Privacy Policy

1. Who we are

Ayzen Dispatch ("Ayzen", "we", "us") provides dispatch software for courier and parcel delivery companies, used to manage orders, drivers and customers. This policy applies to the Ayzen Dispatch administrative dashboard, driver application, customer portal and public website. The organisation responsible for this policy is identified in section 16.

2. Accountability

The organisation identified in section 16 is accountable for personal information under its control, including information transferred to a third party for processing. The individual designated as accountable for compliance with this policy and with applicable privacy legislation may be reached at support@ayzendispatch.com, and correspondence sent to that address is treated as notice to that individual.

Where information is placed into the Service by a business that subscribes to it, that business decides what is collected and why. In that relationship the subscribing business is the controller and we act as processor on its documented instructions, on the terms of the Data Processing Agreement. This policy governs the information for which we are ourselves accountable.

3. What we collect

From businesses that sign up (our direct customers)

• Account information: company name, owner name, email address, and a password (stored securely by our authentication provider, we never see or store your password in plain text).
• Business details you enter: company address, phone number, invoice preferences and service pricing.

About your customers and drivers

If you use Ayzen to run your business, you will enter information about your own customers and drivers into the system. This includes:

• Customer names, addresses, phone numbers, and email addresses.
• Driver names, phone numbers, vehicle details, and (only after a driver taps "Start shift" in the driver app) their location, refreshed roughly every 30 seconds (including while the app is in the background, shown by a persistent notification on the phone), so their dispatcher can see where they are on the live map. Location sharing stops when the driver ends the shift. We keep only the most recent position, not a history of movements, and customers do not see driver locations.
• Order details: pickup and delivery addresses, package details, delivery photos, signatures, and delivery notes captured as proof of delivery.

You (the business using Ayzen) are responsible for having the right to share this information with us: for example, telling your own customers that their delivery is tracked and that delivery proof (photo/signature) is captured, in whatever way is required where you operate.

Technical information

Standard web server logs (IP address, browser type, pages visited, timestamps) collected automatically by our hosting infrastructure for security and troubleshooting.

4. What we do not do

Being specific about this matters as much as saying what we do collect:

• We do not process payments or store payment card details ourselves. Ayzen generates invoices and driver pay sheets; how you actually collect or send money is between you, your customers, and your drivers.
• We do not use advertising or cross-site tracking cookies, and we do not sell personal information to third parties.
• We do not run analytics or tracking scripts on the dashboard or customer portal today.

5. Purposes for which information is used

• To operate the service: creating accounts, dispatching orders, showing driver locations to their dispatcher during a shift, generating invoices.
• To communicate with you: account confirmation emails, password resets, and service-related notices.
• To keep the service secure and working, including diagnosing errors and preventing abuse.

6. Service providers and disclosure

We use a small number of infrastructure providers to run Ayzen. We don't sell or rent your data to anyone. Current providers:

• Supabase: hosts our database, file storage (delivery photos), and handles authentication.
• Cloudflare: hosts the web applications and provides security/performance infrastructure.
• Resend: delivers transactional emails (invitations, password resets, account notices).
• Stripe: processes subscription payments for the business that signs up. We never see card numbers.
• Mapbox: converts pickup and delivery addresses into map coordinates, and since September 2026 also draws the map inside the driver app. Drawing a map means the phone requests the tiles for the area on screen, so Mapbox can tell roughly where a driver is looking. We do not send them a driver's position, and they are not given the location trail.
• Sentry: receives crash reports from the driver app. Recipient names, delivery notes, signatures, photos and login tokens are removed on the phone before a report is sent.
• Expo: builds the driver app and delivers its push notifications.
• Google (Firebase Cloud Messaging): carries push notifications to Android phones. Expo hands each notification to Google for the final delivery, so Google sees the device's push token and the notification text, which names an order number and nothing else.

We may disclose information if required by law, or to protect the rights, safety, or property of Ayzen, our customers, or the public.

7. Retention and disposal

We keep your data for as long as your account is active. If you close your account, we will delete or anonymize your data within a reasonable period, except where we're required to keep records longer (for example, financial records) or where data has already been included in another party's records (such as a driver pay sheet already sent to a driver).

Some records are deleted on a fixed schedule regardless of account status. The delivery history behind an order, meaning who picked it up, when it was delivered and what changed along the way, is kept for seven years, which is how long a business is generally expected to be able to produce a transaction record. Requests for an account made through our website, and notifications we sent to a customer about their delivery, are kept for two years. Delivery photographs are kept for 30 days and then deleted from our storage and from our backup copy. The written record of the delivery, including who accepted it, when, and at what address, remains for the full seven years, so a delivery can still be shown to have happened after the photograph is gone. Jobs run on a schedule to remove anything past these points.

8. Where information is held and processed

The database and stored delivery photographs are hosted in Canada, in Amazon Web Services' central Canadian region, operated on our behalf by Supabase.

Certain service providers listed in section 6 operate outside Canada and receive limited information in the course of performing their function, for example an electronic mail address in order to deliver a message, or a street address in order to return map coordinates. While information is held or processed in another jurisdiction it is subject to the laws of that jurisdiction, and may be accessible to the courts, law enforcement agencies and national security authorities of that jurisdiction. We use contractual means to require a comparable standard of protection from each such provider.

9. Your rights, and how to exercise them

Subject to the limits set out below, you may request access to the personal information we hold about you, request correction of information that is inaccurate or incomplete, request deletion, withdraw a consent previously given, and ask for an account of how the information has been used and to whom it has been disclosed.

