Privacy Policy

This Policy is drafted in English. Translations are provided for convenience; if a translation conflicts with the English version, the English version prevails, except where French is required by Quebec's Charter of the French Language (Bill 96). Qikvo Privacy Policy Effective Date: September 27, 2026 | Last Updated: September 27, 2026 What changed on 27 September 2026: the app no longer contacts Nominatim (OpenStreetMap) or open-meteo at all, so both were removed from Section 2.2 and Section 9. Section 6 now lists every service that receives your data, separated into those reached through our server and those the app contacts directly. Three address lookups used to carry the address in the request URL, which meant it could appear in our hosting provider's logs; they no longer do. Delivery photos, signatures and your mileage records are now stored as files rather than in browser storage, and Section 5 says so, including that they are covered by your own iCloud backup if you have it turned on. Qikvo ('we', 'us', 'our') is committed to protecting your privacy. This Policy governs how we collect, use, store, and disclose personal information when you use the Qikvo application ('App'). By using the App, you consent to the practices described herein. This Policy is written to the standard of the laws that apply to us: Quebec Law 25 (Act Respecting the Protection of Personal Information in the Private Sector, as amended); Canada's Personal Information Protection and Electronic Documents Act (PIPEDA); and the EU/UK General Data Protection Regulation (GDPR). Where a privacy law does not apply to a business of our size, we say so plainly rather than claim compliance with it — see Section 12 for the United States. 1. Privacy Officer As required by Quebec Law 25, we have designated a Privacy Officer responsible for overseeing compliance with this Policy. Privacy Officer: Christos Iliopoulos Email: privacy@qikvo.com Mailing: Qikvo, Montreal, Quebec, Canada You may contact our Privacy Officer to exercise any rights described in this Policy or to report a privacy concern. 2. Information We Collect 2.1 What you provide • Route data: stop addresses, names, cities, postal codes, delivery notes, phone numbers and time windows you enter. These are stored on your device. • Proof of delivery: photos, signatures and notes you capture. Stored on your device. The app requires no account. There is no sign-up, no password, no profile. We do not collect your email address, your name, or any payment information, and we hold no identity for you at all. 2.2 What leaves your device, and when On every route. Your stop addresses are sent to HERE to turn them into map coordinates. The coordinates of your stops, start and end are sent to Stadia Maps — or to HERE if Stadia is unavailable — to measure real driving distances and times and to draw your route line. These pass through our server, which adds our provider key and forwards them unchanged. Your route is not planned by AI. The order of your stops is calculated on your device, from the driving distances the mapping providers return. The one exception: if the mapping providers cannot be reached, your stop list is sent to Anthropic (Claude) as a fallback so that a route can still be produced. Only when you use the feature: • Paste, photo scan, AI Find, end-of-day debrief — the text or image you provide, and your stop list where relevant, go to Anthropic (Claude) to be read. • File import — a PDF you choose is sent to Anthropic (Claude) to be read. CSV and Excel files are read on your device and are not sent anywhere. • Voice — the audio of your speech streams from your device directly to AssemblyAI, not through our server, for transcription. • EV mode — coordinates along your route go to Open Charge Map to find charging stations. Contacted directly, without our server: the map tiles, and the AssemblyAI audio stream. Those services see your device's IP address. Everything else goes through our server. 2.3 What is collected automatically Nothing. The app contains no analytics, no crash reporting, no advertising identifier and no tracking of any kind. We do not know which features you use, how long you use them, or whether you opened the app today. The one exception is ordinary web-server logging: our hosting provider (Cloudflare) records the URL of each request made to our server. Three of our address lookups currently carry the address in the URL, which means an address can appear in those logs. 2.4 What we do not collect, and what we do not store We do not collect biometric identifiers, financial account numbers, health information, or government-issued identification numbers. Location. The app uses your device's location for three things: centring the map on you, setting your start or home address when you tap 'use current location', and re-planning from where you actually are. Electric-vehicle