DRAFT — this document was generated as a starting point and has not been reviewed by a lawyer. Have counsel review it before publishing or relying on it.
Privacy Policy
Effective date: [TODO(navigrate): set upon publishing]
1. Who we are
Navigrate ("Navigrate," "we," "us," or "our") provides dispatch scheduling and drive-time routing software for field-service businesses. Navigrate is operated from Alberta, Canada.
TODO(navigrate): insert the registered legal entity name (e.g. "Navigrate Inc.") and registered business address once incorporated.
2. Information we collect
When you use Navigrate, we collect:
- Account information — the email address and password you use to sign up (passwords are handled by our authentication provider and never stored by us in plain text).
- Technician records you create — names, trades, vehicle identifiers, coverage areas, and home base addresses (including the coordinates we derive from them).
- Client/job records you create — your customers' names, phone numbers, and service addresses, plus job details and scheduling notes you enter.
- Usage data — basic technical information such as browser type and general error logs, used to keep the service running.
The client and technician data described above is entered by you as the account holder. Navigrate acts as a data processor for that information on your behalf.
3. How we use information
- To provide the dispatch scheduling and route-optimization service itself.
- To estimate drive times and geocode addresses, which requires sending address and coordinate data to the Google Maps Platform (see "Third parties" below).
- To process subscription payments, if you upgrade to a paid plan.
- To maintain, secure, and improve the product.
- To communicate with you about your account (e.g. billing or service notices).
We do not sell your data or your customers' data, and we do not use it for advertising.
4. Legal basis for processing (Canada)
Navigrate handles personal information in accordance with the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and, as an Alberta-based operator, Alberta's Personal Information Protection Act (PIPA). We collect, use, and disclose personal information only for purposes a reasonable person would consider appropriate in the circumstances, and only with consent where required.
5. Third parties we share data with
We use a small number of service providers ("sub-processors") to operate Navigrate. Each has its own privacy practices, which we encourage you to review:
- Google Maps Platform — receives addresses and coordinates to provide geocoding, mapping, and drive-time estimates.
- Stripe — processes subscription payments. Stripe hosts checkout directly; Navigrate does not receive or store your card details.
- Supabase — hosts our database and handles authentication. Your account and job data is stored on Supabase's infrastructure with row-level access controls so only your account can read your data.
- Netlify — hosts the Navigrate web application.
TODO(navigrate): confirm this list matches your actual production sub-processors before publishing, and add any others (e.g. an email or analytics provider) you adopt.
6. Data retention
We retain account, technician, and job data for as long as your account is active. If you close your account, we will delete or anonymize your data within a reasonable period, except where we're required to retain it for legal, accounting, or fraud- prevention purposes.
7. Your rights
Under PIPEDA and Alberta PIPA, you generally have the right to access the personal information we hold about you, request corrections, withdraw consent (subject to legal or contractual restrictions), and request deletion. To exercise any of these rights, contact us at info@navigrate.com.
8. Security
We apply row-level access controls so that each account can only read and write its own data, and data is encrypted in transit over HTTPS. No system is perfectly secure, and we can't guarantee absolute security.
TODO(navigrate): add any additional security practices you can truthfully claim (e.g. encryption at rest, backup policy, incident response process) once confirmed.
9. Children's privacy
Navigrate is a business tool and is not directed at, or intended for use by, children.
10. Changes to this policy
We may update this policy from time to time. If we make material changes, we'll update the effective date above and, where appropriate, notify account holders directly.
11. Contact us
Questions about this policy or your data can be sent to info@navigrate.com.