Quebec.

Some of our service providers process information outside Quebec and outside Canada. Stripe processes payment data in the United States. Our identity verification provider and the Apple and Google push notification services may process data in the United States or the European Union. Information processed outside Quebec is subject to the laws of the jurisdiction where it is processed, which may differ from Quebec law. Before transferring personal information outside Quebec, we assess whether it will receive adequate protection and put contractual safeguards in place with the provider.

Security

All traffic between the app and our servers is encrypted in transit using TLS. Passwords are stored as salted one-way hashes. Card numbers never reach our servers. Access to production systems is limited to authorized staff.

Deleting your account requires you to re-enter your password. Signing in with device biometrics alone is not enough to delete an account.

No system is perfectly secure. We cannot guarantee that unauthorized access will never occur, but we take the steps above and review them as the Service evolves.

Confidentiality incidents and breach notification

A confidentiality incident is any unauthorized access, use, disclosure, or loss of personal information. If an incident occurs, we take reasonable steps to reduce the risk of injury and to prevent new incidents of the same kind.

If an incident presents a risk of serious injury to you, we will notify you and the Commission d’accès à l’information du Québec (and, where required, the Office of the Privacy Commissioner of Canada) as required by law. We keep a register of confidentiality incidents.

Data retention

While your account is active, we keep your account, verification, Trip, and payment information for as long as needed to provide the Service.

When you request deletion, your account is scheduled for deletion after a thirty (30) day grace period. During the grace period you can cancel the deletion by signing in. At the end of the grace period we permanently delete or anonymize the following: your name, phone number, address, date of birth, sex, and profile photo are removed; your email address and password are replaced with an unusable placeholder; your linked sign-in accounts, push notification tokens, email verification tokens, and remaining position pings are deleted; your payment customer record at Stripe is deleted; and your name is removed from our audit logs.

Position pings attached to your account are deleted automatically seven (7) days after they are recorded, regardless of account status.

The following records are kept after account deletion: Trip routes, because they are the shared record of every Member on each Trip; ratings you gave and received; and safety reports, which are kept as safety records.

Driver identity verification records (identity document, selfie, and verification result) are retained for five (5) years after account deletion for fraud prevention and legal compliance.

Booking, charge, and payout records, ledger entries, and connected payout account identifiers are not deleted when your account is deleted. They are retained for tax, accounting, and payment dispute purposes and there is currently no scheduled deletion date for them.

Your rights

You have the right to access the personal information we hold about you, to ask that inaccurate or incomplete information be corrected, and to withdraw consent to uses that are not necessary to provide the Service. You may also file a complaint with the Commission d’accès à l’information du Québec or the Office of the Privacy Commissioner of Canada.

You can update most of your account information directly in the app. To exercise any other right, contact our Privacy Officer using the details below. We respond within thirty (30) days.

You can delete your account in the app (Profile → Account → Delete account) or by following the steps at rydze.co/delete-account. The retention section above explains what is deleted and what is kept.

Children

The Service is intended for adults. Under our Terms of Service you must be at least eighteen (18) years old to create an account. We do not knowingly collect personal information from anyone under eighteen. If you believe a minor has created an account, contact our Privacy Officer and we will delete the account.

Privacy Officer

Rydze has designated a person in charge of the protection of personal information, as required by Quebec law.

Title: Founder and Privacy Officer

Email: privacy@rydze.co

Changes to this policy

We may update this policy from time to time. The effective date at the top of the page shows the current version. If we make material changes, we will notify you in the app or by email before they take effect.