range is estimated from the coordinates of your route, not from a live location fix. To do these, coordinates are sent to the mapping providers named above. They are not stored on any server of ours — we operate no server that stores user data. Proof-of-delivery photos and signatures stay on your device and are never transmitted. Photographs you take to scan a list are different: those are sent to Anthropic to be read. Send only what you want read. Everything else — your stops, routes, mileage and earnings records — lives only in the app on your device. Deleting the app deletes them. 3. How We Use Your Information We use your information solely for the following purposes: • To calculate your route on your device, using distances from the mapping providers • To read the lists, speech and photographs you give us • To show maps and estimate EV range • To keep your mileage and earnings record on your device • To respond to your support requests • To comply with legal obligations We do not use your information for advertising, behavioural profiling, or sale to third parties, and we do not use it to train AI models. Automated Decisions: your route order, arrival times and schedule suggestions are produced automatically — the route order and arrival times by an algorithm running on your device, and some suggestions with the help of AI. These are recommendations only. You retain full control and final decision-making over your route. You have the right to understand and contest any automated output that materially affects you, as required by Quebec Law 25 and GDPR Article 22. 4. Legal Basis for Processing Depending on your jurisdiction, we process your personal information based on: • Contract performance: processing necessary to provide the App service you have agreed to use • Legitimate interests: improving the App, preventing fraud, ensuring security • Legal obligation: complying with applicable law • Consent: for any optional data collection or marketing communications (you may withdraw consent at any time) For Quebec residents: collection, use, and disclosure of your personal information is governed by Quebec Law 25. We collect only the minimum information necessary (data minimization principle) and retain it only as long as required for its stated purpose or by law. For EU/UK users: our legal bases under GDPR are Article 6(1)(b) (contract), Article 6(1)(c) (legal obligation), and Article 6(1)(f) (legitimate interests). No special category data under Article 9 is processed. For California residents: we do not sell your personal information (as defined under CCPA/CPRA) and do not share it for cross-context behavioral advertising. 5. Data Storage & Security 5.1 Local Storage Your route data, saved routes and schedules are stored on your device in the app's local storage. Delivery photos, signatures and your mileage records are stored as files inside the app on your device. All of it stays on your device unless you explicitly share it or use AI features (see Section 2.2). These files are included in your device's own iCloud backup if you have it turned on — that copy is yours, held by Apple under your Apple ID, and we have no access to it. 5.2 Subscription Qikvo has no accounts. There is no sign-up, no password, and no profile, so there is no account record for us to hold. Pro subscriptions are purchased and managed entirely through the Apple App Store, which handles payment and billing under its own privacy policy — we never see your payment details, and we do not receive or store your email address. Your subscription status is held on your device. 5.3 Security Measures Traffic between the app and the services it contacts uses TLS 1.3 and HTTPS only. Because your data stays on your device and we operate no server that stores it, the strongest protection here is structural rather than procedural: there is no database to breach, no credentials to steal, and no copy of your route history anywhere but your phone. 5.4 Data Retention Route data, saved routes and schedules: stored on your device until you delete them or uninstall the app. Mileage records: stored on your device until you uninstall the app — there is no way to delete an individual record from within the app, because it is a financial record you may need to produce. Delivery photos and signatures: deleted automatically 90 days after they are captured, including for stops you have removed from a route. Technical diagnostic information: deleted automatically after 7 days. We hold no copy of any of it, so we have nothing to retain and no retention period to apply on our side. AI API logs: Anthropic retains API logs under its own retention policy. We keep no logs of AI queries. 5.5 Data Breach Notification In the event of a data breach posing a risk of serious injury, we will notify the Commission d'accès à l'information du Québec (CAI) and affected individuals as soon as reasonably possible, as required by Quebec Law 25 and PIPEDA. Notification will include the nature of the breach, data involved, remediation steps taken, and contact information for our Privacy Officer. 