Privacy Policy

About This Policy

Truenorth Hub Inc. ("Truenorth Hub," "we," "us," or "our") is committed to protecting the personal information of everyone who uses our platform: Customers, Restaurants/Merchants, Delivery Partners, and visitors to our website and apps (collectively "you"). This Privacy Policy explains what personal information we collect, why we collect it, how we use and disclose it, how long we keep it, and the choices and rights available to you.

This Policy is designed to comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Newfoundland and Labrador privacy law, and with Canada's Anti-Spam Legislation (CASL) as it relates to electronic marketing messages. This Policy applies to the Truenorth Hub website, the Customer App, the Restaurant App, the Delivery Partner App, and the Admin Dashboard (collectively, the "Platform").

2. Our Privacy Officer

We have designated a Privacy Officer who is accountable for our compliance with this Policy and Applicable Law. You can reach out to us with any question, concern, or complaint about how we handle your personal information.

3. Information We Collect

The information we collect depends on how you use the Platform. We collect information directly from you, automatically through your use of the Platform, and in limited cases from third parties (such as payment processors and background-check providers).

3.1 All Users

Identity and contact information: full name, email address, phone number, password (stored in hashed/encrypted form).

Account and profile information: profile photo (optional), preferred language, communication preferences.

Device and usage information: IP address, device identifiers, browser/app version, operating system, app interaction and crash data, collected automatically through cookies and similar technologies (see Section 8).

Support communications: the content of messages, calls, or chats you exchange with our support team, including recordings or transcripts where applicable.

Approximate location derived from IP address, and precise location where you enable device location services.

3.2 Customers

Delivery address(es) and, where provided, delivery instructions (e.g., building access codes, unit number).

Order history, including items ordered, order value, special requests, and timestamps (visible to you in-app for 10 days from the order date; retained on our systems for longer periods as described in Section 6).

Payment information: we do not store your full card number. Card details are collected and stored by our third-party payment processor (e.g., Stripe); we retain a tokenized reference and the last four digits for your convenience and for dispute handling.

Precise real-time location while the Customer App is open and an active delivery is being tracked, where location permission is enabled.

Ratings, reviews, or complaint content you submit (where such features are enabled).

Age-verification information where age-restricted items are ordered in future platform phases.

3.3 Restaurants / Merchants

Business identity information: legal business name, business address, business registration/incorporation number, applicable food service licence or permit number issued by the relevant Newfoundland and Labrador health authority.

Authorized representative information: name, title, contact details of the individual(s) managing the Merchant Account.

Banking information for payout purposes (e.g., transit/institution/account number), collected and stored via our payment processor.

Menu content: item names, descriptions, prices, images, ingredient and allergen information you submit.

Order and transaction records, commission and fee statements, and any customer complaint or refund records associated with your listing.

Tax identification information (e.g., HST/GST number) where applicable.

3.4 Delivery Partners

Identity and eligibility information: full legal name, date of birth, government-issued photo identification, driver's licence number and class (where applicable), vehicle registration and insurance details, Social Insurance Number (for tax reporting purposes only).

Background check results obtained through a third-party screening provider, with your prior consent, as a condition of activation and periodic re-verification.

Real-time GPS location while you are online/available in the Delivery Partner App and throughout an active delivery.

Delivery records: pickup and drop-off timestamps, route/distance data, and the Proof of Delivery photograph captured at the point of drop-off.

Earnings, payout, and tax records, including information required to issue T4A or other Canada Revenue Agency slips.

Banking information for payout purposes, collected and stored via our payment processor.

