1. Our commitment
NotifyMe Inc. handles personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and its ten fair information principles. Where our customers operate in Alberta or British Columbia, our practices are also designed to align with the provincial Personal Information Protection Acts in force in those provinces.
We built this service on a simple idea: a person who spots a problem should be able to report it in ten seconds without creating an account. That means most of the people who interact with NotifyMe give us very little information, and we work to keep it that way.
2. Accountability — our Privacy Officer
NotifyMe Inc. has designated an individual accountable for compliance with this policy and with PIPEDA.
Privacy Officer: David Boe, President, NotifyMe Inc.
Email: privacy@notifymesolutions.com
Mail: NotifyMe Inc., Saskatchewan, Canada
Any question, access request, correction request or complaint about personal information should go to the Privacy Officer. We respond to access requests within 30 days as required by PIPEDA.
3. Who the people in our system are
NotifyMe involves several different kinds of people, and we handle their information differently. It is worth being explicit about who is who.
| Role | Who they are | What we hold |
|---|---|---|
| Customer | The fleet operator, waste hauler or business that subscribes to NotifyMe | Account and billing information, asset records, user accounts |
| Authorized user | Fleet managers, safety managers, dispatchers and administrators at the customer | Name, work email, work phone, role, login and activity records |
| Site contact | A site supervisor or foreman who uses a company PIN to request a bin service | The PIN used, GPS location, timestamp, report content; optionally a name if entered |
| Driver | A person driving a customer vehicle that carries a NotifyMe sticker | Reports associated with their assigned vehicle, and a driver identifier if the customer has assigned one |
| Reporter | A member of the public who scans a sticker and submits a report | Report content, optional photo, optional GPS, a one-way hash of IP address |
4. What we collect and why
4.1 From customers and authorized users
- Account information — name, business email, business phone number, company name, job title, province.
- Billing information — company billing address and subscription records. Payment card details are collected and stored by Stripe, our payment processor. NotifyMe never sees or stores full card numbers.
- Asset records — vehicle identifiers, licence plate numbers, unit numbers, bin identifiers, job site names and site locations that you enter or upload.
- Usage records — logins, dashboard activity, notification delivery status, and PIN attempts including failed attempts, which are logged for security.
We use this to provide the service, deliver alerts, bill you, support you, and keep your account secure.
4.2 From reporters (members of the public)
- Report content — the issue category selected and any free-text note.
- Photographs — only if the reporter chooses to attach one.
- Location — GPS coordinates from the reporter's device, only if they grant browser location permission. Declining does not prevent a report from being submitted.
- Technical data — a one-way SHA-256 hash of the reporter's IP address, plus device and browser type. We do not retain the IP address in readable form.
We use this to deliver the alert to the right customer, to prevent abuse and duplicate reporting, and to moderate content. Reporters are not required to create an account, provide a name, or provide contact details.
4.3 Automatically, from this website
We use Google Analytics to understand how the site is used, and a small number of cookies that keep the site working and remember your cookie choice. See section 11.
5. How we obtain consent
Customers and authorized users consent when they create an account and accept our Terms of Service. Reporters consent at the point of submission: the report screen states what will be collected and who it will be sent to before anything is submitted. Location permission is a separate, explicit browser prompt that can be declined.
You may withdraw consent at any time, subject to legal and contractual restrictions and reasonable notice. Withdrawing consent may mean we can no longer provide the service. Contact the Privacy Officer to withdraw consent.
6. Where your information is stored
Personal information collected through NotifyMe is stored and processed on infrastructure located in Canada, in the Canada Central region, hosted by Supabase on Amazon Web Services.
PIPEDA does not require that personal information be kept in Canada. Organizations may transfer personal information across borders provided it remains subject to a comparable level of protection. We keep Canadian customer data in Canada because it is the right default for the industries we serve and it removes a question our customers' procurement teams would otherwise have to ask.
A limited number of service providers listed in section 8 process data outside Canada. Where that occurs it is disclosed below, and personal information may be accessible to the courts, law enforcement, and national security authorities of the jurisdiction in which the provider operates.
7. Who we share information with
We do not sell personal information. We do not rent it, trade it, or share it for anyone else's advertising.
We disclose personal information only as follows:
- To the customer who owns the asset — when a report is submitted about a vehicle or bin, the report content, category, timestamp, GPS location and any photo are delivered to that customer. Reporter identity is never included.
- To service providers — as listed in section 8, under contract, for the purposes of operating the service.
- Where required by law — in response to a valid court order, subpoena, warrant, or other lawful requirement, or where permitted under PIPEDA without consent, including to investigate a breach of an agreement or a contravention of law.
- In a business transaction — if NotifyMe Inc. is involved in a merger, acquisition or sale of assets, personal information may be disclosed to the parties involved under confidentiality obligations, and you will be notified of any change in ownership or use of your personal information.