6. Sharing of Information We do not sell, rent, or trade your personal information. Qikvo uses a small number of specialist services to turn your addresses into a route. Most are reached through our own server, which adds our provider key and forwards your request unchanged — it stores nothing. A few are contacted by the app directly, which means those services also see your device's IP address. Reached through our server: • Anthropic (Claude), USA: the text, images and PDFs you ask us to read, the transcripts of your voice entries, and your stop list if the mapping providers cannot be reached. Governed by a Data Processing Agreement. • HERE Global B.V.: your stop addresses and the text of your AI Find searches, to turn them into coordinates or find places, and your coordinates, to turn them back into addresses. • Stadia Maps: the coordinates of your stops, start and end, to measure real driving distances and draw your route line. • Open Charge Map: coordinates along your route, to find charging stations, only when EV mode is on. Contacted directly by the app, which also see your IP address: • Stadia Maps (map tiles): which part of the map you are looking at, so the map can be drawn. • AssemblyAI: the audio of your speech, only while you are using voice entry. It is transcribed and discarded; AssemblyAI keeps billing metadata but not your recording or its text. Others: • Apple (App Store): subscription billing. Apple is an independent data controller subject to its own privacy policy. We receive no payment details from it. • Cloudflare: our server runs on Cloudflare, which records technical details of each request, such as the IP address and the web address requested. Those records contain no stop addresses or coordinates. • Legal authorities: when required by a valid court order, subpoena, warrant, or applicable law. We will notify you of such requests unless prohibited by law. • Business transfers: if Qikvo is acquired or merges, your data may be transferred to the successor entity subject to equivalent privacy protections. You will be notified in advance. Cross-Border Data Transfers: AI processing by Anthropic and speech transcription by AssemblyAI involve transfer of data to servers in the United States. For EU/UK users, transfers are conducted under Standard Contractual Clauses (SCCs) compliant with GDPR Chapter V. 7. Your Privacy Rights Depending on your jurisdiction you have the rights below, and none of them is narrowed by anything in this policy. They apply in full to any personal information we hold about you. What changes is how you exercise them, and it works in your favour. Because your data lives on your device and we operate no server that stores it, you do not need to ask us and you do not need to wait. Uninstalling Qikvo erases everything the app holds, immediately and completely — there is no server copy to follow up, no backup of ours to reach and no 30-day process to sit through. Deleting a stop removes it from your route; the mileage record for a completed delivery is kept, because it is a financial record you may need, and its delivery photo and signature are removed automatically 90 days after capture. If you have iCloud backup turned on, a copy of the app's files may exist in your own iCloud account, which you control through Apple. Your mileage and earnings records can be exported to CSV or PDF from the app at any time, which lets you exercise your right to portability without having to ask us. ✓ Right to access: obtain a copy of your personal information ✓ Right to rectification: correct inaccurate personal information ✓ Right to erasure / right to be forgotten: request deletion of your personal information ✓ Right to data portability (Quebec Law 25, GDPR): receive your data in a structured, machine-readable format (effective September 22, 2024 under Law 25) ✓ Right to withdraw consent: withdraw any consent previously given, without affecting prior lawful processing ✓ Right to de-indexation (Quebec Law 25): request that certain information be de-indexed from search results where applicable ✓ Right to object to automated decision-making: request human review of AI-generated routing decisions that materially affect you These rights are unaffected by the fact that we hold almost nothing to exercise them against. Where we do hold something — a support email you send us, for example — contact privacy@qikvo.com and we will respond within 30 days, as required by Quebec Law 25 and GDPR. ✓ Right to lodge a complaint: with the CAI (Quebec), OPC (Canada), your national data protection authority (EU/UK), or the California Privacy Protection Agency (CPPA) Quebec residents have an additional private right of action under Law 25 for intentional violations or gross negligence, with minimum damages of CAD $1,000. California residents: We do not discriminate against users who exercise their CCPA/CPRA rights. Minors: We do not knowingly collect data from children under 14 (Quebec Law 25) or under 13 (USA, COPPA). If you believe a minor has provided data to us, contact privacy@qikvo.com immediately. 