4. How We Use Personal Information

Consistent with PIPEDA's requirement to identify purposes at or before collection, we use personal information only for the following purposes:

To create and administer Accounts, and to authenticate Users;

To process, fulfill, track, and support Orders, including connecting Customers, Merchants, and Delivery Partners as necessary to complete a delivery;

To process payments and payouts, issue receipts, and prepare required tax documentation;

To provide customer support and respond to inquiries, complaints, and disputes;

To verify identity, eligibility, and (for Delivery Partners) conduct background screening required for platform safety;

To detect, investigate, and prevent fraud, abuse, chargeback misuse, and violations of our Terms and Conditions or User Policy, and to enforce those Agreements;

To maintain the safety and security of Users, including through real-time location data, Proof of Delivery, and incident investigation;

To comply with legal, regulatory, and tax obligations, including responding to lawful requests from public authorities;

To analyze, maintain, and improve the Platform's performance, reliability, and features;

With your consent, to send you marketing and promotional communications, which you may opt out of at any time.

We rely on your consent (express or implied by the context of our relationship) as the primary basis for collecting and using personal information, and in limited circumstances rely on legal or contractual necessity (for example, retaining tax records as required by the Canada Revenue Agency, or disclosing information in response to a valid court order) as permitted under PIPEDA without additional consent.

5. How and With Whom We Share Information

We do not sell your personal information. We disclose personal information only as follows:

5.1 Between Users, as Necessary to Fulfill an Order

A Customer's name, delivery address, delivery instructions, and order contents are shared with the Merchant preparing the Order and the Delivery Partner assigned to deliver it.

A Delivery Partner's first name, photo, approximate real-time location, and vehicle type are shared with the Customer for order tracking and identification purposes, and with the Merchant for pickup coordination.

A Merchant's business name, address, and menu are shared with Customers browsing the Platform.

We limit the personal information shared between Users to what is reasonably necessary to complete the Order — for example, a Delivery Partner does not receive a Customer's full payment details, and a Merchant does not receive a Customer's exact real-time location.

5.2 Service Providers

We share personal information with third-party service providers who perform services on our behalf, including payment processing (e.g., Stripe), cloud hosting and data storage, background-check screening (for Delivery Partners), mapping and navigation services, SMS/email delivery, and customer support tooling. These providers are contractually required to protect personal information, use it only for the purpose we specify, and comply with Applicable Law. We conduct reasonable diligence on service providers that process personal information on our behalf.

5.3 Legal and Safety Disclosures

We may disclose personal information without your consent where required or permitted by PIPEDA, including: to comply with a valid subpoena, court order, warrant, or other lawful request by a government or law enforcement authority; to establish, exercise, or defend a legal claim; to investigate suspected fraud or violation of our Agreements; or where necessary to protect the life, health, or safety of a User or member of the public.

5.4 Business Transfers

If Truenorth Hub is involved in a merger, acquisition, financing, or sale of all or part of its business, personal information may be disclosed to the parties involved, subject to appropriate confidentiality protections, and you will be notified of any change in ownership or use of your personal information as required by law.

5.5 Aggregated and De-Identified Data

We may share aggregated or de-identified information (that does not identify you) with partners, for research, or for public reporting (for example, order volume trends by neighbourhood) without restriction under this Policy.

6. Cross-Border Storage and Transfer

Some of our service providers (for example, cloud hosting or payment processing infrastructure) may store or process personal information outside Canada, including in the United States. Where this occurs, that information becomes subject to the laws of the jurisdiction in which it is held, including lawful access requests by authorities in that jurisdiction. We contractually require service providers to provide a comparable level of protection to that required under Canadian privacy law, consistent with PIPEDA's accountability principle for information transferred for processing.

7. Data Retention

Order history is visible to Customers in-app for 10 days from the order date, consistent with the Platform's current feature scope; underlying order records are retained on our backend systems for longer periods as set out below.

Transaction, invoicing, and payout records are retained for a minimum of 7 years to meet Canada Revenue Agency recordkeeping requirements.

Delivery Partner background check results are retained for the duration of the Delivery Partner's active status and for a limited period after deactivation as needed for safety, legal, and insurance purposes, then securely deleted.

Proof of Delivery photographs are retained for [90 days], which we consider sufficient to cover the realistic window for delivery disputes, refund investigations, and insurance claims, after which they are deleted or anonymized unless retention is required for an active dispute or legal obligation.