8. Service providers
| Provider | Purpose | Processing location |
|---|---|---|
| Supabase (on AWS) | Database, authentication, file storage | Canada (ca-central-1) |
| Vercel | Website hosting and content delivery | Global edge network |
| Stripe | Payment processing and subscription billing | United States, Canada |
| Twilio | SMS alert delivery | United States |
| SendGrid | Email alert and notification delivery | United States |
| Amazon Web Services (Rekognition) | Automated photo moderation | United States |
| OpenAI | Automated text moderation of report notes | United States |
| Google Analytics | Website usage measurement | United States |
| Google Workspace | Business email and correspondence | United States, Canada |
Each provider is contractually bound to protect the information it processes and to use it only for the purposes we specify.
9. Content moderation
Because anyone can submit a report, every submission is screened automatically before it reaches a customer. Text notes are screened by OpenAI's Moderation API. Photographs are screened by AWS Rekognition. Content flagged with high confidence is blocked automatically. Content flagged with lower confidence is held for review by a NotifyMe administrator. This is done to prevent harassment, explicit content and hate content from reaching our customers' staff.
Product-specific: defect reports and drivers
NotifyMeFleet delivers a defect report to two recipients at once — the driver assigned to the unit, and the safety or fleet manager. That means a driver's mobile number or work email is held in our system as an alert destination, supplied by the customer.
Reports are about equipment, but they involve a person
A defect report describes a vehicle, not a person's conduct. It nevertheless attaches to the unit the driver was operating, and over time forms a record associated with that driver's assignments. Customers should treat that record as employee information and handle it accordingly.
Guidance for customers. Tell your drivers that units carry a reporting decal and that alerts go to them as well as to management. Drivers respond very differently to a system that tells them their inner dual is flat than to one they discover after the fact. It also removes any argument later about whether notice was given.
Custom redirect destinations
Where a customer configures a unit to route scans to their own system, NotifyMe stores the destination URL and performs the redirect. We do not collect, receive, or process any personal information submitted at that destination, and this policy does not extend to it. The operator of that destination is the customer.
10. How long we keep information
| Information | Retention |
|---|---|
| Customer account and asset records | For the life of the account, then 24 months after closure |
| Reports and alert history | 7 years — customers rely on this record for safety documentation, audits and liability claims |
| Report photographs | 24 months, then deleted |
| Blocked or rejected submissions | 90 days, for abuse prevention |
| Hashed reporter IP records | 12 months, for rate limiting and abuse prevention |
| Billing and tax records | As required by the Income Tax Act and the Excise Tax Act — generally 6 years |
Information no longer required for the purpose it was collected, and not subject to a legal retention requirement, is deleted or anonymized.
11. Cookies and analytics
This site uses:
- Essential storage — a browser localStorage entry (
nmf_ca_cookie_consent) recording your cookie choice so we do not ask again. - Analytics — Google Analytics 4, which sets cookies to measure page views and traffic sources. IP addresses are anonymized by Google Analytics 4 by default.
You can decline non-essential cookies using the notice shown on your first visit, and you can clear cookies and site data at any time through your browser settings. Most browsers also offer a Do Not Track setting; there is currently no consistent industry standard for responding to it.
12. Safeguards
- All data in transit is encrypted using TLS 1.2 or higher.
- Licence plates and other sensitive identifiers are encrypted at rest using AES-256.
- Reporter IP addresses are stored only as one-way SHA-256 hashes and cannot be reversed.
- Access to production data is limited to personnel who require it, and is logged.
- Company PINs are stored hashed. Three failed attempts lock the submitting device for 24 hours.
- Passwords are hashed and salted. We never store them in readable form.
No system is perfectly secure. If a breach of security safeguards creates a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada and notify affected individuals as required by PIPEDA, and we will maintain records of breaches as required.
13. Your rights
Under PIPEDA you have the right to:
- Access the personal information we hold about you, and be told how it has been used and to whom it has been disclosed;
- Correct information that is inaccurate or incomplete;
- Withdraw consent, subject to legal and contractual restrictions;
- Challenge our compliance with this policy and with PIPEDA.
Write to the Privacy Officer at privacy@notifymesolutions.com. We will respond within 30 days. We may ask you to verify your identity before releasing information. In limited circumstances set out in PIPEDA we may not be able to provide access — for example where doing so would reveal personal information about another individual, such as a reporter.
A note on reporter anonymity. We deliberately do not collect information that would let us identify a reporter, and we will not attempt to re-identify one at a customer's request. This is a design choice: people report problems more readily when there are no personal consequences for doing so.
14. If you are not satisfied
If you have raised a concern with our Privacy Officer and are not satisfied with the response, you may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca or 1-800-282-1376. Residents of Alberta and British Columbia may also contact their provincial Information and Privacy Commissioner.
15. Children
NotifyMe Solutions is a business-to-business service and is not directed at children. We do not knowingly collect personal information from anyone under 16. If we learn that we have, we will delete it.
16. Changes to this policy
We may update this policy from time to time. The effective date at the top of this page will change, and material changes will be communicated to account holders by email at least 30 days before they take effect.
17. Contact
NotifyMe Inc.
Privacy Officer: David Boe
Saskatchewan, Canada
privacy@notifymesolutions.com · info@notifymesolutions.com