8. Cookies & Tracking Qikvo is a mobile application and does not use browser cookies. We do not use tracking pixels, cross-site tracking, or behavioral advertising technologies. As required by Quebec Law 25, we do not activate any technology that could identify, locate, or profile you without your explicit prior consent. 9. Third-Party Services The App integrates with third-party navigation apps (Apple Maps, Google Maps, Waze, etc.) when you tap Navigate. Qikvo passes only the destination address to your chosen navigation app. Each navigation provider's privacy policy governs their data use. This Privacy Policy does not govern third-party services. We encourage you to review their policies. 10. Policy Updates We may update this Policy from time to time. Material changes will be communicated through an in-app notice at least 30 days before taking effect. Continued use of the App after the effective date constitutes acceptance of the updated Policy. The current version of this Policy is always accessible within the App under Settings → Privacy Policy. 11. Contact & Complaints Privacy Officer: privacy@qikvo.com General Support: support@qikvo.com Qikvo is operated by Christos Iliopoulos, Montréal, Québec. Quebec / Canada: Commission d'accès à l'information du Québec — www.cai.gouv.qc.ca EU/UK: Your national data protection authority (list at edpb.europa.eu) California: California Privacy Protection Agency — cppa.ca.gov 12. United States residents Legal thresholds. United States state privacy laws apply to companies above certain size thresholds. Qikvo is below all of them: we do not have annual gross revenue over $25 million, we do not process the personal information of 100,000 or more residents of any state, and we derive no revenue at all from selling personal information. We therefore do not claim compliance with California's CCPA/CPRA or the equivalent laws of other states — they do not apply to us. The rights described below are offered voluntarily and do not depend on a law requiring them. We do not sell or share your personal information. We use those words with the meaning the state privacy laws give them: we do not sell personal information for monetary or other valuable consideration, and we do not share it for cross-context behavioural advertising. We never have, and the app contains none of the technology that would make it possible. Precise location. Several states classify precise geolocation — a location accurate to within a radius of 1,750 feet (about 533 metres) — as sensitive data. Qikvo uses your device's precise location for three things: centring the map on you; setting your start or home address when you tap 'use current location', which sends those coordinates to HERE to turn them into an address; and re-planning your route from where you actually are. Estimated electric-vehicle range is calculated from the coordinates of your route, not from a live location fix. None of it happens until you grant the iOS location permission, you can withdraw that permission at any time in iOS Settings, and the app works without it. Your coordinates go only to the providers listed in Section 6, only to calculate your route. We keep no copy: we operate no server that stores user data. We never sell or share your location, and we never use it for advertising, profiling, or training AI models. 'Do not track' signals. Qikvo is a mobile app, not a website. It contains no browser and uses no cookies, so it never receives a browser 'Do Not Track' signal and does not respond to one. Nothing is lost by that: the app does no tracking that such a signal could switch off. We also do not allow any other party to collect information about your activity over time or across different websites or apps. Your choices, offered voluntarily. You may request access to, correction of, or deletion of any personal information we hold by writing to privacy@qikvo.com. We will respond within 30 days. In practice we hold very little: your stops, routes, mileage and earnings live only on your device, so uninstalling the app erases them immediately and completely, with no copy of ours left behind. We do not discriminate against anyone who exercises any of these rights. Minors. Qikvo requires you to be at least 18 years old. The app is not directed to children under 13 and we do not knowingly collect personal information from them (COPPA, 15 U.S.C. §§ 6501 et seq.). If you believe a child has provided us with information, write to privacy@qikvo.com and we will delete it. Qikvo — Montreal, Quebec, Canada