Direct your request to the right party. If you are a driver, a customer or a recipient of a business that uses Ayzen Dispatch, that business decides what is held about you and for how long. Your request goes to them. Where we receive such a request directly we will not action it ourselves; we will refer it to that business and tell you that we have done so.

If you hold an Ayzen Dispatch account yourself, write to support@ayzendispatch.com. We respond within thirty (30) days. Where a request is complex or numerous we may extend that period and will tell you before the original period expires, giving our reasons.

We will ask for information sufficient to satisfy us of your identity before acting, and will not ask for more than is necessary for that purpose. Access is provided without charge; where a request is manifestly unfounded or repetitive we may decline it or charge a reasonable fee, and will explain why.

A request may be refused in whole or in part where the law requires or permits refusal, including where disclosure would reveal personal information about another individual, where the information is subject to solicitor-client privilege, where it was generated in the course of a formal dispute resolution process, or where disclosure would prejudice the investigation of a breach of an agreement or of law. Where we refuse, we will say so in writing, give the reason, and tell you how to complain.

Withdrawing a consent does not affect processing carried out before the withdrawal, and may mean we can no longer provide part or all of the Service. We will tell you the consequences before acting on a withdrawal.

10. Safeguards

Safeguards are applied proportionate to the sensitivity of the information. Stated as what exists rather than as an aspiration:

• Every connection to the Service is encrypted in transit.
• Each subscribing business is separated from every other at the database level rather than only within the application, so one business cannot read another's records.
• Access is granted by role. A driver reaches only work assigned to them; a customer reaches only their own orders, and only the fields intended for a customer.
• Delivery photographs are stored privately and released only through a short-lived signed link, checked against the requester's entitlement to that delivery.
• Diagnostic reports from the driver application are stripped of recipient names, delivery notes, signatures, photographs and credentials on the device before transmission.
• Records past their retention period are removed by scheduled jobs rather than by manual action.

No system is completely secure. We do not warrant that the Service cannot be compromised, and nothing in this section is a guarantee against every form of attack.

11. If a breach occurs

Where we become aware of a breach of security safeguards affecting personal information under our control, we will assess whether it creates a real risk of significant harm, taking account of the sensitivity of the information and the probability of its misuse.

Where the information belongs to a subscribing business, we will notify that business without undue delay and in any event within seventy-two (72) hours of becoming aware, and will provide what it needs to meet its own obligations. Reporting to the Office of the Privacy Commissioner of Canada and notifying affected individuals is that business's responsibility as controller.

Where we are ourselves the controller of the affected information, we will report and notify as the law requires, and will maintain a record of the breach whether or not it was reportable.

12. Automated decisions and profiling

We do not make decisions producing legal or similarly significant effects about any individual by automated means, and we do not profile individuals. Features of the Service that order, group or estimate, such as route sequencing, delivery time estimates and price estimates, are tools presented to a dispatcher, who decides. The subscribing business is responsible for the decisions it takes with them.

13. Children's information

Ayzen Dispatch is a business tool and is not directed at children. We do not knowingly collect personal information from children under 16.

14. Residents of particular jurisdictions

Quebec. Where the law of Quebec applies, you may additionally request that personal information concerning you be communicated to you, or to a person or body you designate, in a structured, commonly used technological format; be informed of the personal information used to render a decision based exclusively on automated processing, and of the reasons and principal factors leading to it; and request that the dissemination of personal information concerning you cease, or that any hyperlink attached to your name that provides access to it be de-indexed, where the law so provides. The person in charge of the protection of personal information may be reached at the address in section 16. Before personal information is communicated outside Quebec, an assessment of the privacy-related factors is conducted where the law requires one.

United States. Where the privacy law of a United States state applies to information for which we are accountable, you may, subject to that law, request to know the categories and specific pieces of personal information collected about you, the sources, the purposes, and the categories of recipients; request correction or deletion; and appeal a refusal. We do not sell personal information, do not share it for cross-context behavioural advertising, and do not use or disclose sensitive personal information for any purpose that would give rise to a right to limit. We will not discriminate against you for exercising any of these rights. You may make a request by electronic mail to the address in section 16, and may designate an authorised agent to do so on your behalf, subject to verification. Where we process information on behalf of a subscribing business, we do so as its service provider, and requests should be directed to that business.

15. Changes to this policy

We'll update the date at the top of this page when this policy changes, and for material changes we'll make a reasonable effort to notify account holders directly.

16. Contact, complaints and responsible organisation

This policy is issued by Inayah Tech Solutions Inc., a corporation incorporated under the laws of the Province of Ontario, Canada, which operates the Service under the trade name Ayzen Dispatch and is the organisation accountable for the personal information this policy describes.

Questions about this policy, or a request concerning your own information: support@ayzendispatch.com. Correspondence is by electronic mail; we maintain no address for service by post.

If you are dissatisfied with how a request or a concern has been handled, say so to that address and ask for it to be reviewed. We will respond in writing, explain the outcome, and say what, if anything, we have changed as a result.

You are entitled to complain to the Office of the Privacy Commissioner of Canada at any time, whether or not you have raised the matter with us first. The Commissioner may be reached at priv.gc.ca or by telephone at 1-800-282-1376. Where you are a driver, customer or recipient of a business that uses the Service, your complaint will ordinarily concern that business as the controller of your information.