Support communications and dispute records relevant to a claim are retained for the limitation period applicable to that claim (generally up to 2 years under the Limitations Act, and up to 6 years for certain claims), plus a reasonable administrative buffer.

We retain personal information only as long as reasonably necessary to fulfill the purposes identified in this Policy, or as required by Applicable Law, after which it is securely deleted, destroyed, or anonymized.

8. Cookies and Similar Technologies

We use cookies, SDKs, and similar technologies on our website and apps to keep you signed in, remember preferences, understand how the Platform is used, and measure the performance of marketing communications. You can control cookies through your browser settings and control app-level tracking and location permissions through your device settings; disabling certain cookies or permissions may limit some Platform functionality (for example, live order tracking requires location access).

9. Your Privacy Rights

Subject to limited exceptions under PIPEDA (for example, where information is protected by solicitor-client privilege, relates to an ongoing investigation, or where disclosure would reveal personal information about another individual), you have the right to:

Access the personal information we hold about you;

Request correction of inaccurate or incomplete personal information;

Withdraw consent to certain uses of your personal information (which may limit or prevent your ability to use parts of the Platform, for example, withdrawing consent to location collection will prevent live order tracking or dispatch, as applicable);

Ask questions about our privacy practices or file a complaint about how we have handled your personal information.

To exercise these rights, contact our Privacy Officer at [privacy@truenorth-hub.com]. We will respond within 30 days as required by PIPEDA, or provide notice if additional time is reasonably needed. If you are not satisfied with our response, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada (www.priv.gc.ca).

10. Marketing Communications and CASL

We will only send you promotional or marketing messages by electronic means (email, SMS, push notification) where you have provided express or implied consent in accordance with Canada's Anti-Spam Legislation (CASL). Every marketing message will identify Truenorth Hub, provide our contact information, and include a functional unsubscribe mechanism. You may withdraw consent at any time by using the unsubscribe link, replying STOP to SMS messages, or adjusting your notification preferences in-app; we will process opt-out requests within 10 business days as required by CASL. Transactional messages necessary to deliver the Platform's core service (such as order and delivery updates, safety notices, and Account/security notices) are not marketing messages and are not subject to opt-out under CASL, though certain notification types may be adjustable in-app.

11. Data Security

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, alteration, disclosure, or destruction, proportionate to the sensitivity of the information involved. These include encryption of data in transit and at rest for sensitive fields, access controls limiting internal access to personal information on a need-to-know basis, and regular review of our security practices. No system is completely secure, and we cannot guarantee absolute security. In the event of a breach of security safeguards involving personal information that creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as required by PIPEDA's mandatory breach reporting obligations, and will keep records of all such incidents.

12. Children's Privacy

The Platform is not directed at, and Accounts may not be created by, individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected personal information from a child, we will take reasonable steps to delete it.

13. Location Data — Additional Detail for Delivery Partners

Delivery Partners are subject to additional location tracking as a core function of dispatch, safety, and delivery verification. Precise GPS location is collected whenever the Delivery Partner App is set to "online"/available and throughout an active delivery, and is used to: assign nearby delivery opportunities, calculate estimated delivery times shown to Customers and Merchants, provide live tracking to Customers and Merchants for the duration of an active delivery, support safety monitoring and emergency response, and serve as evidence in the resolution of delivery disputes (see Terms and Conditions Section 4.3 and 7.3). Location collection stops, or is limited to coarse/IP-based location, when the Delivery Partner App is set to offline, subject to standard device-level background app permissions.

14. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices or Applicable Law. Where changes are material, we will provide notice through the Platform or by email at least 14 days before the changes take effect, and will update the "Last Updated" date at the top of this Policy. We encourage you to review this Policy periodically.

15. Contact Us

Questions, concerns, or complaints about this Policy or our handling of your personal information can be directed to: support@truenorth-hub.com